IP Library › Granted Patent US 12,267,357
Granted Patent B2
US 12,267,357 · App. 17/672,502 · Granted Apr 1, 2025

Verifying the trust-worthiness of ARP senders and receivers using attestation-based methods

Inventors: Sujal Sheth (Gujarat, IN); Shwetha Subray Bhandari (Bangalore, IN); William F. Sulzen (Apex, NC); Frank Brockners (Cologne, DE)
Assignee: Cisco Technology, Inc.
H04L63/1466H04L61/103H04L63/126
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12,267,357
App. No.
17/672,502
Granted
Apr 1, 2025
Kind
B2
Abstract

Systems, methods, and computer-readable media for assessing reliability and trustworthiness of devices operating within a network. An ARP responder can receive an ARP request from an ARP requestor for performing address resolution between the ARP requestor and the ARP responder in a network environment. The ARP responder can build an ARP response including attestation information of the ARP responder. Further, the ARP responder can provide, to the ARP requestor, the attestation information for verifying the ARP responder using the ARP response and the attestation information of the ARP responder.

Claims (50)

1. A method comprising:

receiving, at an Address Resolution Protocol (ARP) responder, an ARP request from an ARP requestor for performing address resolution between the ARP requestor and the ARP responder in a network environment, wherein the ARP request includes requestor attestation information of the ARP requestor for verifying trustworthiness of one or more of hardware and software associated with the ARP requestor;

verifying trustworthiness of the ARP requestor using the requestor attestation information of the ARP requestor included in the ARP request;

performing the address resolution between the ARP requestor and the ARP responder based on whether the ARP requestor is verified as trustworthy or untrustworthy;

building, by the ARP responder, an ARP response including attestation information of the ARP responder;

providing, from the ARP responder to the ARP requestor, the ARP response and the attestation information of the ARP responder for verifying the ARP responder using the ARP response and the attestation information of the ARP responder; and

verifying the ARP responder based on at least one or more attestation information of the ARP responder that is verified before the ARP request is received.

2. The method of claim 1 , further comprising:

extracting a media access control (MAC) address of the ARP responder and an Internet Protocol (IP) address of the ARP responder from the ARP response; and

adding an ARP entry including a mapping of the MAC address of the ARP responder with the IP address of the ARP responder.

3. The method of claim 1 , further comprising facilitating ARP attack mitigation in the network environment if the ARP responder is not verified using the attestation information in the ARP response.

4. The method of claim 3 , wherein the ARP attack mitigation includes refraining from adding an entry including a mapping of a MAC address of the ARP responder with an IP address of the ARP responder in an ARP mapping data store.

5. The method of claim 3 , wherein the ARP attack mitigation includes sending an alert indicating that the ARP responder failed verification using the attestation information.

6. The method of claim 3 , wherein the ARP attack mitigation includes creating a log entry indicating the ARP responder failed verification using the attestation information and a mapping of a MAC address of the ARP responder with an IP address of the ARP responder.

7. The method of claim 1 , further comprising sending the attestation information of the ARP responder from the ARP requestor to a verifier, wherein the verifier is configured to remotely verify the ARP responder using the attestation information of the ARP responder received from the ARP requestor.

8. The method of claim 1 , further comprising:

stapling, by the ARP responder, the attestation information included in the ARP response with a verifier signed key, wherein the verifier signed key is generated based on a verifier validating the attestation information; and

sending the ARP response including the attestation information with the verifier signed key from the ARP responder to the ARP requestor, wherein the ARP requestor is configured to locally verify the ARP responder using the attestation information and the verifier signed key received from the ARP responder.

9. The method of claim 8 , wherein the verifier validates the attestation information to generate the verifier signed key before the ARP request is received at the ARP responder from the ARP requestor.

10. A system comprising:

one or more processors; and

a computer-readable medium comprising instructions stored therein, which when executed by the one or more processors, cause the one or more processors to:

receive an ARP request from an Address Resolution Protocol (ARP) requestor sent to an ARP responder for performing address resolution between the ARP requestor and the ARP responder in a network environment, wherein the ARP request includes requestor attestation information of the ARP requestor for verifying trustworthiness of one or more of hardware and software associated with the ARP requestor;

verify trustworthiness of the ARP requestor using the requestor attestation information of the ARP requestor included in the ARP request;

perform the address resolution between the ARP requestor and the ARP responder based on whether the ARP requestor is verified as trustworthy or untrustworthy;

build an ARP response including attestation information of the ARP responder;

provide the ARP response and the attestation information of the ARP responder, to the ARP requestor from the ARP responder for verifying the ARP responder using the ARP response and the attestation information of the ARP responder; and

verifying the ARP responder based on at least one or more attestation information of the ARP responder that is verified before the ARP request is received.

