Securing dynamic host control protocol

A computer-implemented method comprising:

• generating, at a network device, a private key using one-time programmable (OTP) seed parameters stored locally on the network device;
• populating one or more first Dynamic Host Configuration Protocol (DHCP) packets with authentication data including (i) a unique hardware identifier (ID) associated with a hardware chip in the network device and (ii) a public key ID that indicates a public key corresponding to the private key;
• signing the one or more first DHCP packets with a signature using the private key to result in one or more first signed DHCP packets;
• sending the one or more first signed DHCP packets to a DHCP server;
• and
• receiving, from the DHCP server, a second DHCP packet that indicates an Internet Protocol (IP) address assigned to the network device, wherein receipt of the second DHCP packet indicates that the DHCP server authenticated the network device by using the public key to verify that the signature was generated using the private key.

A Dynamic Host Configuration Protocol (DHCP) server configured to cryptographically verify network devices that request Internet Protocol (IP) addresses, the DHCP server comprising:

• one or more processors;
• and
• one or more computer-readable media storing computer-executable instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:
• receiving a list of unique hardware identifiers (IDs) associated with a hardware chips in the network devices that are permitted to be connected to a network associated with the DHCP server;
• receiving, from a network device, one or more first signed DHCP packets with authentication data including (i) a unique hardware identifier (ID) associated with a hardware chip in the network device and (ii) a public key ID that indicates a public key corresponding to a private key used to sign the one or more first signed DHCP packets;
• using the public key ID, retrieving the public key that corresponds to a private key that was used to sign the one or more first signed DHCP packets;
• using the public key, verifying that a signature on the one or more first signed DHCP packets was generated using the private key;
• authenticating the hardware chip by determining that the unique hardware ID is included in the list of unique hardware IDs;
• and
• sending, to the network device, a second DHCP packet indicating an IP address.