Research Of DHCP Security Mechanism

With the popularity of the Internet, the number of individual network terminals is rising rapidly, especially the personal mobile terminal holdings is showing the scale of explosive growth. And depending on simple to use and easy to configure, DHCP gradually becomes the preferred IP address distribution mode in network combination. However, the network security awareness of the network terminal holders has not yet been improved. Meanwhile, the potential vulnerabilities lurking deeply in some of the original TCP/IP protocol, such as rogue DHCP server, ARP spoofing, have increased sharply. These make the Internet security crisis even worse. In order to solve this problem, network security management had been put on the agenda. As a comprehensive security solution, it integrates the traditional "Firewall", "Authentication", "Data Encryption", "Intrusion Detection" and other security measures into one system. It can dig the intrinsic relation of the wide variety of information, then identify the problem, and eventually make the corresponding processing.Based on the analysis of DHCP protocol security holes, the thesis summarized some of the common features of security threats. And by those features, we realized a set of DHCP security management system-DHCPGuard. The system not only can accurately detect and locate the abnormal node of campus network, but also can handle the follow-up tasks. Meanwhile, it can effectively defense the attack based on vulnerability of DHCP, also can greatly reduce the severe damage caused by ARP spoofing in local network. Finally, to make the system more safer, we considered DHCP server disaster recovery technology, and found that DHCPGuard with DHCP Failover mechanism could achieve the load balancing purposes and deal with emergency situations.