11. The system of claim 10 , wherein the instructions, which when executed by the one or more processors, further cause the one or more processors to:

extract a media access control (MAC) address of the ARP responder and an Internet Protocol (IP) address of the ARP responder from the ARP response; and

add an ARP entry including a mapping of the MAC address of the ARP responder with the IP address of the ARP responder.

12. The system of claim 10 , wherein the instructions, which when executed by the one or more processors, further cause the one or more processors to facilitate ARP attack mitigation in the network environment if the ARP responder is not verified using the attestation information in the ARP response.

13. The system of claim 12 , wherein the ARP attack mitigation includes refraining from adding an entry including a mapping of a MAC address of the ARP responder with an IP address of the ARP responder in an ARP mapping data store.

14. The system of claim 12 , wherein the ARP attack mitigation includes sending an alert indicating that the ARP responder failed verification using the attestation information.

15. The system of claim 12 , wherein the ARP attack mitigation includes creating a log entry indicating the ARP responder failed verification using the attestation information and a mapping of a MAC address of the ARP responder with an IP address of the ARP responder.

16. The system of claim 10 , wherein the instructions, which when executed by the one or more processors, further cause the one or more processors to sending the attestation information of the ARP responder from the ARP requestor to a verifier, wherein the verifier is configured to remotely verify the ARP responder using the attestation information of the ARP responder received from the ARP requestor.

17. The system of claim 10 , wherein the instructions, which when executed by the one or more processors, further cause the one or more processors to:

staple, by the ARP responder, the attestation information included in the ARP response with a verifier signed key, wherein the verifier signed key is generated based on a verifier validating the attestation information; and

send the ARP response including the attestation information with the verifier signed key from the ARP responder to the ARP requestor, wherein the ARP requestor is configured to locally verify the ARP responder using the attestation information and the verifier signed key received from the ARP responder.

18. The system of claim 17 , wherein the verifier validates the attestation information to generate the verifier signed key before the ARP request is received at the ARP responder from the ARP requestor.

19. A non-transitory computer-readable storage medium comprising instructions stored therein, which when executed by one or more processors, cause the one or more processors to:

receive an ARP request from an Address Resolution Protocol (ARP) requestor sent to an ARP responder for performing address resolution between the ARP requestor and the ARP responder in a network environment, wherein the ARP request includes requestor attestation information of the ARP requestor for verifying trustworthiness of one or more of hardware and software associated with the ARP requestor;

verify trustworthiness of the ARP requestor using the requestor attestation information of the ARP requestor included in the ARP request;

perform the address resolution between the ARP requestor and the ARP responder based on whether the ARP requestor is verified as trustworthy or untrustworthy;

build an ARP response including attestation information of the ARP responder;

provide the ARP response and the attestation information of the ARP responder, to the ARP requestor from the ARP responder for verifying the ARP responder using the ARP response and the attestation information of the ARP responder; and

verifying the ARP responder based on at least one or more attestation information of the ARP responder that is verified before the ARP request is received.

20. The non-transitory computer-readable storage medium of claim 19 , wherein the instructions, which when executed by the one or more processors, further cause the one or more processors to:

extract a media access control (MAC) address of the ARP responder and an Internet Protocol (IP) address of the ARP responder from the ARP response; and

add an ARP entry including a mapping of the MAC address of the ARP responder with the IP address of the ARP responder.

