Collaborative Approach to Mitigating ARP Poisoning-based Man-in-the-Middle Attacks

Transcription

1 Coaborative Approach to Mitigating ARP Poisoning-based Man-in-the-Midde Attacks Seung Yeob Nam a, Sirojiddin Djuraev a, Minho Park b a Department of Information and Communication Engineering, Yeungnam University, Gyeongsan , Repubic of Korea b Schoo of Eectronic Engineering, Soongsi University, Dongjak-gu, Seou , Repubic of Korea Abstract In this paper, we propose a new mechanism for counteracting ARP (Address Resoution Protoco) poisoning-based Man-in-the-Midde (MITM) attacks in a subnet, where wired and wireess nodes can coexist. The key idea is that even a new node can be protected from an ARP cache poisoning attack if the mapping between an IP and the corresponding MAC addresses is resoved through fair voting among neighbor nodes under the condition that the number of good nodes is arger than that of maicious nodes. Providing fairness in voting among the nodes that are heterogeneous in terms of the processing capabiity and access medium is quite a chaenge. We attempt to achieve fairness in voting using the uniform transmission capabiity of Ethernet LAN cards and smaer medium access deays of Ethernet than for wireess LAN. Athough there is another scheme that resoves the same issue based on voting, i.e. MR-ARP, the voting fairness is improved further by fitering the voting repy messages from the too-eary responding nodes, and the voting-reated key parameters are determined anayticay considering the fairness in voting. This paper shows that fairness in voting can be achieved using the proposed approach, overcoming the imitations of other votingbased schemes, and ARP poisoning-based MITM attacks can be mitigated in a more generaized environment through experiments. Keywords: Address Resoution Protoco (ARP), ARP cache poisoning, Man-in-the-Midde attack, voting, voting fairness. Introduction The Address Resoution Protoco (ARP) is used to find the Media Access Contro (MAC) address corresponding to the IP address of a node in the same subnet [, 2]. The resoved address is kept temporariy in the ARP cache to reduce the resoution time for subsequent queries for the same IP address [3]. ARP poisoning attack refers to the maicious behavior of registering a fase (IP, MAC) address mapping in the ARP cache of a remote machine. If the ARP poisoning attack is successfu, the attacker can eavesdrop in the communication between the other nodes, modify the packet contents, and hijack the connection. Furthermore, ARP cache poisoning can be used to mount other types of attacks such as Denia of Service (DoS) [4], Man-in-the-Midde (MITM) attacks [5], and JavaScript insertion attack [6]. Emai addresses: synam@ynu.ac.kr (Seung Yeob Nam), sirojiddin987@gmai.com (Sirojiddin Djuraev), mhp@ssu.ac.kr (Minho Park) Severa attempts have been made to resove the ARP cache poisoning probem in a wired or wireess LAN environment. Nevertheess, it is sti not easy to find a mechanism that can prevent ARP poisoning-based MITM attacks in a practica environment where many mobie nodes easiy join and eave the considered subnet. Conventiona approaches can be cassified into two categories depending on the need to upgrade the Ethernet switches. Dynamic ARP Inspection (DAI) [7] corresponds to an approach requiring the support of Ethernet switches. DAI might prevent ARP poisoning, but this requires manua configuration by network managers. The wireess nodes connected via the same AP may not be protected by DAI. The approaches that do not require the support from Ethernet switches can be cassified into two categories depending on the use of cryptography. Antidote [8] empoys a non-cryptographic approach, and attempts to prevent ARP cache poisoning by contacting and giving a higher priority to the previous owner of a given IP address in the case of MAC confict. However, Antidote cannot prevent poisoning Preprint submitted to Computer Networks November 5, 23

2 for a new IP address if a maicious ARP repy arrives first [9]. S-ARP [9], a modified version of S-ARP [], and Ticket-based ARP (TARP) [] are we-known cryptography-based approaches. The centra servers, such as Authoritative Key Distributor (AKD) for S-ARP and Loca Ticket Agent (LTA) for TARP, might be subject to a singe point of faiure probem. Furthermore, there is a cost of manua configuration to disseminate the pubic key and the MAC address of the centra server to newy arriving hosts. This manua setting might not be appropriate for the environment of Wi-Fi hot-spots where the wireess nodes can enter and eave easiy. Phiip [2] investigated an approach to prevent ARP cache poisoning in wireess LAN by impementing the defense mechanism in the AP. The AP constructs a ist of correct IP-to-MAC address mapping