Modeling and performance analysis of a new secure address resolution protocol

Abstract

SummaryAddress Resolution Protocol (ARP) is an essential protocol for the operation of local area networks. It is used for mapping the logical address to the physical address. However, ARP was designed without any security features. Therefore, ARP is vulnerable to many ARP spoofing attacks, such as the host impersonation, man-in-the-middle (MITM), and denial of service (DoS) attacks. Many techniques were introduced in the literature for mitigating ARP spoofing attack. However, they could not provide protection against the host impersonation and DoS attacks. This work introduces a new technique to secure address resolution protocol called ARP Authentication (ARP-A). The proposed technique provides authentication for ARP messages and entities. In addition, it converts ARP from a stateless to a stateful protocol. To evaluate the performance of ARP-A, it was implemented on Linux. To investigate the scalability of ARP-A, a new analytical model was designed for it using stochastic reward nets. The results show that, compared with other related schemes introduced in the literature, ARP-A is more efficient in terms of security and performance. ARP is a stateless protocol 2 because it does not store the state of the ARP requests. It processes an ARP Reply message whether or not it sent an ARP Request. Due to its stateless property and lack of integrity and authenticity, ARP has some serious inherent security vulnerabilities. The ARP spoofing attack 3 can be performed by transmitting a spoofed ARP Request or Reply in the network. In this attack, the attacker associates his MAC address with the IP address of the victim. So, the traffic destined to the IP address of the victim will instead be forwarded to the attacker. The ARP spoofing attack is a serious security problem that threats LANs. 4 It is usually used to perform other types of LAN attacks, such as the man-in-the-middle (MITM), 5 denial of service (DoS), 6 and host impersonation attacks. 4

Address resolution protocol spoofing attacks and security approaches: A survey

“…The ARP authentication , technique is the best solution in this category, which solves the S‐ARP drawbacks.…”

“…The ARP authentication, 17 technique is the best solution in this category, which solves the S-ARP drawbacks. In general, the cryptographic processing can lower the performance of ARP.…”

“…Authentication solutions: The author in Reference introduced a new technique called ARP authentication (ARP‐A) to mitigate the ARP attacks, which consists of two schemes:…”

“…Address resolution protocol (ARP) is one of the important protocols in Transmission Control Protocol (TCP)/Internet protocol (IP) and is used to associate the IP address of the network layer to the MAC address of the data link layer , , , , , , . Using this protocol can identify how many hosts are connected in the LAN, and discover the MAC address to IP address, in an LAN environment .…”

“…After that, the IP‐MAC addresses mapping is saved in the ARP cache table. ARP was designed without security features, so ARP doesn't support the authentication or integrity scheme, and thus can be easily spoofed. Therefore, ARP is highly susceptible to spoof and poison attacks.…”