Assignments (1)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Feb 15, 2022
From: SHETH, SUJAL; BHANDARI, SHWETHA SUBRAY; SULZEN, WILLIAM F.; BROCKNERS, FRANK
To: CISCO TECHNOLOGY, INC.
Reel/Frame 059019/0867 →
Continuity (3)
Continuation 16712584 · Dec 12, 2019
Provisional Application 62830162 · Apr 5, 2019
Related Publication 20220174091A1 · Jun 2, 2022
References Cited (89)
US 6189042B1 · Keller-Tuberg · 2001 [cited by applicant]
US 6249623B1 · Patrick et al. · 2001 [cited by applicant]
US 6675206B1 · Britton et al. · 2004 [cited by applicant]
US 6771649B1 · Tripunitara · 2004 [cited by examiner]
US 7234163B1 · Rayes et al. · 2007 [cited by applicant]
US 7237267B2 · Rayes et al. · 2007 [cited by applicant]
US 7360245B1 · Ramachandran et al. · 2008 [cited by applicant]
US 7464183B1 · Loffe et al. · 2008 [cited by applicant]
US 7469418B1 · Wilkinson et al. · 2008 [cited by applicant]
US 7523485B1 · Kwan · 2009 [cited by applicant]
US 7562390B1 · Kwan · 2009 [cited by examiner]
US 8117657B1 · Elrod et al. · 2012 [cited by applicant]
US 8966608B2 · Jarredal · 2015 [cited by applicant]
US 8966698B2 · Mok et al. · 2015 [cited by applicant]
US 9036504B1 · Miller et al. · 2015 [cited by applicant]
US 9525671B1 · Worsley · 2016 [cited by applicant]
US 10205698B1 · Petersen et al. · 2019 [cited by applicant]
US 10440044B1 · Zini et al. · 2019 [cited by applicant]
US 10693866B2 · Ben-Shalom et al. · 2020 [cited by applicant]
US 11882176B2 · Sheth · 2024 [cited by examiner]
US 20020013844A1 · Garrett et al. · 2002 [cited by applicant]
US 20020016858A1 · Sawada et al. · 2002 [cited by applicant]
US 20030070007A1 · Tchakmakjian · 2003 [cited by applicant]
US 20030172144A1 · Henry · 2003 [cited by examiner]
US 20050147097A1 · Chari et al. · 2005 [cited by applicant]
US 20060088037A1 · Finley, Jr. et al. · 2006 [cited by applicant]
US 20060221979A1 · Cheshire et al. · 2006 [cited by applicant]
US 20070248085A1 · Volpano · 2007 [cited by applicant]
US 20080107065A1 · Lescuyer et al. · 2008 [cited by applicant]
US 20090013181A1 · Choi et al. · 2009 [cited by applicant]
US 20100088399A1 · Gluck · 2010 [cited by applicant]
US 20100107162A1 · Edwards et al. · 2010 [cited by applicant]
US 20100107250A1 · Li · 2010 [cited by applicant]
US 20100241744A1 · Fujiwara · 2010 [cited by applicant]
US 20110010769A1 · Järredal · 2011 [cited by applicant]
US 20110029645A1 · Baykal et al. · 2011 [cited by applicant]
US 20130111589A1 · Cho · 2013 [cited by applicant]
US 20130212249A1 · Groat et al. · 2013 [cited by applicant]
US 20140325651A1 · Kim et al. · 2014 [cited by applicant]
US 20150058968A1 · Wang et al. · 2015 [cited by applicant]
US 20150143118A1 · Sheller et al. · 2015 [cited by applicant]
US 20150358345A1 · Clark et al. · 2015 [cited by applicant]
US 20160142365A1 · Devarajan · 2016 [cited by applicant]
US 20170093912A1 · Poomalai et al. · 2017 [cited by applicant]
US 20170221066A1 · Ledford et al. · 2017 [cited by applicant]
US 20170289138A1 · Ben-Shalom et al. · 2017 [cited by applicant]
US 20180027012A1 · Srinivasan et al. · 2018 [cited by applicant]
US 20180219909A1 · Gorodissky et al. · 2018 [cited by applicant]
US 20190020679A1 · Qu et al. · 2019 [cited by applicant]
US 20190058731A1 · Garg et al. · 2019 [cited by applicant]
US 20190297050A1 · Chu et al. · 2019 [cited by applicant]
US 20200084284A1 · Chauhan · 2020 [cited by applicant]
US 20200169527A1 · Cheng et al. · 2020 [cited by applicant]
US 20200322375A1 · Sheth et al. · 2020 [cited by applicant]
CN 1825853A · 2006 [cited by applicant]
CN 103152335A · 2013 [cited by applicant]
CN 106453308A · 2017 [cited by applicant]
CN 108123943A · 2018 [cited by applicant]
