Technologies for preventing man-in-the-middle attacks in software defined networks

A system comprising:

• a processor;
• and
• a non-transitory computer-readable storage medium having instructions stored which, when executed by the processor, cause the processor to perform operations comprising:
• receiving, at a Software Defined Network controller, a unicast Address Resolution Protocol packet from a first host designated for a second host, wherein the Software Defined Network controller, the first host, and the second host are on a secured network, and wherein the unicast Address Resolution Protocol packet is received via a switch;
• verifying, by the SDN controller, the first host as valid by comparing the unicast Address Resolution Protocol packet to a host database;
• in response to verifying the first host as valid, sending a reply of the unicast Address Resolution Protocol packet to the switch, the reply providing instructions for the second host regarding communications with the first host and forwarding the unicast Address Resolution Protocol packet to the second host;
• determining that the first host is moving;
• initiating a gratuitous Address Resolution Protocol request on behalf of the first host;
• and
• sending the gratuitous Address Resolution Protocol request to the Software Defined Network Controller, such that the first host is authorized to send the gratuitous Address Resolution Protocol request to a plurality of Virtual Tunnel End Points via the switch using a flood list.

A computer-readable storage device having instructions stored which, when executed by a computing device, cause the computing device to perform operations comprising:

• receiving, at a Software Defined Network controller, a unicast Address Resolution Protocol packet from a first host designated for a second host, wherein the Software Defined Network controller, the first host, and the second host are on a secured network, and wherein the unicast Address Resolution Protocol packet is received via a switch;
• verifying, by the SDN controller, the first host as valid by comparing the unicast Address Resolution Protocol packet to a host database;
• in response to verifying the first host as valid, sending a reply of the unicast Address Resolution Protocol packet to the switch, the reply providing instructions for the second host regarding communications with the first host and forwarding the unicast Address Resolution Protocol packet to the second host;
• determining that the first host is moving;
• initiating a gratuitous Address Resolution Protocol request on behalf of the first host;
• and
• sending the gratuitous Address Resolution Protocol request to the SDN controller, such that the first host is authorized to send the gratuitous Address Resolution Protocol request to a plurality of Virtual Tunnel End Points via the switch using a flood list.