by monitoring the DHCP ACK messages or referring to the DHCP eases fie, and bocks a the ARP packets with fase mapping based on the estabished ist. However, this approach can be effective ony for the dynamic IP addresses aocated through DHCP, and cannot prevent the ARP cache poisoning that occurs in the wired LAN. In this paper, we attempt to protect the upgraded nodes from ARP poisoning-based MITM attacks, regardess of whether they are wired or wireess nodes. Recenty, Nam et a. [3] proposed an enhanced version of ARP, caed MR-ARP, to prevent ARP poisoning-based MITM attacks in the Ethernet by empoying the concept of voting. MR-ARP attempts to determine the owner of a given IP address by giving a higher priority to the previous owner in case of confict on the MAC address of the owner. This is simiar to the mechanism of Antidote. If an MR-ARP node observes confict on the owner of an IP address that is not registered in its own ARP cache, the MR-ARP node triggers voting on the owner of that IP address among the neighbor nodes and makes a decision based on the voting resut. In this mechanism, it is important to maintain fairness in voting among the different nodes by having each of them send a simiar number of votes. MR-ARP achieves fairness among the wired nodes because the nodes connected to the same Ethernet have the same transmission rate, and are ikey to send a simiar number of packets during a common fixed interva. On the other hand, MR-ARP might not guarantee fairness in voting in a wireess LAN environment, because the transmission rate may not be uniform among different wireess nodes due to the traffic rate adaptation based on the signa-to-noise ratio (SNR), i.e. Auto Rate Faback (ARF) [4]. Nam et a. [5] attempted to resove the unfairness probem of MR-ARP in a wireess LAN 2 by incorporating computationa puzzes [6 8] in the voting procedure of another security-enhanced version of ARP, EMR-ARP. On the other hand, EMR-ARP requires the condition that the computation power of the neighbor machines is no more than a factor of 2 different, and this assumption may not be vaid even among the popuar tabet machines. Therefore, we investigate a new mechanism that can prevent ARP poisoning-based MITM attacks with a reaxed assumption and ess infrastructure upgrade overheads. The proposed scheme is aso based on voting among the neighbor nodes, and an attempt is made to provide fairness in voting by reying on the uniform transmission rate in the Ethernet, in a simiar manner to MR-ARP. However, the voting scheme is refined further to provide fairness in voting in a more generaized environment compared to other voting-based schemes, i.e. MR-ARP and EMR-ARP. The contribution of this paper can be summarized as foows: The proposed ARP scheme can be depoyed by upgrading the operating system, and the proposed scheme can protect the upgraded machines from ARP poisoning-based MITM attacks, even though the computation power of different wired/wireess machines is different by more than a factor of 2. The fairness in voting is improved compared to MR-ARP by dropping too eary repy packets. The impact of the eary packet fitering scheme on the voting fairness is anayticay investigated for an exampe case. The voting traffic overhead of the proposed scheme is ower than for other voting-based schemes, i.e. MR-ARP and EMR-ARP. The voting reated parameters, incuding the number of repy messages required for each neighbor node, are determined anayticay considering the fairness in voting. The proposed scheme aso shares the foowing advantages with other voting-based schemes. The manua setup or configuration is not required for the newy arriving wired or wireess nodes, because the pubic key cryptography is not required, and it is free from the singe point of faiure probem due to the absence of a centraized server. This scheme is backward compatibe with existing ARP, and the infrastructure upgrade cost is minima, because it does not require the upgrade of Ethernet switches or modification of DHCP. The remainder of the paper is organized as foows. In Section 2, the proposed mechanism to prevent ARP

