US 6,771,649 B1 · Middle approach to asynchronous and backward-compatible detection and prevention of ARP cache poisoning

Abstract

A method and apparatus for a middleware approach to the asynchronous and backward-compatible detection and prevention of Address Resolution Protocol (ARP) cache poisoning is presented. In a Streams-based network subsystem, such as found in the Solaris 2.6 operating system, a Cache Poisoning Checker (CPC) streams module, a CPC streams driver and a CPC user-level application are implemented. The CPC streams module is implemented in a protocol stack that pertains to ARP and is designed to intercept ARP traffic in both the upward and downwards directions that are dictated by the respective Internet Protocol and Ethernet drivers in the network subsystem. The CPC streams driver acts to provide an interface between the CPC streams module and the CPC user-level application. The CPC user-level application gives access to the local ARP cache and raises alarms if an ARP cache attack is detected. Both the CPC streams driver and CPC user-level application are implemented in a stream of their own, separate from the protocol stack containing the CPC streams module.

Claims14

Dependent claims

An apparatus for detecting attempts to poison and preventing poisoning of an Address Resolution Protocol (ARP) cache, the apparatus comprising:

a streams-based networking subsystem;
a protocol stack, implemented in the streams-based networking subsystem, comprising:
an ARP streams module capable of making resolution based upon the ARP cache;
and
a cache poisoning checker module for intercepting ARP traffic to and from the ARP streams module, the cache poisoning checker module adapted to record a destination Internet Protocol address for a second host contained in an ARP request from a first host, and determine whether an Internet Protocol address contained in the ARP response from the second host corresponds to the recorded destination Internet Protocol address for the second host,
wherein the cache poisoning checker module can detect a spurious ARP response and prevent it from being entered in the ARP cache if the Internet Protocol address contained in the ARP response from the second host does not correspond to the recorded destination Internet Protocol address of the second host in the ARP request from the first host.

3 more elements

Dependencies are inferred from the claim text.

Middle approach to asynchronous and backward-compatible detection and prevention of ARP cache poisoning

Life of this patent

Middle approach to asynchronous and backward-compatible detection and prevention of ARP cache poisoning

Life of this patent

Abstract

Claims14