Illegitimate use of ip addresses is counteracted. A network (1) includes a switch (5) with ports (P1,P2,P3) to subscribers (6,6A) and a port (PN) to a core network (2) with dhcp servers (4, 4a,4b). The switch includes a database (MAC1, MAC2), port numbers (P1, P2) and VLAN identities (VLAN1, VLAN2) for the subscribers (6, 6A) and the filter has a list over trusted dhcp servers. Initially only dhcp messages from the subscribers are allowed. When the subscriber (6) requests (M1, M3) for an ip address it is checked that it is a dhcp message with valid subscriber values (MAC1, P1, VLAN1). A respond (M2, M4) with an allocated ip address (ip1) and lease time interval (T1) is checked to come from a trusted dhcp server. If so, a list in the filter (9) with correct information is dynamically generated (MAC1, P1, VLAN1, ip1, T1). A message (M5) from the subscriber (6) with false ip address is discarded by the filter. Attempts by the subscriber to use false ip address are counted and a warning signal is generated.
|
0. 16. A switch node configured to prevent illegitmate use of an ip address by a subscriber device, the switch node comprising:
at least one downlink port for communication with a subscriber device;
at least one uplink port for communication with at least one Dynamic Host Configuration Protocol (dhcp) server in a network; and,
a first table having a list of trusted ones of the dhcp servers, the first table being associated with the ports;
processing circuitry; and
a memory, the memory containing instructions that, when executed by the processing circuitry, cause the switch node to:
receive a subscriber ip address request message from a subscriber device, analyse it to be a dhcp request message and transmit it on the uplink port;
receive a reply message on the uplink port, analyse it to be a dhcp reply message having a source ip address from one of the trusted dhcp servers in the first table;
dynamically update a second table with an identification of the subscriber device and a corresponding assigned subscriber ip address contained in the dhcp reply message;
receive a frame with a source ip address from a subscriber device;
compare the source ip address with the stored subscriber ip address for the subscriber device in the second table;
discard the frame when the source ip address differs from the stored subscriber ip address; and
accept the frame when the source ip address matches the stored subscriber ip address of the second table.
0. 11. A method in a switch node coupled upstream to at least one Dynamic Host Configuration Protocol (dhcp) server and coupled downstream to at least one subscriber device, the method including the steps of:
creating a first table of trusted ones of the dhcp servers in the switch node;
receiving, by the switch node, from the at least one subscriber device, a dhcp request message for an ip address
transmitting, by the switch node, the dhcp request message to one of the trusted dhcp servers;
receiving, by the switch node, a reply message from the trusted dhcp server, the reply including an assigned subscriber ip address;
analysing the reply message by the switch node to be a dhcp message and having a source address from one of the trusted dhcp servers according to the first table;
updating a second table dynamically in the switch node, the second table storing an identification of the subscriber device and the assigned subscriber ip address;
transmitting, by the switch node, to the subscriber device, a reply message which carries the assigned subscriber ip address;
receiving, by the switch node, a frame from the subscriber device using a source ip address;
comparing the source ip address with the stored subscriber ip address in the second table;
discarding the frame when the source ip address differs from the stored subscriber ip address of the second table; and
accepting the frame when the source ip address matches the stored subscriber ip address of the second table.
0. 1. A method for preventing illegitmate use of an Internet Protocol (ip) address by a subscriber device in an ip network, the network including a switch node and at least one dhcp server, said subscriber device in communication with the switch node, the method including the steps of:
creating a list of trusted ones of the dhcp servers in said switch node;
transmitting by the subscriber device a dhcp request message for an ip address;
receiving a reply message by said switch node which carries an assigned subscriber ip address;
analysing the reply message by said switch node to be a dhcp message and having a source address from one of the trusted dhcp servers;
updating a filter dynamically in the switch node, the filter storing an identification of the subscriber device and the assigned subscriber ip address;
transmitting a frame from the subscriber device using a source ip address;
comparing in the filter said source ip address with the stored subscriber ip address; and,
discarding said frame when said source ip address differs from the stored subscriber ip address.
