Method for neutralizing the ARP spoofing attack by using counterfeit MAC addresses

A system for neutralizing an ARP spoofing attack comprising:

• a plurality of local networks each respectively including a plurality of network devices,
• wherein the plurality of network devices in a first local network among the plurality of local networks includes a general network device that is a subscriber PC, terminal equipment, and a switch;
• a terminal device connected to the first local network and configured to neutralize an ARP spoofing attack,
• the terminal device including a MAC address conversion table configured to store respective real MAC addresses of the general network device, the terminal equipment, counterfeit MAC addresses corresponding to the real MAC addresses, and embedded software,
• wherein the counterfeit MAC addresses in the MAC address conversion table include a first counterfeit MAC address and a second counterfeit MAC address, and are stored in a ring shape arrangement, and
• wherein the embedded software in the terminal device is configured to:
• change at least one of the real MAC addresses of the general network device and the terminal equipment into the first counterfeit MAC address,
• detect when an ARP spoofing attack is executed by monitoring an ARP request packet,
• change the first counterfeit MAC address into the second counterfeit MAC address when the terminal device detects that the ARP spoofing attack is executed, wherein the changing of the first counterfeit MAC address into the second counterfeit MAC address is performed in a round robin manner based on the ring shape arrangement of the counterfeit MAC addresses stored in the MAC address conversion table, and
• subsequently, broadcast the second counterfeit MAC address to the network devices in the first local network, and change reception and transmission packets of the first local network by using the second counterfeit MAC address.

A method for neutralizing an ARP spoofing attack in a system, the system including a plurality of local networks, each of the plurality of local networks respectively including a plurality of network devices and a plurality of terminal devices,

• the plurality of network devices in a first local network among the plurality of local networks including a general network device that is a subscriber PC, terminal equipment, and a switch,
• the plurality of terminal devices in the first local network including a first terminal device,
• the method comprising,
• allocating a counterfeit MAC address to the first network device or a the first terminal device for neutralizing an ARP spoofing attack;
• storing, in a MAC address conversion table, respective real MAC addresses of the general network device and the terminal equipment, and counterfeit MAC addresses corresponding to the real MAC addresses, wherein the counterfeit MAC addresses in the MAC address conversion table include a first counterfeit MAC address and a second counterfeit MAC address, and are stored in a ring shape arrangement;
• changing at least one of the MAC addresses of the general network device and the terminal equipment into the first counterfeit MAC address;
• monitoring whether an ARP spoofing attack is executed by monitoring an ARP request packet or not, packet;
• changing the first counterfeit MAC address into the second counterfeit MAC address when the ARP spoofing attack is detected at the monitoring step, wherein the changing of the first counterfeit MAC address into the second counterfeit MAC address is performed in a round robin manner based on the ring shape arrangement of the counterfeit MAC addresses stored in the MAC address conversion table;
• subsequently, broadcasting the second counterfeit MAC address to the network devices and the terminal devices in the local networks, and changing MAC addresses of reception and transmission packets into the second counterfeit MAC address;
• and
• executing communications based on the second counterfeit MAC address.