3 poisoning-based MITM attack is discussed in detai. Section 3 determines the voting-reated parameters anayticay considering the fairness in voting. In Section 4, an agorithm to discard too eary repy packets is introduced to improve the voting fairness, and the impact of the eary packet fitering agorithm on the voting fairness is anayzed. In Section 5, the performance of the proposed scheme is compared with that of other votingbased schemes based on the anaysis and experiment resuts. Finay, concusions are reported in Section Voting-based Security Enhanced ARP The voting-based MITM prevention mechanisms, i.e. MR-ARP and EMR-ARP, usuay require some assumptions for norma operation. The foowing two assumptions are needed for MR-ARP: Assumption : The number of the voting-cognizant good nodes shoud be arger than that of the maicious nodes in the same subnet. Assumption 2: A the voting-cognizant good nodes and maicious nodes shoud be connected to the subnet through a wire. EMR-ARP requires the foowing two assumptions: Assumption 3: The number of the voting-cognizant good nodes shoud be arger than that of the maicious nodes in the same subnet. Assumption 4: The computation power of different machines is no more than a factor of 2 different. Assumption for MR-ARP is identica to Assumption 3 for EMR-ARP. The main goa of this study is to deveop a new ARP protoco that can prevent ARP poisoningbased MITM attacks with fewer assumptions compared to MR-ARP or EMR-ARP. In more detai, we attempt to drop Assumption 2 for MR-ARP and Assumption 4 for EMR-ARP, and devise a new ARP, i.e. Generaized MR-ARP (GMR-ARP), under the foowing assumption. Assumption 5: The number of the voting-cognizant good nodes is arger than that of the maicious nodes among the neighbor nodes in a wired network. At east one voting-cognizant good node is needed in the wired network to satisfy the above condition, i.e. Assumption 5. If an interna node wants to access the externa network, then the node needs to know the MAC 3 address of the gateway router, because the packets from that node need to be deivered to the gateway router first. Therefore, each interna node normay attempts to find the MAC address of the gateway router repeatedy as the timer for that entry expires in the ARP cache, and the maicious node tends to aunch MITM attacks between an interna node and the gateway router. Since the voting-based MITM prevention schemes can protect ony the nodes whose ARP code is upgraded, we assume that the new ARP code is depoyed at the gateway router to prevent the most prevaent types of MITM attacks, i.e. between an interna node and gateway router, in a subnet, and we consider that this is a reasonabe assumption. The proposed MITM-resistant version of ARP, i.e. GMR-ARP, foows the basic approach of MR-ARP [3]. One of the key ideas is as foows. When Node A knows the correct (IP, MAC) address mapping for Node B, if Node A hods the mapping whie B is aive, then ARP poisoning on Node A and the MITM attack between A and B can be prevented. MR-ARP and EMR-ARP use a ong-term (IP, MAC) mapping tabe to manage (IP, MAC) mapping for a the machines aive in the same subnet. If a new MR-ARP or EMR-ARP node attempts to find the MAC address corresponding to each IP address in a given subnet, the nodes in the same subnet might suffer from ower data throughput for an extended time period whie the new node resoves the address mapping through voting. As an exampe, EMR-ARP spends approximatey one second to find the owner of one IP address. If there are 6, nodes in a given /6 subnet, then a new EMR- ARP node might need to spend approximatey 6, seconds to find the MAC addresses of a the nodes. The new MR-ARP/EMR-ARP node and other neighbor nodes in the same subnet are ikey to suffer from a ower throughput during this time interva due to fooding of the voting packets for MR-ARP, or processing power consumed by cryptographic puzzes for EMR- ARP. To overcome this voting overhead probem of both MR-ARP and EMR-ARP, we et the new GMR-ARP node fi the ong-term tabe as much as possibe with a specia voting procedure during the initiaization stage. Before describing the initiaization stage, we discuss the ong-term (IP, MAC) mapping tabe in more detai. Athough MR-ARP and EMR-ARP attempts to maintain (IP, MAC) mapping for a aive machines in the same subnet, GMR-ARP basicay attempts to manage (IP, MAC) mapping ony for other GMR-ARP nodes because the goa of GMR-ARP is to protect the GMR- ARP nodes from ARP cache poisoning or MITM attacks. On the other hand, the IP address of non-gmr-

4 ARP node can aso be maintained in the ong-term tabe of a GMR-ARP node if the GMR-ARP node is interested in that IP address. Three fieds, IP, MAC, and Timer T L, are aocated to each IP address registered in the ong-term tabe. The defaut vaue of the timer in the ong-term tabe is 6 minutes. To avoid osing the mapping of (IP a, MAC a ) for an aive host after 6 minutes, we send new ARP request messages for IP a ony to MAC a through unicasting to check if the MAC a is aive. In this case, ARP request messages are sent at random intervas with a mean of msec. If at east one ARP repy is returned, the mapping is registered in the short-term ARP cache and the corresponding ong-term tabe timer is again set to 6 minutes. If no ARP repy returns, then the mapping of (IP a, MAC a ) is considered invaid and the corresponding entry is deeted from the ong-term