WO2010041788A1

WO2010041788A1 - A method for neutralizing the arp spoofing attack by using counterfeit mac addresses

Info

Publication number: WO2010041788A1
Application number: PCT/KR2008/006793
Authority: WO
Inventors: Hyoung-Bae Park; Yun-Seok Lee; Kyu-Min Choi; Kyoung-Pil Kong; Pil-Sang You; Sung-Goo Kim
Original assignee: Plustech Inc.
Priority date: 2008-10-10
Filing date: 2008-11-18
Publication date: 2010-04-15

Abstract

The present invention is related to a method for neutralizing a malicious ARP spoofing attack generated in a local network and in particular, the present invention provides a method for neutralizing an ARP spoofing attack comprising a step for detecting an ARP spoofing attack based on an ARP request packet generated for an ARP spoofing attack; a step for generating a plurality of counterfeit MAC addresses and dynamically changing MAC addresses of network devices or servers which are to be protected whenever an ARP spoofing attack is generated; and a step for neutralizing an ARP spoofing attack by using a counterfeit MAC address which is capable of neutralizing an ARP spoofing attack adequately.

Description

A METHOD FOR NEUTRALIZING THE ARP SPOOFING ATTACK BY USING COUNTERFEIT MAC ADDRESSES

Technical Field

[1] The present invention relates to a method for detecting and neutralizing an ARP spoofing attack and in particular, relates to a method using a counterfeit MAC address for neutralizing an ARP spoofing attack, wherein consists of a step for detecting an ARP spoofing attack by collecting an ARP request packet transmitted for forging a MAC address when a hacker forges the MAC address of a attack target identically and then counterfeits information of an ARP cache table of a switch or a other network devices in order to execute an ARP spoofing attack, and a step for changing the MAC address of the attack target into a counterfeit MAC address if an ARP spoofing attack is detected so that an ARP spoofing attack can be neutralized. Background Art

[2] Recently, an Internet technology is developing remarkably without let-up and is being disseminated widely, anyone can use the Internet easily.

[3] Thus, Internet users have been increasing tremendously, but all of Internet users do not necessarily know technology about computer systems or networks very well.

[4] That is, Internet users are increasing incessantly due to spread of Internet use, but since they do not always have special knowledge about a computer or the Internet, the wicked persons who execute various kinds of crimes via a network using this drawback are increasing bit by bit.

[5] For example, consider a case such as an individual information theft which is drawing keen attention of the citizens recently intensively. In the past, most users using the Internet have a tendency that they ignore or disregard importance of individual information or security, and thus they have been thinking little of importance. But, as various kinds of crimes are generated using such a way of thinking, awareness of network security is being enhanced and thus, as described above, a method to prevent illegal hacking and the like is drawing keen attention of the concerned persons.

[6] Further, as described above, there are many hacking ways as a method to acquire individual information illegally, but a hacking method using an ARP spoofing attack can be enumerated as an example.

[7] An ARP spoofing attack is as follows. A hacker forges the MAC address of a attack target identically and then counterfeits information of an ARP cache table of a switch or a other network devices. As a result, the attacker can obtain desired information from the routed traffic by routing traffic between a computer that is the attack target and a server to a attacker's computer.

[8] In this way, if a hacker forges information of an ARP cache table of a switch or other network devices via an ARP spoofing attack, the hacker can route traffic between a computer that is the attack target and a server to his own computer, and thereby, the attacker can obtain very useful individual information such as a password and etc. from the routed traffic without restriction.

[9] Therefore, as Internet users are increasing explosively, such an ARP spoofing attack becomes a very serious problem in light of a situation that diverse equipments are employed for establishing a network in enterprises, individuals and even homes.

[10] A conventional method for neutralizing this malicious ARP spoofing attack is follows. If many IPs having same MAC address are spotted by scanning an ARP table of same local network equipments, there is a room for doubt that an ARP spoofing attack is generated and first of all, it is confirmed whether an execution file including vicious code for an ARP spoofing attack exists or is being executed in a suspicious equipment for which an ARP spoofing attack is generated. After detecting whether an ARP spoofing attack is generated or not, an ARP spoofing attack is blocked through deletion of a concerned execution file and execution stop of a process.

[11] In this way, after confirming whether an execution file including malicious codes for an ARP spoofing attack exists or is being executed in a suspicious equipment for which an ARP spoofing attack is generated, an ARP spoofing attack is blocked temporarily through deletion of a concerned execution file and execution stop of a process, but such a method is only a temporary way of blocking.

[12] That is, as malicious codes and concerned execution file names are changed and evolved, the conventional method described as above can not be free from an ARP spoofing attack and there is an ineffective problem that all equipments for which there is a suspicion that an ARP spoofing attack is generated must be checked one by one.

[13] Further, this problem is getting more serious as suspicious equipments are increasing, that is, a scale of a network is being enlarged.

[14] Therefore, under a present situation that a scale of a network is being enlarged and so numerous network equipments are used, there are immense efforts and time for checking all equipments for which there is a suspicion that an ARP spoofing attack is generated one by one, and personnel expenses and other costs are also increased when personnel is increased in order to reduce the checking time. As a result, there exist many problems in terms of time and cost as well as spoofing damage.