CN 109698868A · 2019 [cited by applicant]
GB 2458154A · 2009 [cited by applicant]
KR 100201574B1 · 1999 [cited by applicant]
KR 20180086610A · 2018 [cited by applicant]
WO WO2010041788A1 · 2010 [cited by examiner]
WO WO2012153913A1 · 2012 [cited by applicant]
WO WO2013020501A1 · 2013 [cited by applicant]
D. Bruschi, A. Ornaghi and E. Rosti, “S-ARP: a secure address resolution protocol,” 19th Annual Computer Security Applications Conference, 2003. Proceedings., Las Vegas, NV, USA, 2003, pp. 66-74 (Year: 2003). [cited by examiner]
Attestation definition by Merriam-Webster Dictionary, obtained online from <https://www.merriam-webster.com/dictionary/attestation>, retrieved on Feb. 24, 2024. [cited by examiner]
D. J. Tian, K. R. B. Butler, J. I. Choi, P. McDaniel and P. Krishnaswamy, “Securing ARP/NDP From the Ground Up,” in IEEE Transactions on Information Forensics and Security, vol. 12, No. 9, pp. 2131-2143, Sep. 2017 (Year… [cited by examiner]
A. Nehra, M. Tripathi and M. S. Gaur, “FICUR: Employing SDN programmability to secure ARP,” 2017 IEEE 7th Annual Computing and Communication Workshop and Conference (CCWC), Las Vegas, NV, USA, 2017, pp. 1-8 (Year: 2017). [cited by examiner]
B. Bakhache and R. Rostom, “Kerberos secured Address Resolution Protocol (KARP),” 2015 Fifth International Conference on Digital Information and Communication Technology and its Applications (DICTAP), Beirut, Lebanon, 2… [cited by examiner]
Abad et al., “An Analysis on the Schemes for Detecting and Preventing ARP Cache Poisoning Attacks”, 2007 (Year: 2007). [cited by applicant]
Bakhache et al., “Kerberos Secured Address Resolution Protocol (KARP)”, 2015 (Year: 2015). [cited by applicant]
Cox Jr et al., “Leveraging SDN for ARP Security”, 2016 (Year: 2016). [cited by applicant]
Dictionary.com, “attestation”, 2021 (Year: 2021). [cited by applicant]
Hammouda et al., “An Enhanced Secure ARP Protocol and LAN Switch for Preventing ARP based Attacks”, 2009 (Year: 2009). [cited by applicant]
Issac et al., “Secure Unicast Address Resolution Protocol (S-UARP) by Extending DHCP”, 2005 (Year: 2005). [cited by applicant]
Li et al., “Transparent Interconnection of Lots of Links (TRILL): ARP and Neighbor Discovery (ND) Optimization”, RFC 8302, 2018 Year: 2018). [cited by applicant]
Limmaneewichid et al., “The Cryptographic Trailer Based Authentication Scheme for ARP”, 2011 (Year: 2011). [cited by applicant]
Lootah et al., “TARP: Ticket-based Address Resolution Protocol”, 2005 (Year: 2005). [cited by applicant]
Matties, “Distributed Responder ARP: Using SDN to Re-Engineer ARP from within the Network”, 2017 (Year: 2017). [cited by applicant]
Meghana et al., “A Survey on ARP Cache Poisoning And techniques for detection and mitigation”, 2017 (Year: 2017). [cited by applicant]
Nam et al., “Mitigating ARP poisoning-based man-in-the-middle attacks in wired and wireless LAN”, 2012 (Year: 2012). [cited by applicant]
Ortega et al., “Preventing ARP Cache Poisoning Attacks: A Proof of Concept using OpenWrt”, 2009 (Year: 2009). [cited by applicant]
Pandey, “Prevention of ARP Spoofing: A Probe Packet based Technique”, 2012 (Year: 2012). [cited by applicant]
Prevelakis et al., “LS-ARP: A Lightweight and Secure ARP”, 2017 (Year: 2017). [cited by applicant]
Ramachandran et al., “Detecting ARP Spoofing: An Active Technique”, 2005 (Year: 2005). [cited by applicant]
Tian et al., “Securing ARP From the Ground Up”, 2015 (Year: 2015). [cited by applicant]
Tian et al., “Securing ARP/NDP From the Ground Up”, 2017 (Year: 2017). [cited by applicant]
Trabelsi et al., “Preventing ARP Attacks using a Fuzzy-Based Stateful ARP Cache”, 2007 (Year: 2007). [cited by applicant]