tabe. Therefore, (IP, MAC) mapping can be retained in the ong-term tabe as ong as the binding is vaid. The MR-ARP or EMR-ARP node monitors every ARP request message to find a machines aive in the same subnet, and adds them to the ong-term tabe. On the other hand, a new GMR-ARP node attempts to find a the other GMR-ARP nodes, and adds them to the ong-term tabe as eary as possibe during the initiaization stage to reduce the voting time overhead. The initiaization stage is described in more detai beow. 2.. Initiaization Stage The initiaization procedure is performed ony once during the ifetime of a given machine. The initiaization stage consists of two steps. In the first step, the rebooted or newy attached node advertises its own IP/MAC mapping through a gratuitous ARP request packet [9]. Each GMR-ARP node that receives the gratuitous ARP packet examines whether the source IP address of the received packet is registered in its own ong-term tabe. If it knows the received IP address, it resoves the confict by asking the previous owner of that IP address and giving it priority. If the GMR-ARP node does not know the received IP address, it just negects the received gratuitous packet. Fig. summarizes the task that is performed by the GMR-ARP node receiving a gratuitous ARP request packet. This first step of the initiaization stage is identica to that of EMR- ARP [5]. This packet is sent first to update the (IP, MAC) mapping for a given IP easiy without the burden of voting, particuary when the owner of a given IP address changes egitimatey through DHCP. The second step has three goas. The first goa is to ensure that the new GMR-ARP node can use the seected IP address without probems. The second goa 4 / (IP a, MAC a ): the sender protoco (IP) and hardware (MAC) addresses of the received gratuitous ARP request packet / if((ip a, MAC a ) is registered in the ong-term tabe){ register (IP a, MAC a ) in the short-term cache; set the ong-term tabe timer to 6 minutes; } ese if(ip a is in the ong-term tabe, but the registered MAC is not MAC a ){ / confict on IP and MAC mapping / send ARP requests to existing MAC through unicasting at random intervas with an average of msec; if(at east one ARP repy arrives) retain the existing (IP, MAC) mapping and drop the new one; ese accept the new mapping; The accepted mapping is registered in the short-term cache, too. } Figure : Short-term cache and ong-term tabe update poicy appied on the arriva of gratuitous ARP request packets is to find the existing GMR-ARP nodes in the same subnet, and to register the IP addresses of the neighbor GMR-ARP nodes in the ong-term tabe ony when there is no confict on those IP addresses. The third goa is to register the address mapping for the new GMR- ARP node in the ong-term tabes of the neighbor GMR- ARP nodes. The second step begins sec after transmission of the gratuitous ARP request packet. In the second step, the rebooted or newy attached node sends a specia voting request packet for its own IP address to determine if the seected IP address is used by other machines. The new node can use the current IP address without probems, if there is no voting repy packet, or the MAC address of the voting node pos more than 5% of the votes. If there is at east one repy packet and the MAC address of the voting request node pos ess than 5%, the node reinquishes the current IP address and requests a new IP address through the DHCP or manua configuration with the hep of a network administrator. Therefore, the first goa is met by this procedure. When other GMR-ARP nodes receive a specia voting request message, if the (IP, MAC) mapping for the seected IP address exists in the ong-term tabe, the neighbor nodes repy by broadcasting a singe voting repy message containing the mapping. If a neighbor GMR-ARP node does not have (IP, MAC) mapping for the seected IP address, the node repies by broadcasting a voting repy message containing the mapping (IP, ). Athough this mapping does not have any information and is not counted in voting, the voting request node can know the IP and MAC addresses of a neighbor node