[15] Therefore, in order to solve the above conventional problems, it is desirable to provide a method for neutralizing an ARP spoofing attack swiftly and effectively, but a method which satisfies those conditions has not been developed until now. Disclosure of Invention

Technical Problem

[16] Therefore, in order to solve a conventional problem that can not neutralize effectively an ARP spoofing attack which is evolving and changing continuously, the object of the present invention is to provide a method comprising a step for detecting an ARP spoofing attack in a real time manner, a step for initially neutralizing an ARP spoofing attack by changing a MAC address of an equipment which is a target of an ARP spoofing attack into a counterfeit MAC address after detection and a step for neutralizing an ARP spoofing attack using the counterfeit MAC address for initially neutralizing an ARP spoofing attack which is evolving and changing continuously.

[17] Further, in order to improve inefficiency of a prior art which must check equipments having a room for doubt that an ARP spoofing attack is generated one by one, another object of the present invention is to provide a method comprising a step for detecting an ARP spoofing attack in a real time manner, a step for initially neutralizing an ARP spoofing attack by changing a MAC address of an equipment which is a target of an ARP spoofing attack into a counterfeit MAC address after detection and a step for neutralizing an ARP spoofing attack using more effective counterfeit MAC address in terms of time and cost without checking equipments having a room for doubt that an ARP spoofing attack is generated one by one. Technical Solution

[18] In order to accomplish the above objects, a system for neutralizing an ARP spoofing attack according to the present invention is provided and the system consists of a local network including a general network device such as a subscriber PC, terminal equipments and a switch; a network for neutralizing an ARP spoofing attack and including a network device such as a router, terminal equipments, a server and a switch; and a means for neutralizing an ARP spoofing attack which is connected between the switch of the local network, and the switch of a network for neutralizing an ARP spoofing attack so that all traffics can be bypassed in case of communications between the above networks.

[19] Here, the means for neutralizing an ARP spoofing attack includes a means for detecting an ARP spoofing attack against the network device or the server, and which is connected between the local network and the network for neutralizing a ARP spoofing attack so that all kinds of packets generated or received by a subscriber of the local network can pass through; a MAC address conversion table having a real MAC address of an equipment, and a plurality of counterfeit MAC addresses corresponding to the real MAC address of the equipment in order to change a MAC address of a network device or a MAC address of a server which is to be protected from an ARP spoofing attack into a counterfeit address; and a transmission unit for transmitting all of transmitted and received packets to the counterfeit MAC address via the local network.

[20] Further, the means for detecting an ARP spoofing attack recognizes a fact that an

ARP attack is generated if an ARP request packet in which a MAC address of a transmitter is identical to the MAC address of the network device or the MAC address of the server is collected among all ARP request packets collected via a network interface connected to the local network, and changes a MAC address which is currently being used into a counterfeit MAC address which is not used based on the MAC address conversion table.

[21] Further, a system for neutralizing an ARP spoofing attack according to the present invention is provided and the system includes a local network including a general network device such as a subscriber PC, terminal equipments and a switch; and a terminal device for neutralizing an ARP spoofing attack which is connected to the local network, and where a software for neutralizing an ARP spoofing attack is embedded so that all traffics transmitted and received among the local network can be bypassed.

[22] Here, the software for neutralizing an ARP spoofing attack executes a step for detecting an ARP spoofing attack which is executed against the terminal device for neutralizing an ARP spoofing attack by each of subscriber PCs and the like of the local network, and wherein the terminal device is connected to the local network so that all kinds of packets generated or received between the terminal device for neutralizing an ARP spoofing attack and a subscriber of the local network can pass through; a step for changing a MAC address of the terminal device for neutralizing an ARP spoofing attack which is currently being used into a counterfeit MAC address which is not used based on a MAC address conversion table having a real MAC address of an equipment, and a plurality of counterfeit MAC addresses corresponding to the real MAC address of the equipment in order to change the MAC address of the terminal device for neutralizing an ARP spoofing attack which is to be protected from an ARP spoofing attack into a counterfeit address if it is judged that an ARP attack is generated in the step for detecting an ARP spoofing attack; and a step for transmitting all of transmitted and received packets to the counterfeit MAC address via the local network.

[23] Further, the step for detecting an ARP spoofing attack recognizes a fact that an ARP attack is generated if an ARP request packet in which the MAC address of the terminal device for neutralizing an ARP spoofing attack is identical to the MAC address of a transmitter is collected among all ARP request packets collected via a network interface connected to the local network.

[24] Further, a method for neutralizing an ARP spoofing attack according to the present invention is provided and the method consists of a step for allocating a counterfeit MAC address to a network device or a terminal device for neutralizing an ARP spoofing attack; a step for monitoring whether an ARP spoofing attack is executed by monitoring an ARP request packet or not; a step for changing the counterfeit MAC address of an detected attack target if an attack is detected at the monitoring step; a step for notifying network devices and terminal devices on all local networks of the changed counterfeit MAC address; and a step for changing MAC addresses of all reception and transmission packets into the changed counterfeit MAC address and executing communications.