0. 2. The method according to
0. 3. The method according to
0. 4. The method according to
0. 5. The method according to
counting a number of attempts (n) from the subscriber to use an illegitimate ip address;
comparing the number (n) of the attempts with a threshold number (N);
sending a warning signal when the number of attempts exceeds a threshold criteria.
0. 6. A switch node in an Internet Protocol (ip) network adapted to prevent illegitmate use of an ip address by a subscriber device, the switch node including:
at least one port for communication with a subscriber device;
an uplink port for communication with dhcp servers in the network; and,
a filter device having a list of trusted ones of the dhcp servers, the filter device being associated with the ports; wherein the switch node is operative to:
receive a subscriber ip address request message from a subscriber device, analyse it to be a dhcp request message and transmit it on the uplink port;
receive a reply message on the uplink port, analyse it to be a dhcp reply message having a source ip address from one of the trusted dhcp servers on the list;
dynamically update the filter with an identification of the subscriber device and a corresponding assigned subscriber ip address contained in the dhcp reply message;
receive a frame with a source ip address from a subscriber device;
compare in the filter said source ip address with the stored subscriber ip address for the subscriber device; and,
to discard said frame when said source ip address differs from the stored subscriber ip address.
0. 7. The switch node according to
0. 8. The switch node according to
0. 9. The switch node according to
0. 10. The switch node according to
0. 12. The method according to claim 11, further comprising the step of storing in the second table a subscriber MAC address, a subscriber physical port number, a subscriber virtual LAN identity and a lease time interval for the assigned subscriber ip address.
0. 13. The method according to claim 11, wherein the subscriber ip address is statically assigned and handled by the dhcp servers.
0. 14. The method according to claim 12, the method including deleting the subscriber identification and the corresponding assigned subscriber ip address from the second table when the lease time interval is out.
0. 15. The method according to claim 11, the method further comprising the steps of:
counting a number of attempts (n) from the subscriber to use an ip address that does not match that contained in the second table;
comparing the number (n) of the attempts with a threshold number (N);
sending a warning signal when the number of attempts exceeds the threshold number.
0. 17. The switch node according to claim 16, wherein the switch node is further operative to store in the second table a subscriber MAC address, a subscriber physical port number, a subscriber virtual LAN identity and a lease time interval for the assigned subscriber ip address.
0. 18. The switch node according to claim 16, wherein the subscriber ip address comprises a statically assigned address which is handled by the dhcp servers.
0. 19. The switch node according to claim 17, wherein the switch node is further operative to delete the subscriber identification and the corresponding assigned subscriber ip address from the filter when the lease time interval expires.
0. 20. The switch node according to claim 16, further comprising a counter operative to count a number (n) of discarded frames on the subscriber port, to compare the number (n) of the discarded frames with a threshold number (N), and to send a warning signal when the number of discarded frames exceeds the threshold number.
|
Notice: More than one reissue application has been filed for the reissue of U.S. Pat. No. 7,996,537, which was the National Stage of International Application No. PCT/SE02/02021, filed Nov. 6, 2002. The reissue applications are (1) application Ser. No. 13/962,787 and (2) application Ser. No. 14/609,631 (the present application):
This application is a continuation reissue of application Ser. No. 13/962,787, which is an application for reissue of U.S. Pat. No. 7,996,537, which was the National Stage of International Application No. PCT/SE02/02021, filed Nov. 6, 2002.
The present invention relates to a method and a device in an
IP network, which counteracts illegitimate use of IP addresses.
Subscribers in an IP network can use IP addresses that are not acquired in a legitimate way. The subscriber can use someone else's IP address or an IP address currently not in use. The subscriber, who may be e.g. an enterprise, is connected to a broadband island, and uses the IP address to identify itself on the network. If the subscriber has abuse intentions it is appealing to use such an illegitimate IP address. Abuse tracking is namely based on the IP address and the abuser would benefit from the illegitimate address, since the abuser would be more difficult to track at an investigation.