5 through this repy message. Based on these voting repy messages, the voting request node cacuates the ratio of votes supporting its current (IP, MAC) address mapping, and aso registers the (IP, MAC) mapping of the neighbor GMR-ARP nodes in its own ong-term tabe. The maicious nodes might attempt to corrupt the ong-term tabe by sending repy messages with a spoofed IP or MAC address. If the voting request node identifies a confict on some IP address due to IP or MAC spoofed packets by some maicious node, the voting request node eaves the MAC fied corresponding to this IP address empty, and resoves the confict ater ony when it needs to know the MAC address for this IP address. Therefore, the second goa of registering the obvious (IP, MAC) mapping of the neighbor GMR-ARP nodes in the ong-term tabe can be achieved through this procedure. The neighbor GMR-ARP nodes, which do not have the (IP, MAC) mapping for the IP address seected by the new GMR-ARP node in the ong-term tabe, monitor the repy packets from the other GMR-ARP nodes for an interva of sec. If they observe ony the mapping of (IP, ), or the MAC address of the voting node pos more than 5% of the votes excuding the votes with the mapping of (IP, ), then those neighbor GMR-ARP nodes accept the sender protoco and sender hardware address mapping of the specia voting request packet into the ARP cache and the ong-term tabe. Otherwise, the mapping is not registered in the ong-term tabe of the neighbor GMR-ARP nodes. If we consider the subnet without any adversary nodes, then we can easiy find that a the existing GMR- ARP nodes can accept the (IP, MAC) mapping of the new GMR-ARP node into the ong-term tabe through the first and second steps of the initiaization stage. Therefore, the third goa can be achieved when there is no adversary node. When there are adversary nodes, the good neighbor nodes can earn the correct (IP, MAC) mapping for the new GMR-ARP node through a voting procedure, which wi be described ater. Fig. 2 summarizes the way in which the GMR-ARP nodes process a specia voting request message that queries the MAC address for the IP address of the voting request node. Therefore, according to the initiaization procedure described above, when a GMR-ARP node sends the specia voting request packet after reboot or initia depoyment, if ony attackers repy with a fase MAC address for the queried IP address, the new node wi attempt to avoid the use of the IP address in confict. Thus, the fake repies from the maicious nodes are not ikey to be hepfu in corrupting the ARP caches of the neighbor nodes, particuary for the entry reated to the new 5 / (IP a, MAC a ): the sender protoco (IP) and hardware (MAC) addresses of the received voting request packet, IP g : the target protoco (IP) address of the received packet / if(ip g is registered in the ong-term tabe){ repy by broadcasting the MAC address for IP g ; } ese{ repy by broadcasting the mapping of (IP g,); temporariy store the mapping of (IP a, MAC a ), and monitor the repies from other GMR-ARP nodes for sec; if(ony trivia mapping of (IP g,), or MAC a pos over 5%) accept the new mapping in both short and ong term tabes; ese drop the mapping; } Figure 2: Handing of the received specia voting request packet whose sender protoco (IP) address is equa to the target protoco (IP) address GMR-ARP node. On the other hand, if there is no fake repy from the adversary nodes for the specia voting request, then a the norma GMR-ARP nodes wi accept the mapping between the sender protoco address and the sender hardware address of the specia voting request packet by the agorithm in Fig. 2. Consequenty, the proposed initiaization procedure can effectivey protect the ARP cache of existing GMR-ARP nodes from an ARP cache poisoning attack on the entry for a new GMR-ARP node. The ARP cache of a new GMR-ARP node is protected by the second step of the initiaization stage and the voting procedure described in the next subsection Voting Scheme When a new GMR-ARP node wants to know the MAC address corresponding to an IP address that is not its own ong-term tabe after the initiaization stage, it basicay resoves the mapping based on the norma ARP procedure, i.e. based on the handshake of the ARP request and ARP response messages. However, if the new GMR-ARP node cannot make a decision due to confict on the mapping, the MAC address in confict can be resoved by the voting scheme. Two more types of ARP packets are used, i.e. voting request and voting repy packets, as in MR-ARP [3]. The packet format is the same as that of the ARP request/repy packets. The operation fied is set to 2 and 2 for the voting request and repy packets, respectivey. When Node A wants to find the correct MAC address for the IP address of IP B, Node A broadcasts a voting request with IP B in the target protoco address fied to query the neighbor GMR-ARP nodes about the

