Layer-2 security for industrial automation by snooping discovery and configuration messages
In one embodiment, a switch in a computer network listens to a device naming exchange on trusted interfaces to learn device names of devices reachable on interfaces of the switch. The switch then listens to the device naming exchange to learn a corresponding interface of the switch on which each particular (named) device is reachable, and associates each learned device name to the learned corresponding interface for that particular device. The switch then allows identity responses from only learned device names on their corresponding interface. In another embodiment, the switch also listens to an IP address assigning exchange on the trusted interfaces to learn IP addresses assigned to each particular device, and associates each learned IP address with a corresponding learned device name and its corresponding interface. The switch then allows address resolution responses from only learned IP addresses from their corresponding learned device names on their corresponding interface.
1. A method, comprising:
listening, by a switch in a computer network, to a device naming exchange on one or more trusted interfaces of the switch to learn device names of devices reachable on interfaces of the switch;
listening, by the switch, to the device naming exchange to learn a corresponding interface of the switch on which each particular device, with a learned device name, is reachable;
associating each learned device name to the learned corresponding interface for that particular device;
allowing, by the switch, identity responses from only learned device names on their corresponding interface;
protecting against disallowed responses by disabling interfaces of the switch on which a disallowed response is received; and
disabling interfaces of the switch on which the disallowed response is received until one of either expiration of a period of time or administrator intervention.
2. The method as in claim 1 , further comprising:
listening, by the switch, to an Internet Protocol (IP) address assigning exchange on the one or more trusted interfaces of the switch to learn IP addresses assigned to each particular device;
associating each learned IP address with a corresponding learned device name and its corresponding interface; and
allowing, by the switch, address resolution responses from only learned IP addresses from their corresponding learned device names on their corresponding interface.
3. The method as in claim 1 , wherein all interfaces of the switch are untrusted by default, the method further comprising:
configuring any untrusted interface that is connected to an input/output (I/O) controller as a trusted interface of the one or more trusted interfaces; and
configuring any untrusted interface that trunks between another switch in the computer network as a trusted interface of the one or more trusted interfaces.
4. The method as in claim 1 , further comprising:
restricting disallowed responses by dropping the disallowed responses.
5. The method as in claim 1 , further comprising:
persisting associations across reboots of the switch.
6. The method as in claim 1 , further comprising:
storing a media access control (MAC) address of each learned device name.
7. The method as in claim 1 , wherein the computer network is an industrial automation network.
8. An apparatus, comprising:
one or more network interfaces to communicate as a switch with a computer network;
a processor coupled to the network interfaces and adapted to execute one or more processes; and
a memory configured to store a process executable by the processor, wherein the process is configured to:
listen to a device naming exchange on one or more trusted interfaces of the switch to learn device names of devices reachable on interfaces of the switch;
listen to the device naming exchange to learn a corresponding interface of the switch on which each particular device, with a learned device name, is reachable;
associate each learned device name to the learned corresponding interface for that particular device;
allow identity responses from only learned device names on their corresponding interface;
protect against disallowed responses by disabling interfaces of the switch on which a disallowed response is received; and
disable interfaces of the switch on which the disallowed response is received until one of either expiration of a period of time or administrator intervention.
9. The apparatus as in claim 8 , wherein the process is further configured to:
listen to an Internet Protocol (IP) address assigning exchange on the one or more trusted interfaces of the switch to learn IP addresses assigned to each particular device;
associate each learned IP address with a corresponding learned device name and its corresponding interface; and
allow address resolution responses from only learned IP addresses from their corresponding learned device names on their corresponding interface.
10. The apparatus as in claim 8 , wherein all interfaces of the switch are untrusted by default, and wherein the process is further configured to:
configure any untrusted interface that is connected to an input/output (I/O) controller as a trusted interface of the one or more trusted interfaces; and
configure any untrusted interface that trunks between another switch in the computer network as a trusted interface of the one or more trusted interfaces.
11. The apparatus as in claim 8 , wherein the process is further configured to:
restrict disallowed responses by dropping the disallowed responses.
12. The apparatus as in claim 8 , wherein the process is further configured to:
persist associations across reboots of the switch.
13. The apparatus as in claim 8 , wherein the process is further configured to:
store a media access control (MAC) address of each learned device name.
14. A tangible, non-transitory, computer-readable media having software encoded thereon, the software configured to:
listen to a device naming exchange on one or more trusted interfaces of the switch to learn device names of devices reachable on interfaces of the switch;
listen to the device naming exchange to learn a corresponding interface of the switch on which each particular device, with a learned device name, is reachable;
associate each learned device name to the learned corresponding interface for that particular device;
allow identity responses from only learned device names on their corresponding interface;
protect against disallowed responses by disabling interfaces of the switch on which a disallowed response is received; and
disable interfaces of the switch on which the disallowed response is received until one of either expiration of a period of time or administrator intervention.
15. The computer-readable media as in claim 14 , wherein the software is further configured to:
listen to an Internet Protocol (IP) address assigning exchange on the one or more trusted interfaces of the switch to learn IP addresses assigned to each particular device;
associate each learned IP address with a corresponding learned device name and its corresponding interface; and
allow address resolution responses from only learned IP addresses from their corresponding learned device names on their corresponding interface.
16. The computer-readable media as in claim 14 , wherein all interfaces of the switch are untrusted by default, and wherein the software is further configured to:
configure any untrusted interface that is connected to an input/output (I/O) controller as a trusted interface of the one or more trusted interfaces; and
configure any untrusted interface that trunks between another switch in the computer network as a trusted interface of the one or more trusted interfaces.