In the international patent application WO 98/26550 is disclosed a system for allocating and using IP addresses in a network with subscriber systems. Each subscriber system is connected to a DHCP server via a cable modem. The DHCP server leases IP addresses to the subscriber systems and works in combination with a secure DHCP relay agent and a secure IP relay agent. When a subscriber system sends a DHCP request message, the DHCP relay agent adds a trusted identifier to the message and transmits it to the DHCP server. The trusted identifier, which is associated with the requesting subscriber system, is used by the DHCP server to prevent the subscriber system to access IP address leases of other subscriber systems. The DHCP server also counts the number of IP address leases per trusted identifier and restricts it to a predetermined number. The system requires a non-standard DHCP server and subscriber system.
U.S. Pat. No. 6,061,798 discloses a firewall for isolating network elements from a publicly accessible network. All access to protected network elements must go through the firewall, operating on a stand alone computer. An proxy agent, specifically assigned to an incoming request, verifies the authority of the request to access a network element indicated in the request. Once verified, the proxy agent completes the connection to the protected network on behalf of the source of the incoming request.
Its known in the art to prevent misuse of IP addresses by a filter in a switch, which is connected to a subscriber. A subscriber's data frames are filtered for illegitimate addresses. The filter is built up and is updated by a network operator.
The present invention deals with the abovementioned problem how to restrict the use of allocated IP addresses in an IP network to legitimate ones.
Another problem is how to prevent a subscriber to use per se legitimate IP addresses, which the subscriber has obtained in an illegitimate way.
Still a problem is how to prevent the subscriber to make a great number of attempts to illegitimately use IP addresses.
Still another problem is that an operator has to buildup and update a filter for statically allocated addresses.
The problem is solved by an IP filter device with subscriber identifications and corresponding IP addresses. Data frames from the subscribers have to have the correct source IP address to pass the filter device. The IP filter is successively updated as new subscriber IP addresses are used. In case of IP addresses being allocated by DHCP (Dynamic Host Configuration Protocol) servers, only trusted servers are allowed to allocate subscriber IP addresses to the subscribers.
The IP filter is dynamically updated in the following way. A subscriber requests for an IP address. An address response with an allocated IP address from a DHCP server is analysed both to be a DHCP frames and to come from one of the trusted DHCP servers, which servers are noted on a list. The allocated IP address and its lease time is stored in the IP filter together with an identification of the subscriber. When the lease time is out the subscriber identification and the IP address are deleted from the filter. New subscribers are stored successively. Traffic from one of the subscribers has to have the subscriber's assigned IP address as source address to pass the filter. Attempts from a subscriber to use illegitimate IP addresses are counted and at a predetermined number of attempts a warning is generated.
A purpose with the invention is to restrict the use of IP addresses to legitimate ones.
Another purpose is to prevent a subscriber to use per se legitimate IP addresses which, the subscriber has obtained in an illegitimate way.
Still a purpose is how to prevent the subscriber to make a great number of attempts to illegitimately use IP addresses.
Yet another purpose is that the mentioned IP address limitations will work automatically in an environment with dynamically allocated IP addresses.
The invention has the advantage that only trusted DHCP servers can allocate IP addresses.
Another advantage is that a subscriber can use only legitimate IP addresses obtained in a legitimate way.
A further advantage is that it is possible to prevent repeated attempts to get IP addresses.
Still another advantage is that a subscriber, that intends to misuse the network, can't make tracing more difficult by using an IP address obtained illegitimately.
Also, advantages are that an operator does not need to build up and update a filter, an automated process is not affected by human errors and management of the system is cheap.
The invention will now be more closely described with the aid of embodiments in connection with the enclosed drawings.