6 (IP, MAC) mapping for that IP. If a neighbor GMR-ARP node receives an ARP voting request for IP B, it repies by unicasting ARP voting repies with the (IP, MAC) mapping for IP B to the voting request node at the maximum rate when it has mapping in the ong-term tabe. Node A then counts the number of votes from each IP address of the neighbor nodes, and accepts the voting repy messages unti the number of the voting repy messages from the node responding the eariest reaches. A ate repy messages are negected. We consider ony the neighbor GMR-ARP nodes who have sent more than or equa to ζ( < ζ < ) voting repy messages in the voting, and each of those nodes can contribute ony one vote, i.e. each GMR-ARP node can cast ony one vote by sending a sufficienty arge number of voting repy messages as soon as possibe. After coecting a sufficient number of the voting repy packets, Node A makes a decision based on the majority of votes. The parameters and ζ need to be determined carefuy for reiabe operation of the voting procedure, and this issue wi be discussed in more detai in the next section. We attempt to achieve two goas by this mechanism. The first goa is to achieve fairness in voting among the wired nodes even with different processing power, and another goa is to prevent node dupication attack by some adversary nodes. Some maicious nodes might attempt to send more than voting repy messages whie spoofing IP or MAC addresses to increase the ratio of the votes supporting their fake (IP, MAC) mapping, which is caed a node dupication attack. However, if the voting repy packets are accepted according to the above poicy, it is possibe to suppress the node dupication attack. How the proposed voting scheme can resove the confict on the owner of a given IP address without vunerabiity to a node dupication attack can be expained as foows. The voting request node can be either a wired node or a wireess node. These two cases are considered separatey as foows Case - Wired voting request node In this subsection, we consider the case where the voting request node is connected to the subnet through a wire. If a voting-cognizant nodes are wired ones, the fairness can be guaranteed in the Ethernet for the foowing reason. Ethernet cards normay have the capabiity to send packets up to the ink rate, and the Ethernet switch serves the packets from different ports in a fair manner. Therefore, each node is ikey to send a simiar number of voting repy packets under this fairness condition as ong as every node is transmitting packets. The fairness may not be maintained if any node finishes its own transmission. Accordingy, the fairness might be 6 guaranteed if the voting repy packets are accepted ony unti the eariest node competes its transmission. Under the assumption that each node, even incuding the maicious nodes, has ony one network card, every node wi be treated fairy in this voting, and node dupication attack is unikey to be successfu due to the fairness in voting. We can aso consider the case where some of the voting-cognizant nodes are connected through the wireess medium. The MAC access deay of a wireess node in the 82. environment is known to be of the order of tens of msec [2, 2]. On the other hand, it takes ony 6 and.6 msec to transmit 5 5-Byte packets on a -Mbps and -Gbps Ethernet, respectivey. Therefore, in this case, the voting is ikey to be terminated by the wired nodes before the wireess nodes send a sufficient number of voting repy messages, and the voting resut is highy ikey to be determined ony by the wired nodes. A simiar concusion to the case where the voting-cognizant nodes are a wired nodes can be drawn Case 2 - Wireess voting request node In this subsection, we consider the case where the voting request node is a wireess node. Let us assume that there are non-zero wireess voting-cognizant nodes and non-zero wired voting-cognizant nodes. We assume that the access point (AP) is connected to the Ethernet through a wire. In this case, the wired votingcognizant nodes can receive the voting request message amost as soon as the voting request message reaches the AP because the transmission deay on the Ethernet is negigiby sma compared to the MAC access deay in an 82. environment. However, the wireess nodes can receive a voting request message after an additiona MAC access deay from the AP to the wireess nodes. Therefore, the voting repy messages from the wired nodes are ikey to fi up the buffer in the AP earier than the packets from the wireess nodes. Consequenty, the voting resut is ikey to be determined by the wired voting cognizant nodes again. The fairness without a node dupication probem can be expained in the same way as in the previous case, i.e. Case. 3. Anaysis of Voting-reated Parameters As expained in the previous section, it is very important to preserve the fairness among the wired nodes to prevent a node dupication attack. In the voting scheme described in the previous section, if is too sma, the fairness may not be achieved among different wired