[25] Here, the step for monitoring whether an ARP spoofing attack is executed by monitoring an ARP request packet or not includes a step for filtering and collecting only ARP request packets for which an OP code value is 1 among packets received from the local networks; and a step for judging whether a MAC address which is identical to a Sender MAC address of a header information of the ARP request packet exists in the counterfeit MAC addresses or not, and if it exits, judging that a spoofing attack for a concerned MAC address exists since an ARP request packet is regarded as an ARP request packet generated in a real network device or a server but an ARP request packet from a specific terminal of a network for counterfeiting an ARP cache table for a switch or other network devices.

[26] Further, the step for changing the counterfeit MAC address selects a counterfeit

MAC address that is not currently used for changing the counterfeit MAC address for which an attack is detected into the counterfeit MAC address that is not currently used based on the MAC address conversion table having a real MAC address of a equipment, and a plurality of counterfeit MAC addresses corresponding to the real MAC address of the equipment if the attack is detected.

[27] Further, the step for notifying network devices and terminal devices generates an

ARP request packet indicating that the counterfeit MAC address which is attacked is changed, and transmits it to the network devices and the terminal devices on all local networks of the changed counterfeit MAC address transmits in a broadcasting manner.

[28] Further, the communication step includes a step for changing a receiver MAC of a packet transmitted to the network devices or the terminal devices into a real MAC address of the network devices and the terminal devices which are ready to receive based on the MAC conversion table so that the network devices or the terminal devices can communicate to the changed counterfeit MAC address; and a step for changing a transmitter MAC of a packet transmitted from the network devices or the terminal devices into a counterfeit MAC address of the network devices and the terminal devices which are ready to transmit based on the MAC conversion table. Advantageous Effects

[29] As described above, according to the prior art, first of all, it must be confirmed whether an execution file including vicious code for an ARP spoofing attack exists or is being executed in suspicious equipment for which an ARP spoofing attack is generated. Therefore, a conventional problem can not neutralize effectively an ARP spoofing attack which is evolving and changing continuously. In order to solve this problem, the present invention can provide a method comprising a step for detecting an ARP spoofing attack in a real time manner; a step for initially neutralizing an ARP spoofing attack by changing a MAC address of an equipment which is a target of an ARP spoofing attack into a counterfeit MAC address after detection; and a step for neutralizing an ARP spoofing attack using the counterfeit MAC address for effectively neutralizing an ARP spoofing attack which is evolving and changing continuously.

[30] Further, according to the prior art, there are immense efforts and time for checking all equipments for which there is a suspicion that an ARP spoofing attack is generated one by one, and personnel expenses and other costs are also increased when personnel is increased in order to reduce the checking time. As a result, there exist many problems in terms of time and cost as well as spoofing damage. In order to solve these problems, the present invention can provide a method comprising a step for detecting an ARP spoofing attack in a real time manner; a step for initially neutralizing an ARP spoofing attack by changing a MAC address of an equipment which is a target of an ARP spoofing attack into a counterfeit MAC address after detection; and a step for neutralizing an ARP spoofing attack using more effective counterfeit MAC address in terms of time and cost without checking equipments having a room for doubt that an ARP spoofing attack is generated one by one.

[31] Therefore, according to the present invention, as a MAC address of an equipment for neutralizing an ARP spoofing attack is allocated and changed into a counterfeit MAC address, there is an effect that it is possible to protect concerned equipments from an ARP spoofing attack without executing any special countermeasures against an ARP spoofing attacker(for example, removal of an ARP spoofing malicious code by using a vaccine, power OFF of a attack system and etc.).

[32] Further, a method for executing communications on a local network can be changed or improved into various security technologies on a local network by using a counterfeit MAC method of a system according to the present invention. Brief Description of Drawings

[33] The above and other aspects, features and advantages of the present invention will be more apparent from the following detailed description taken in conjunction with the accompanying drawings, in which ; FIG. 1 is a configuration diagram of network system showing a state in which a system for neutralizing an ARP spoofing attack which executes a method for neutralizing an ARP spoofing attack by using a counterfeit MAC address is applied to a network according to a first embodiment of the present invention.

[34] FIG. 2 is a flow chart showing whole procedures of allocation of a counterfeit MAC address and a MAC address change process for detection of an ARP spoofing attack and neutralization of an ARP spoofing attack.

[35] FIG. 3 is a diagram showing a structure of an ARP request packet for notifying change of a counterfeit MAC address.

[36] FIG. 4 is a schematic diagram showing a state in which communications can be realized by changing a real MAC address into a counterfeit MAC address among a network device, a terminal or a server for neutralizing an ARP spoofing attack.

[37] FIG. 5 is a diagram showing an example of a MAC address allocation table which is referred to for allocation and change of a counterfeit MAC address.

[38] FIG. 6 is a flow chart showing whole procedures of a method for neutralizing an

ARP spoofing attack by using a counterfeit MAC address according to the present invention.

[39] FIG. 7 is a schematic configuration diagram showing a structure of a second embodiment of a network system for neutralizing an ARP spoofing attack which executes a method for neutralizing an ARP spoofing attack by using a counterfeit MAC address according to the present invention.