Conventional dynamic address allocation works in short in the following manner. A subscriber in a conventional IP network with dynamic address allocation wants to have an IP address, which he has paid for. He then broadcasts a DHCP (Dynamic Host Configuration Protocol) request. A DHCP server notes the request and responds with an IP address and a lease time interval for the address. The subscriber now can communicate with other subscribers or a service provider via the network. A subscriber with abuse intentions can acquire an IP address in an illegitimate way, which makes it more difficult to track him on the network. The subscriber can e.g. get the address from a bogus DHCP server or can himself write an address that belongs to someone else or is currently not in use. The subscriber can also behave in other unacceptable ways, e.g. request and get a great number of IP addresses and thereby make it difficult for other subscribers to get an address.
In brief the switch 5 works in the following manner. To prevent misuse of allocated IP addresses the inventive switch 5 is equipped with the filter 5 for IP address spoofing protection, that can be enabled or disabled per virtual LAN. The switch 5 also has a list L1 over trusted ones of the DHCP servers, in the embodiment the servers 4, 4a and 4b. The switch is configured such that, when the spoofing protection is enabled, all IP addresses are blocked on the subscribers switch port. The only traffic allowed is DHCP traffic to the trusted DHCP servers, DHCP broadcasts and sending of ARPs (Address Resolution Protocol). When the subscriber 6 needs an IP address he broadcasts a DHCP request. The DHCP servers 4, 4a, 4b read the request and responds with a frame, that indicates an assigned subscriber IP address IP1 and a lease time interval T1 for this address. The frame also has a source IP address defining the respective DHCP server. The switch 5 checks via this source IP address if the frame is sent by the trusted DHCP servers 4, 4a, 4b on the list. It also checks that it really is a DHCP frame that is received. The switch 5 has stored in the database 7 the MAC address MAC1 of the subscriber 6, an identification of its physical port P1 and its virtual LAN VLAN1. The switch now dynamically configures the filter 9, which per subscriber includes the following values: The subscriber MAC address MAC1, the subscriber's port identification P1, the subscriber's virtual LAN VLAN1, the received subscriber IP address IP1 and the lease time interval T1 for the IP address. When the subscriber 6 sends a message the switch compares the subscriber source IP address in the transmitted frames with the assigned subscriber IP address IP1 in the filter 9 on the subscriber's port identification P1 and virtual LAN VLAN1. With correct IP address the frames pass the filter, else the frames are discarded. When the lease time interval T1 is out the subscriber identification and the assigned subscriber IP address IP1 is deleted from the filter (9). More details of the above briefly described processes will be given in connection with
In a corresponding manner as above the IP filter 9 will be dynamically configured with subscriber values for the subscriber 6A: The port identification P2, the virtual LAN VLAN2, an allocated subscriber IP address IP2 and a corresponding lease time interval T2.
Statically allocated IP addresses can in one alternative be written directly into the IP filter 9. In another alternative the DHCP servers have the statically assigned IP address for a subscriber. The latter makes a conventional DHCP request for its static IP address. The DHCP server notes the subscriber's MAC address in the request and always allocates the subscriber's statically assigned IP address. Statically assigned IP addresses of the first type can be used e.g. when applications on a computer can't utilize DHCP requests for an IP address.
In
It was mentioned above that the filter 9 was configured with subscriber values. The values are stored in a filter table TAB1, which is shown in
The communication in the network 1 is performed in accordance with the TCP/IP Seven Layer Stack. In
It also has a field TY2 indicating that VLAN is in use. A field VL1 points out which virtual LAN that is concerned by a virtual LAN tag. In the present example this tag is the virtual LAN identity, exemplified by the identities VLAN1 and VLAN2. The frame includes a field TY1 for defining a type of Ethernet frame. A field EPL1 contains the Ethernet payload including an IP header IPH with source and destination IP addresses, the lease time interval and the message that is to be transmitted.