7 nodes. Therefore, it is important to find and use a sufficienty arge number for to achieve reasonabe fairness among the wired nodes in voting, and this probem is investigated in detai in this section. If ζ is ess than or equa to.5, then the proposed voting scheme might be vunerabe to a node dupication attack again. As an exampe, et us consider a case where ζ is.5. If the voting request node observes.5 voting repy messages from a neighbor node, then the voting request node wi approve one vaid vote for the neighbor node. In this case, a maicious node might attempt to contribute two votes by sending two streams of.5 voting repy packets from two different (spoofed) IP addresses. ζ needs to be maintained higher than.5 to reduce the possibiity of this probem. In this work, we consider two vaues,.6 and.7, for possibe vaues of ζ. In the proposed voting scheme, each GMR-ARP node sends voting repy messages for each voting request message, and the voting request node accepts voting repy packets ony unti the number of the voting repy messages reaches for the eariest node. M denotes the number of GMR-ARP nodes in the same subnet, and K i denotes the number of voting repy packets received from Node i ( i M). One voting experiment finishes when max i M K i =, and there wi be ony one node that satisfies the reation: K j =. Z is a random variabe satisfying the reation: max i M K i = = K Z. We are interested in the probabiity that an arbitrary neighbor node can contribute one vaid vote for a given vaue of, which can be expressed as P vv (, ζ) = Pr(K ζ K Z = ). () In the above equation, Node was seected as a tagged node without a oss of generaity. When the neighbor GMR-ARP nodes receive the voting request packet, they wi send voting repy packets at the maximum rate, i.e. usuay cose to the ink rate, to the voting request node simutaneousy. In this case, the neighbor nodes naturay contend to access the voting request node, and this contention is usuay resoved fairy by the Ethernet switch [3]. To derive a mathematica formua for (), we mode the medium access attempt, to the voting request node, of each neighbor node as an independent Bernoui experiment. Let p denote the probabiity that a tagged node succeeds in transmitting the head-of-ine voting repy packet earier than the other M nodes. Each node then has the same medium access probabiity p. Because i M p =, p = /M. By a simiar reasoning, the foowing can 7 aso be obtained: Pr(Z = i) = /M, i =, 2,..., M. (2) Then, P vv (, ζ) can be expressed as (3). The detaied derivation of this equation is given in Appendix A. Athough (3) is accurate under the assumption of the i.i.d. medium access probabiity of each neighbor node, the computationa compexity is very high due to the arge number of combinations for the innermost summations, i.e. the number of the soutions for the indeterminate integer equations, in both the numerator and the denominator. For exampe, the number of the nonnegative integer soutions for the foowing indeterminate equations is ( ) M+m 2 m : x + x x M = m, x i (i =, 2,..., M ). Athough the number of soutions for the indeterminate equation in (3) is ess than for this case due to the upper bound for each eement, the number of possibe combinations is sti high at a simiar eve. We find that it takes more than an hour to evauate P vv (, ζ) for ζ =.7, M and 5 on.3 GHz dua-core CPU machines. Therefore, we investigate a new ow-compexity approximation for P vv (, ζ) that can be used practicay for arge vaues of M and. Let D i (t) denote the number of a voting repy packet transmissions from a the GMR- ARP nodes unti the tagged node i transmits the t-th repy packet successfuy. As D i (t) increases, the tagged node i wi spend more time sending the t-th repy message successfuy. Thus, D i (t) can aso be considered to measure the deay to deiver a given number of the repy packets successfuy. P vv (, ζ) can be expressed in terms of D i (t) as P vv (, ζ) = Pr(K ζ K z = ) = Pr(D ( ζ ) min i M D i()). (4) If we assume that D i (t) and D j (s) are mutuay independent for i j, then the foowing approximation resut

8 P vv (, ζ) = M + M M i= ζ (M 2) ( )++i m=+i (M ) ( )+ m= ( M ( M ) m ( m )( ) m i x x M = m i, x u ) m ( ) m x x M = m, x u ( u M ) 2 j M j M ( m i x j ( m x j 2 k< j x k k< j x k ) ) (3) can be obtained: vaid vote probabiity (zeta =.7) P vv (, ζ) = M + [ i ( ) ( ) ( j ) M j M M i= j= i ( ) ( ) ( j ) M j ] M M i k= ζ j= ( ) ( ) ζ ( k ) k ζ ζ M M i k ( )( j ζ M j= ζ ) ζ ( M ) j ( ζ ). (5) Probabiity M = 5 (accurate anaysis) M = 5 (approximation) M = (approximation) M = 2 (approximation) M = 3 (approximation) Figure 3: P vv (, ζ) = Pr(K ζ K z = ) for various vaues of and M (ζ =.7) The detaied derivation of the above equation is given in Appendix B. Fig. 3 shows the change of the probabiity P vv (, ζ), i.e. the probabiity that a neighbor GMR-ARP node can contribute to the voting by sending a sufficient number (ζ) of the voting repy packets, for a range of vaues of M and when ζ is fixed to.7. We can easiy know that the fairness improves as this probabiity increases. The fairness cannot be guaranteed when