[40] [Description of reference numbers in figures]

[41] 10. A system for neutralizing an ARP spoofing attack

[42] 11. A network for neutralizing an ARP spoofing attack

[43] 12. local network 13, 14. switch

[44] 15. A system for neutralizing an ARP spoofing attack

[45] 16. A terminal device for neutralizing an ARP spoofing attack

[46] 17. A SAV for neutralizing an ARP spoofing attack 18. interface

[47] 19. network devices and terminal devices 20. server 21. subscriber PC

[48] 31. Ethernet header 32. ARP header 41 , 44. Input port

[49] 42. MAC address conversion table 43, 45. Output port

Best Mode for Carrying out the Invention

[50] According to an embodiment of the present invention, a system for neutralizing an

ARP spoofing attack comprising a local network including a general network device such as a subscriber PC, terminal equipments and a switch; a network for neutralizing an ARP spoofing attack and including a network device such as a router, terminal equipments, a server and a switch; and a means for neutralizing an ARP spoofing attack which is connected between the switch of the local network, and the switch of a network for neutralizing an ARP spoofing attack so that all traffics can be bypassed in case of communications between the above networks is provided.

[51] Here, the means for neutralizing an ARP spoofing attack includes a means for detecting an ARP spoofing attack against the network device or the server, and which is connected between the local network and the network for neutralizing a ARP spoofing attack so that all kinds of packets generated or received by a subscriber of the local network can pass through; a MAC address conversion table having a real MAC address of an equipment, and a plurality of counterfeit MAC addresses corresponding to the real MAC address of the equipment in order to change a MAC address of a network device or a MAC address of a server which is to be protected from an ARP spoofing attack into a counterfeit address; and a transmission unit for transmitting all of transmitted and received packets to the counterfeit MAC address via the local network.

[52] Further, the means for detecting an ARP spoofing attack recognizes a fact that an

[53] Further, according to another embodiment of the present invention, a system for ne utralizing an ARP spoofing attack is provided and the system includes a local network including a general network device such as a subscriber PC, terminal equipments and a switch; and a terminal device for neutralizing an ARP spoofing attack which is connected to the local network, and where a software for neutralizing an ARP spoofing attack is embedded so that all traffics transmitted and received among the local network can be bypassed.

[54] Here, the software for neutralizing an ARP spoofing attack executes a step for detecting an ARP spoofing attack which is executed against the terminal device for neutralizing an ARP spoofing attack by each of subscriber PCs and the like of the local network, and wherein the terminal device is connected to the local network so that all kinds of packets generated or received between the terminal device for neutralizing an ARP spoofing attack and a subscriber of the local network can pass through; a step for changing a MAC address of the terminal device for neutralizing an ARP spoofing attack which is currently being used into a counterfeit MAC address which is not used based on a MAC address conversion table having a real MAC address of an equipment, and a plurality of counterfeit MAC addresses corresponding to the MAC address of the equipment in order to change the MAC address of the terminal device for neutralizing an ARP spoofing attack which is to be protected from an ARP spoofing attack into a counterfeit address if it is judged that an ARP attack is generated in the step for detecting an ARP spoofing attack; and a step for transmitting all of transmitted and received packets to the counterfeit MAC address via the local network.

[55] Further, the step for detecting an ARP spoofing attack recognizes a fact that an ARP attack is generated if an ARP request packet in which the MAC address of the terminal device for neutralizing an ARP spoofing attack is identical to the MAC address of a transmitter is collected among all ARP request packets collected via a network interface connected to the local network.

[56] Further, according to the present invention, a method for neutralizing an ARP spoofing attack is provided and the method consists of a step for allocating a counterfeit MAC address to a network device or a terminal device for neutralizing an ARP spoofing attack; a step for monitoring whether an ARP spoofing attack is executed by monitoring an ARP request packet or not; a step for changing the counterfeit MAC address of an detected attack target if an attack is detected at the monitoring step; a step for notifying network devices and terminal devices on all local networks of the changed counterfeit MAC address; and a step for changing MAC addresses of all reception and transmission packets into the changed counterfeit MAC address and executing communications.

[57] Here, the step for monitoring whether an ARP spoofing attack is executed by monitoring an ARP request packet or not includes a step for filtering and collecting only ARP request packets for which an OP code value is 1 among packets received from the local networks; and a step for judging whether a MAC address which is identical to a Sender MAC address of a header information of the ARP request packet exists in the counterfeit MAC addresses or not, and if it exits, judging that a spoofing attack for a concerned MAC address exists since an ARP request packet is regarded as an ARP request packet generated in a real network device or a server but an ARP request packet from a specific terminal of a network for counterfeiting an ARP cache table for a switch or other network devices.

[58] Further, the step for changing the counterfeit MAC address selects a counterfeit

MAC address that is not currently used for changing the counterfeit MAC address for which an attack is detected into the counterfeit MAC address that is not currently used based on the MAC address conversion table having a MAC address of a real equipment, and a plurality of counterfeit MAC addresses corresponding to the MAC address of the real equipment if the attack is detected.

[59] Further, the step for notifying network devices and terminal devices generates an

[60] Further, the communication step includes a step for changing a receiver MAC of a packet transmitted to the network devices or the terminal devices into a real MAC address of the network devices and the terminal devices which are ready to receive based on the MAC conversion table so that the network devices or the terminal devices can communicate to the changed counterfeit MAC address; and a step for changing a transmitter MAC of a packet transmitted from the network devices or the terminal devices into a counterfeit MAC address of the network devices and the terminal devices which are ready to transmit based on the MAC conversion table. Mode for the Invention

[61] Below, a method for neutralizing an ARP spoofing attack by using a counterfeit

MAC address according to the present invention will be explained in detail with referring to the attached drawings.