In an alternative 503 the incoming frame comes on one of the subscriber ports P1, P2 or P3. In a block 504 then a task (3) is performed, including a check whether the frame is a DHCP message. This is checked by checking the source and destination port numbers in the UDP message, given that the system is restricted such that only DHCP messages may use port 67 and 68. If the DHCP message check fails it implies that someone is using ports 67 and 68 and the message is discarded. If the frame is found to be a DHCP message, according to an alternative YES1, the frame is accepted by a block 505. This block performs a task (6), which includes that the frame is forwarded and in this case forwarded to the core network 2. If the frame is not a DHCP message, according to an alternative NO1, a task (4) is performed in a block 506. The task (4) includes a check whether a frame source information is valid. It is checked that the layer 2 source MAC address, the layer 3 IP address, the lease time interval and in actual cases the identification of the virtual LAN are all valid on the actual port. In the present embodiment it is in other words checked in the table TAB1 that the MAC address MAC1, the IP address IP1, the lease time interval T1 and the LAN identification VLAN1 are valid on the port P1. In an alternative NO2 the check task (4) shows that the source information is not valid and in a block 507 a task (5) is performed which implies that the frame is discarded. In an alternative YES2 for the block 506 the source information is valid and the frame is accepted in the block 505 by performing the task (6).
The block 502 has the task (2) by which it can in an alternative 508 detect that the frame comes from the core network 2 on the port PN. In a block 509 a task (7) is performed, which includes the check whether the frame is a DHCP message. In an alternative NO3, when the frame is not a DHCP message, the frame is accepted in the block 505, which performs the task (6). In an alternative YES3, when the frame is a DHCP message, the frame is checked in a block 510 performing a task (8). This task includes a question whether the DHCP message originates from a valid DHCP server, i.e. is a server that is stored in the list L1. In an alternative NO4 the server is not valid and the frame is discarded in a block 511 performing the task (5). In another alternative YES4 the server is valid and a check is performed in a block 512 performing a task (9). The check includes a question whether the frame is a DHCP acknowledge message. In an alternative NO5, when the frame is not an acknowledge message, the frame is accepted in the block 505. In an opposite alternative YES5 the frame is an acknowledge message. It is then handled in a block 513 performing a task (10). This task includes that the layer 3 IP address and the lease time interval are added in the database 7. Then the information about the layer 2 source MAC address, the layer 3 IP address, the port identification, the lease time interval and the virtual LAN identification for the subscriber are inserted in the table TAB1. The frame is then accepted, task (6) in the block 505.
In
In connection with
One or more of the DHCP servers 4, 4a, 4b returns each a DHCP offer message M2 with an offered IP address. According to the block 501, task (1), the message M2 is received and in the block 502, task (2), its origin is checked. The port PN is decided according to the alternative 508 and in the block 509, task (7), and the alternative YES3 it is noted that the message M2 is a DHCP message. According to the block 510, task (8) and alternative YES4, the DHCP server 4 is valid. In the block 512, task (9) and alternative NO5, the message M2 is pointed out not be a DHCP acknowledge message and in the block 505, task (6), the DHCP offer message M2 is forwarded to the subscriber 6.
The subscriber 6 now selects one of the offered IP addresses, in the embodiment the address IP1 from the server 4. The subscriber requests for the address IP1 by a DHCP request M3 which is received by the switch 5 according to the block 501, task (1). In the block 502, task (2), the origin of the message M3 is checked and according to the alternative 503 the port P1 is decided. According to the block 504, task (3) and the alternative YES1, the message M3 is a DHCP message that is accepted in the block 505, task (6) and is forwarded to the core network 2.
The selected one of the DHCP servers, server 4, returns a DHCP acknowledge message M4, confirming the offered IP address IP1. According to the block 501, task (1), the message M4 is received and in the block 502, task (2) its origin is checked. The port PN is decided according to the alternative 508 and in the block 509, task (7), and the alternative YES3 it is noted that the message M4 is a DHCP message. According to the block 510, task (8) and alternative YES4, the DHCP server 4 that has sent the message M4 is valid. In the block 512, task (9) and alternative YES5, the message M4 is pointed out to be a DHCP acknowledge message (DHCPACK). It is then handled in the block 513, task (10) by which the information about the subscriber's layer 2 source MAC address MAC1, the received layer 3 IP address IP1, the port identification P1, the virtual LAN identification VLAN1 and the lease time interval T1 are inserted in the table TAB1. The message M4 is thereby accepted and in the block 505, task (6), the DHCP acknowledge message M4 is forwarded to the subscriber 6. The subscriber now has a valid IP address.
