LS-ARP: A lightweight and secure ARP

摘要

The Address Resolution Protocol (ARP) provides the link between layer 3 IPv4 addresses and layer 2 (MAC) addresses. ARP has no facilities for authenticating the communicating parties and is therefore vulnerable to spoofing attacks. Observing that in modern networks the use of the DHCP server to allocate both static and dynamic addresses is more or less taken for granted, we propose to use the DHCP server to vouch for the mapping between IP and MAC addresses. Using our proposed enhancement to ARP (a) does not affect the reliability of the network (i.e. use of this enhancement will not cause the network to become less reliable), (b) the computational overhead is less than 1% of the existing protocol overhead, and (c) dynamic addresses are fully taken into account, with the validity of the mapping expiring at the same time as the DHCP lease.