[62] Here, the explanation described below is only an embodiment for realizing the present invention, and thus the present invention is not limited only to these embodiments which are described below.

[63] First of all, FIG. 1 is a diagram illustrating a first embodiment of the present invention and in particular, is a configuration diagram of a network system illustrating a state in which a system for neutralizing an ARP spoofing attack which executes a method for neutralizing an ARP spoofing attack by using a counterfeit MAC address according to the present invention is applied to a network.

[64] As illustrated in FIG. 1, a network system 10 for neutralizing an ARP spoofing attack according to the present invention includes a system 15 for neutralizing an ARP spoofing attack arranged between a switch 13 of the local network and a switch 14 of a network for neutralizing an ARP spoofing attack so that all traffic of communication generated between a network 11 for neutralizing an ARP spoofing attack and a local network 12 including common network devices and terminal equipments can be bypassed.

[65] Further, as illustrated in FIG. 7, a network system 10 for neutralizing an ARP spoofing attack according to the present invention includes a terminal device 16 for neutralizing an ARP spoofing attack, and a software 17 for neutralizing an ARP spoofing attack which is embedded in the terminal device 16 for enabling all traffics transmitted and received among the local network 12 to be bypassed.

[66] Here, the structure illustrated in FIG. 7 will be explained in detail later.

[67] Therefore, allocation of a counterfeit MAC address and a MAC address change process for neutralization of an ARP spoofing attack are executed by the system 15 for neutralizing an ARP spoofing attack in the network system as described above and the software 17 for neutralizing an ARP spoofing attack.

[68] FIG. 2 is a flow chart showing whole procedures of allocation of a counterfeit MAC address and a MAC address change process for detection of an ARP spoofing attack and neutralization of an ARP spoofing attack.

[69] As illustrated in FIG. 2, first of all, a method for neutralizing an ARP spoofing attack by using a counterfeit MAC address according to the present invention allocates the counterfeit MAC address to an equipment or a terminal device which to be protected from an ARP spoofing attack(step S21).

[70] Then, as described later, it is monitored whether an ARP spoofing attack is executed or not by monitoring an ARP request packet(step S22), and an operator changes the counterfeit MAC address if it is detected that an ARP spoofing attack is generated(step S23).

[71] Subsequently, the changed counterfeit MAC address is notified to all equipments on all local networks(step S24) and MAC addresses of all reception and transmission packets are changed by using the changed counterfeit MAC address(step S25).

[72] Therefore, through the above processes, it is monitored whether an ARP spoofing attack is executed or not by monitoring an ARP request packet and an ARP spoofing attack can be neutralized by changing the counterfeit MAC address if it is detected that an ARP spoofing attack is generated.

[73] Subsequently, as described above, a method for monitoring whether an ARP spoofing attack is executed or not by monitoring an ARP request packet will be explained in detail.

[74] A method for detecting an ARP spoofing attack according to the present invention filters and collects only ARP request packets for which an OP code value is 1 among packets transmitted from the local network 12 to an interface 18 of the system 15 for neutralizing an ARP spoofing attack.

[75] Then, it is judged whether a MAC address which is identical to a Sender MAC address of a header information of the ARP request packet exists in the counterfeit MAC addresses of the network 11 for neutralizing an ARP spoofing attack or not. If the MAC address exits, it is judged that an ARP spoofing attack for a concerned MAC address exists since an ARP request packet is not regarded as an ARP request packet generated in a real network device 19 or a server 20 but regarded as an ARP request packet from a specific terminal of a network for counterfeiting an ARP cache table for a switch or other network devices.

[76] In this way, if it is detected that an ARP spoofing attack is generated from the local network 12, an ARP request packet indicating that the counterfeit MAC address which is attacked is changed, and transmits it to all network equipments and the terminal devices on the local network 12 is generated and is transmitted to the local network 12 in a broadcasting manner in order to change the counterfeit MAC address for which an attack is detected into the counterfeit MAC address that is not currently used.

[77] As described above, FIG. 3 is a diagram showing a structure of an ARP request packet for notifying change of a counterfeit MAC address. Referring to FIG. 3, the ARP request packet includes an Ethernet header 31 and an ARP header 32, and a field information generation portion of the Ethernet header 31 is as follows.

[78] ; Destination MAC Address enters OxFFFFFFFFFFFF of broadcasting address

[79] ; Source MAC Address 402 enters a counterfeit MAC address which is newly to be changed.

[80] ; Ethernet Type 403 enters 0x0806 of ARP type.

[81] Further, each field information of a field information generation portion of a ARP header is as follows.

[82] ; HAV Type 404 enters 0x0001 of Ethernet type.

[83] ; Protocol Type 40 enters 0x0800 which is an IP protocol.

[84] ; HAV Size 406 enters 6 which is a size of Ethernet address.

[85] ; Protocol Size 407 enters 4 which is a size of an IPv4 address.

[86] ; OPcode 408 enters 0x0001 which is an ARP request type.

[87] ; Sender Mac Address 409 enters a counterfeit MAC which is to be changed.