It should be noted that a subscriber, e.g. the subscriber 6, can legitimately use more than one IP address. The subscriber makes an agreement with an operator and obtains in this legitimate way further subscriptions for IP addresses. The number of legitimate IP addresses is noted in the database 7. The IP addresses themselves are obtained from the trusted servers in the same way as the address IP1 and are noted in the filter table TAB1.
The subscriber 6 now wants to utilize a service from the service provider 3 and sends a message M5 in
If the subscriber tries to send a frame like the frame FR1 in
In
The process when the subscriber 6 gets an IP address will be described very briefly in connection with
When the subscriber 6 sends the message M5 to the service provider 3, the message is received in block 801 and is found not to be a DHCP message, block 802 alternative NO6. The frame source information is then checked in block 803 with the aid of the table TAB1 in the filter 9. If valid, alternative YES7, the message M5 is accepted and is sent to the addressee.
Johansson, Thomas, Anders Nesz, Peter, Valentin Juhl, Michael
Patent | Priority | Assignee | Title |
Patent | Priority | Assignee | Title |
5884024, | Dec 09 1996 | Oracle America, Inc | Secure DHCP server |
6393484, | Apr 12 1999 | International Business Machines Corp. | System and method for controlled access to shared-medium public and semi-public internet protocol (IP) networks |
6427170, | Dec 08 1998 | Cisco Technology, Inc | Integrated IP address management |
7079499, | Sep 08 1999 | Apple | Internet protocol mobility architecture framework |
7127524, | Dec 29 2000 | PALO ALTO NETWORKS, INC | System and method for providing access to a network with selective network address translation |
20020023160, | |||
20020065919, | |||
20030233576, | |||
20040044778, | |||
20040064559, | |||
20040107286, | |||
20070299942, | |||
EP520709, | |||
RE45445, | Nov 06 2002 | Telefonaktiebolaget L M Ericsson (publ) | Method and arrangement for preventing illegitimate use of IP addresses |
WO147179, |
Executed on | Assignor | Assignee | Conveyance | Frame | Reel | Doc |
Apr 11 2005 | VALENTINE JUHL, MICHAEL | TELEFONAKTIEBOLAGET LM ERICSSON PUBL | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 034970 | /0752 | |
Apr 12 2005 | NESZ, PETER | TELEFONAKTIEBOLAGET LM ERICSSON PUBL | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 034970 | /0752 | |
Apr 18 2005 | JOHANSSON, THOMAS | TELEFONAKTIEBOLAGET LM ERICSSON PUBL | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 034970 | /0752 | |
Jan 30 2015 | Telefonaktiebolaget LM Ericsson (publ) | (assignment on the face of the patent) | / |
Date | Maintenance Fee Events |
Feb 09 2023 | M1553: Payment of Maintenance Fee, 12th Year, Large Entity. |
Date | Maintenance Schedule |
Feb 19 2022 | 4 years fee payment window open |
Aug 19 2022 | 6 months grace period start (w surcharge) |
Feb 19 2023 | patent expiry (for year 4) |
Feb 19 2025 | 2 years to revive unintentionally abandoned end. (for year 4) |
Feb 19 2026 | 8 years fee payment window open |
Aug 19 2026 | 6 months grace period start (w surcharge) |
Feb 19 2027 | patent expiry (for year 8) |
Feb 19 2029 | 2 years to revive unintentionally abandoned end. (for year 8) |
Feb 19 2030 | 12 years fee payment window open |
Aug 19 2030 | 6 months grace period start (w surcharge) |
Feb 19 2031 | patent expiry (for year 12) |
Feb 19 2033 | 2 years to revive unintentionally abandoned end. (for year 12) |