Patent ID: 8578488
Filing Date: 2013-11-05
Classification: H04L

Abstract:
1. A system for neutralizing an ARP spoofing attack, the system comprising: a plurality of local networks each respectively including a plurality of network devices, wherein the plurality of network devices in a first local network among the plurality of local networks includes a general network device that is a subscriber PC, terminal equipment, and a switch; a neutralizing network configured to neutralize an ARP spoofing attack and including a network device that is a router, terminal equipment, a server, and a switch; and an interconnecting device connected between the first local network and the neutralizing network, and including a MAC address conversion table, the MAC address conversion table configured to store respective real MAC addresses of the general network device, the terminal equipment of the first local network, and the server, and counterfeit MAC addresses corresponding to the real MAC addresses, wherein the counterfeit MAC addresses in the MAC address conversion table include a first counterfeit MAC address and a second counterfeit MAC address, and are stored in a ring shape arrangement, and wherein the interconnecting device is configured to: change at least one of the real MAC addresses into the first counterfeit MAC address, detect when the ARP spoofing attack is executed by monitoring an ARP request packet, change the first counterfeit MAC address into the second counterfeit MAC address when the interconnecting device detects that an ARP spoofing attack is executed, wherein the changing of the first counterfeit MAC address into the second counterfeit MAC address is performed in a round robin manner based on the ring shape arrangement of the counterfeit MAC addresses stored in the MAC address conversion table, and subsequently, broadcast the second counterfeit MAC address to the network devices in the first local network, and change reception and transmission packets of the first local network by using the second counterfeit MAC address.