[88] ; Sender IP Address 410 enters an equipment IP of a counterfeit MAC which is to be changed.

[89] ; Target MAC Address 411 enters 0x000000000000.

[90] ; Target IP Address 412 enters an IP information which is identical to the Sender IP

Address, generates an ARP request packet and transmits a concerned packet to a local network.

[91] Subsequently, a communication method which can be realized by changing a real

MAC address into a counterfeit MAC address in a network for neutralizing an ARP spoofing attack will be explained in detail with referring to FIG. 4.

[92] FIG. 4 is a schematic diagram showing a state in which communications can be realized by changing a real MAC address into a counterfeit MAC address between a server 20 or a network devices and a terminal device 19 of the network 11 for neutralizing an ARP spoofing attack and the system 15 for neutralizing an ARP spoofing attack.

[93] As illustrated in FIG. 4, in connection with a Destination MAC Address 401 of a packet having the Ethernet header 31 among the traffic inputted to an input(In) port 401 from the local network 12, the system 15 for neutralizing an ARP spoofing attack changes the Destination MAC Address 401 into real MAC address of an equipment matching with a counterfeit MAC address of a MAC address conversion table 42 in order to change a counterfeit MAC address into the real MAC address of an equipment. Then, the changed address is transmitted to an output(Out) port 43 connected to the network 11 for neutralizing an ARP spoofing attack. Further, in connection with a Source MAC Address 402 of a packet having the Ethernet header 31 among the traffic inputted from the network 11 for neutralizing an ARP spoofing attack and the terminal device to an input(In) port 44, the system 15 for neutralizing an ARP spoofing attack changes the Source MAC Address 402 into a counterfeit MAC address of an equipment which matches with a real MAC address of a MAC address conversion table 42 and is now currently used in order to change a real MAC address into the counterfeit MAC address. Then, the changed address is transmitted to an output(Out) port 45 connected to the network 12.

[94] Therefore, as described above, the equipments and the terminals of the local network

12 can execute communication based on the counterfeit MAC address of the MAC address conversion table 42 according to the processes of the system 15 for neutralizing an ARP spoofing attack.

[95] FIG. 5 is a diagram showing an example of a MAC address allocation table 42 which is referred to for allocation and change of a counterfeit MAC address.

[96] As illustrated in FIG. 5, in a MAC address allocation table for allocation of a counterfeit MAC address, three counterfeit addresses are randomly created for each of real MAC addresses of equipments without overlapping, and in connection with each of the real MAC addresses of equipments, the MAC address allocation table is organized by selecting a counterfeit address which can use a counterfeit MAC address which is initially created as a counterfeit MAC address which is currently used among available counterfeit MAC addresses.

[97] In the MAC address allocation(conversion) table which is organized as such, if it is detected that an ARP spoofing attack is generated in a counterfeit MAC address which is currently used, three counterfeit MAC addresses are arranged as a ring shape according to a Round Robin method and a counterfeit MAC address having 2 is changed into a counterfeit MAC address which is currently used if a MAC address in which an ARP spoofing attack is detected is a counterfeit MAC address having 1.

[98] Further, if it is detected that an ARP spoofing attack is generated in a counterfeit

MAC address having 2, a counterfeit MAC address having 3 is changed into a counterfeit MAC address which is currently used. If it is detected that an ARP spoofing attack is generated in a counterfeit MAC address having 3, a counterfeit MAC address having 1 is changed into a counterfeit MAC address which is currently used. Thereby, an ARP spoofing attack can be neutralized.

[99] FIG. 6 is a flow chart showing whole procedures of a method for neutralizing an

[100] As illustrated in FIG. 6, a method for neutralizing an ARP spoofing attack by using a counterfeit MAC address according to the present invention monitoring packets transmitted in a network(step S61), filters only ARP packets of the monitored packets(step S62), and judges whether the filtered packet is an ARP request packet or not(step S63).

[101] If a judgement result is "YES", that is, if the filtered packet is an ARP request packet, a counterfeit MAC address is extracted from the counterfeit MAC address conversion table(step S64).

[102] Then, judges whether a MAC address which a Sender MAC address is identical to the extracted counterfeit MAC address exists or not(step S65).

[103] If a judgement result is "YES", that is, if same MAC address exists, detects that an ARP spoofing attack is generated(step S66), and it is judged whether Sender MAC is currently used or not(step S67).

[104] If a judgement result is "YES", that is, if Sender MAC is currently used, a counterfeit MAC address which is now used in the counterfeit MAC address conversion table into a counterfeit MAC address which is not currently used(step S68).

[105] Then, reception and transmission MAC is changed based on a counterfeit MAC address which is now used in the counterfeit MAC address conversion table(step S69).

[106] Further, if a judgement result is "NO" (step S63, S65, S67), it is judged that an ARP spoofing attack is not generated and thus the whole process is terminated.

[107] Therefore, through the processes described as above, an ARP spoofing attack is detected in a real time manner, and a vicious ARP spoofing attack can be neutralized effectively by changing a counterfeit MAC address which is currently used into another address if an ARP spoofing attack is detected.

[108] Next, a second embodiment of a method for neutralizing an ARP spoofing attack by using a counterfeit MAC address according to the present invention will be explained in detail with referring to FIG. 7.

[109] Here, for simplifications of explanation, the portions which are identical to those of the first embodiment are denoted by same symbols and the explanation thereof are omitted.

[110] As illustrated in FIG. 7, the second embodiment of a method for neutralizing an ARP spoofing attack by using a counterfeit MAC address according to the present invention is different from the first embodiment in that the local network 12 is directly connected to the Internet, and allocation and change of a counterfeit MAC address for detection of an ARP spoofing attack and neutralization of an ARP spoofing attack are executed by using a SW(software) 17 for neutralizing an ARP spoofing attack embedded in a terminal device 16 for neutralizing an ARP spoofing attack instead of the system 15 for neutralizing an ARP spoofing attack in the first embodiment.

[I l l] That is, unlike the system 15 for neutralizing an ARP spoofing attack in the first embodiment, the terminal device 16 for neutralizing an ARP spoofing attack in the second embodiment is connected to the local network 12 and monitors all traffics generated and transmitted between every terminal such as a subscriber PC 21 existing in the local network 12 and the terminal device 16 for neutralizing an ARP spoofing attack. Further, if an ARP spoofing attack is detected against the terminal device 16 from the subscriber PC 21, as described above, a counterfeit MAC address which is currently used changed into another address which is not used based on the counterfeit MAC address conversion table, and communications are executed by using the changed address.

[112] Further, these processes are executed by the SW(software) 17 for neutralizing an ARP spoofing attack embedded in the terminal device 16, and the specific processes are identical to those of the first embodiment.

[113] That is, the SW(software) 17 for neutralizing an ARP spoofing attack monitors all packets generated and received between the terminal device 16 and the local network 17 and thus an ARP spoofing attack which is targeted to terminal device 16 can be detected in the subscriber PC 21 and the like the local network 12.

[114] Here, when detecting an ARP spoofing attack, if an ARP request packet in which a MAC address of a transmitter is identical to the MAC address of the terminal device 16 is collected among all ARP request packets collected via a network interface connected to the local network 12, it is recognized that an ARP spoofing attack is generated.

[115] Thereafter, if it is recognized that an ARP spoofing attack is generated, the MAC address of the terminal device 16 which is currently used is changed into a counterfeit MAC address which is not currently used with referring to a MAC address conversion table having a real MAC address of an equipment, and a plurality of counterfeit MAC addresses corresponding to the real MAC address of the equipment in order to change a MAC address of the terminal device 16 which is to be protected from an ARP spoofing attack into a counterfeit address.

[116] Then, all reception and transmission packets are transmitted to the changed address of the local network 12.

[117] Therefore, according to the second embodiment of the present invention, it is also possible to realize a method for neutralizing an ARP spoofing attack by using a counterfeit MAC address through software.

[118] Further, in the second embodiment, the terminal device 16 including the

SW(software) 17 for neutralizing an ARP spoofing attack is illustrated as a separate external device, but the SW(software) 17 for neutralizing an ARP spoofing attack, for example, can be realized as a client program embedded in the subscriber PC 21.

[119] As described above, a method for neutralizing an ARP spoofing attack by using a counterfeit MAC address according to the present invention is explained in detail while taking the embodiments of the present invention as examples, but the present invention is not limited to the embodiments and the detailed explanation of the present invention.

[120] That is, in the first embodiment, the system 15 for neutralizing an ARP spoofing attack is arranged, but if a series of processes as described above can be executed, the system 15 can also be implemented as an independent system of a hardware type like the first embodiment or can be provided as a separate external device or a software such as an application program embedded in a server or a client like the second embodiment.

[121] Here, if the system 15 is provided as a software type as described above, the present invention is provided as a recording medium where a program for executing a series of processes as described above is recorded or can be provided as a download program which can be obtained via downloading in the Internet. Therefore, the system 15 can be provided as various kinds of types if necessary.

[122] Therefore, the present invention is not limited only to the detailed explanation of the present invention as described above, and it is natural that according to design and diverse demands, various modifications and changes can be made by the person having a common knowledge in the related art within the scope of the claims of the present invention without deviating from the spirit and the scope of the present invention.

Industrial Applicability

[123] According to the present invention, since a MAC address of an equipment for neutralizing an ARP spoofing attack is allocated and changed into a counterfeit MAC address, there is an effect that initially, it is possible to protect a concerned equipment from an ARP spoofing attack without taking countermeasures against an ARP spoofing attacker(for example, removal of an ARP spoofing malicious code by using a vaccine, power OFF of a attack system and etc.).

[124] Further, a method for executing communications in a local network by using a counterfeit MAC method of a system according to the present invention can be changed or improved as various security technologies on a local network.

Claims

[1] A system for neutralizing an ARP spoofing attack comprising, a local network including a general network device such as a subscriber PC, terminal equipments and a switch; a network for neutralizing an ARP spoofing attack and including a network device such as a router, terminal equipments, a server and a switch; and a means for neutralizing an ARP spoofing attack which is connected between the switch of the local network and the switch of a network for neutralizing an ARP spoofing attack so that all traffics can be bypassed in case of communications between the above networks.

[2] The system for neutralizing an ARP spoofing attack set forth in the claim 1, wherein the means for neutralizing an ARP spoofing attack comprises, a means for detecting an ARP spoofing attack against the network device or the server, and which is connected between the local network and the network for neutralizing a ARP spoofing attack so that all kinds of packets generated or received by a subscriber of the local network can pass through, a MAC address conversion table having a real MAC address of an equipment, and a plurality of counterfeit MAC addresses corresponding to the real MAC address of the equipment in order to change a MAC address of a network device or a MAC address of a server which is to be protected from an ARP spoofing attack into a counterfeit address, and a transmission unit for transmitting all of transmitted and received packets to the counterfeit MAC address via the local network.

[3] The system for neutralizing an ARP spoofing attack set forth in the claim 2, wherein the means for detecting an ARP spoofing attack recognizes a fact that an ARP attack is generated if an ARP request packet in which a MAC address of a transmitter is identical to the MAC address of the network device or the MAC address of the server is collected among all ARP request packets collected via a network interface connected to the local network, and changes a MAC address which is currently being used into a counterfeit MAC address which is not used based on the MAC address conversion table.

[4] A system for neutralizing an ARP spoofing attack comprising, a local network including a general network device such as a subscriber PC, terminal equipments and a switch; and a terminal device for neutralizing an ARP spoofing attack which is connected to the local network, and where a software for neutralizing an ARP spoofing attack is embedded so that all traffics transmitted and received among the local network can be bypassed.

[5] The system for neutralizing an ARP spoofing attack set forth in the claim 4, wherein the software for neutralizing an ARP spoofing attack executes, a step for detecting an ARP spoofing attack which is executed against the terminal device for neutralizing an ARP spoofing attack by each of subscriber PCs and the like of the local network, and wherein the terminal device is connected to the local network so that all kinds of packets generated or received between the terminal device for neutralizing an ARP spoofing attack and a subscriber of the local network can pass through, a step for changing a MAC address of the terminal device for neutralizing an ARP spoofing attack which is currently being used into a counterfeit MAC address which is not used based on a MAC address conversion table having a real MAC address of an equipment, and a plurality of counterfeit MAC addresses corresponding to the real MAC address of the equipment in order to change the MAC address of the terminal device for neutralizing an ARP spoofing attack which is to be protected from an ARP spoofing attack into a counterfeit address if it is judged that an ARP attack is generated in the step for detecting an ARP spoofing attack and a step for transmitting all of transmitted and received packets to the counterfeit MAC address via the local network.

[6] The system for neutralizing an ARP spoofing attack set forth in the claim 5, wherein the step for detecting an ARP spoofing attack recognizes a fact that an ARP attack is generated if an ARP request packet in which the MAC address of the terminal device for neutralizing an ARP spoofing attack is identical to the MAC address of a transmitter is collected among all ARP request packets collected via a network interface connected to the local network.

[7] A method for neutralizing an ARP spoofing attack comprising, a step for allocating a counterfeit MAC address to a network device or a terminal device for neutralizing an ARP spoofing attack, a step for monitoring whether an ARP spoofing attack is executed by monitoring an ARP request packet or not, a step for changing the counterfeit MAC address of an detected attack target if an attack is detected at the monitoring step, a step for notifying network devices and terminal devices on all local networks of the changed counterfeit MAC address and a step for changing MAC addresses of all reception and transmission packets into the changed counterfeit MAC address and executing communications.

[8] The method for neutralizing an ARP spoofing attack set forth in the claim 7 wherein the step for monitoring whether an ARP spoofing attack is executed by monitoring an ARP request packet or not includes a step for filtering and collecting only ARP request packets for which an OP code value is 1 among packets received from the local networks, and a step for judging whether a MAC address which is identical to a Sender MAC address of a header information of the ARP request packet exists in the counterfeit MAC address or not, and if it exits, judging that an ARP spoofing attack for a concerned MAC address exists since an ARP request packet is regarded as an ARP request packet generated in a real network device or a server but an ARP request packet from a specific terminal of a network for counterfeiting an ARP cache table for a switch or other network devices.

[9] The method for neutralizing an ARP spoofing attack set forth in the claim 7 wherein the step for changing the counterfeit MAC address selects a counterfeit MAC address that is not currently used for changing the counterfeit MAC address for which an attack is detected into the counterfeit MAC address that is not currently used based on the MAC address conversion table having a real MAC address of an equipment, and a plurality of counterfeit MAC addresses corresponding to the real MAC address of the equipment if the attack is detected.

[10] The method for neutralizing an ARP spoofing attack set forth in the claim 7 wherein the step for notifying network devices and terminal devices generates an ARP request packet indicating that the counterfeit MAC address which is attacked is changed, and transmits it to the network devices and the terminal devices on all local networks of the changed counterfeit MAC address transmits in a broadcasting manner.

[11] The method for neutralizing an ARP spoofing attack set forth in the claim 7 wherein the communication step includes a step for changing a receiver MAC of a packet transmitted to the network devices or the terminal devices into a real MAC address of the network devices and the terminal devices which are ready to receive based on the MAC conversion table so that the network devices or the terminal devices can communicate to the changed counterfeit MAC address and a step for changing a transmitter MAC of a packet transmitted from the network devices or the terminal devices into a counterfeit MAC address of the network devices and the terminal devices which are ready to transmit based on the MAC conversion table.