is very sma regardess of the vaue of M, i.e. the number of neighbor GMR-ARP nodes. On the other hand, the probabiity approaches.9 as increases to. Thus, a reasonabe eve of fairness might be achieved when the vaue of is set to. Athough the approximation resut by (5) does not agree with the accurate anaysis resut by (3), the error was found to be ess than % in a the cases, and ess than 5% when 5. Therefore, the approximation equation might be used to find the tendency of the probabiity for arge vaues of and M. The non-monotonic trend of the probabiity P vv (, ζ) comes from the discontinuity of ζ. A arge vaue of can ead to high voting traffic overheads during the voting period. Thus, it is better if the vaue of can be reduced further. Fig. 4 shows the 8 change of the probabiity P vv (, ζ) for a smaer vaue of ζ: ζ =.6 in this case. We find that the vaid voting probabiity approaches.9 even when is around 5. If the vaue of ζ is owered further, the vaue of might be reduced. However, if ζ is ower than.5, the scheme might be more vunerabe to the node dupication attack. Therefore, we use.6 for the vaue of ζ hereafter, and the vaue of is fixed to 5. The reason why we attempt to maintain the probabiity P vv (, ζ) = Pr(K ζ K z = ) at east around.9 can be expained as foows. Let us assume that there are N g good (GMR-ARP) nodes and N b maicious nodes around a new GMR-ARP node. Let N and N 2 denote the number of the good nodes and bad nodes that contribute to the voting successfuy by sending a sufficient number of voting repy packets. Let us assume the probabiity that a neighbor node contributes to the voting successfuy is p, and the success of one node is independent of the success of the other nodes. Then, p is identica to P vv (, ζ) discussed above, and N and N 2 become independent. Under this condition, we cacuate the probabiity that a voting request node makes an incorrect decision, P f d. We can easiy know that N and

9 vaid vote probabiity (zeta =.6) Probabiity M = 5 (accurate anaysis) M = 5 (approximation) M = (approximation) M = 2 (approximation) M = 3 (approximation) Fase decision probabiity # of nodes = 2 (Good:, Bad: ) # of nodes = 4 (Good: 2, Bad: 2) Figure 4: P vv (, ζ) = Pr(K ζ K z = ) for various vaues of and M (ζ =.6) Probabiity N 2 have the foowing binomia distribution: ( ) Ng Pr(N = n) = p n ( p) Ng n, n ( ) Nb Pr(N 2 = s) = p s ( p) Nb s. s (6) The fase decision probabiity P f d can then be expressed as P f d = Pr(N < N 2 ) = N b i= ( Ng i ) p i ( p) N g i N b j=i+ ( Nb j ) p j ( p) N b j. (7) Fig. 5 shows the fase decision probabiity P f d when N g is arger than N b by ony. According to Fig. 5, the fase decision probabiity can be maintained at ess than.5 ony when p.98. However, such a arge vaue of p is not required if N g is sufficienty arger than N b, as shown in Fig. 6. Fig. 6 shows the fase decision probabiity as N b increases for a given vaue of N g when p is fixed to.9. We can observe that the fase decision probabiity can be maintained very ow if N b is not cose to N g, even though p is.9. Therefore, athough the vaue of is decided such that p or P vv (, ζ) is cose to.9, it is expected that the fase decision probabiity can be maintained ow provided the number of good GMR-ARP nodes is sufficienty arger than the number of maicious nodes. 4. Eary Packet Dropping to Improve the Fairness of Voting Athough the packet transmission rate is uniform among the different wired nodes beonging to the same probabiity that a node successfuy participates in a voting (p) Figure 5: Fase decision probabiity (P f d ) when the number of good nodes (N g ) is arger than the number of maicious nodes (N b ) by Probabiity Fase decision probabiity (p =.9) fase decision prob. (# of good nodes = 2) # of adversary nodes Figure 6: Fase decision probabiity (P f d ) as the number of maicious nodes (N b ) increases when the number of good nodes (N g ) is fixed to 2

10 N ai Number of the neighbor nodes participating in voting over time (2 eary responding nodes, and 2 ate responding nodes) average the other attacker. To resove this unfairness probem by the difference in the arriva times of the repy packets of the different nodes, we discard too eary repy packet arrivas in the foowing way. The foowing three parameters are cacuated from N ai : i (# of repies from the eariest repying node) Figure 7: Change of N ai over the various vaues of i, i.e. the number of the voting repy messages from the eariest repying node subnet, the voting repy messages of the different nodes cannot arrive at the voting request node simutaneousy when the voting request packet has been sent. As a worst case, if the voting repy packets of a singe maicious node arrive much earier than the repy packets of good neighbor nodes, then a singe attacker might win the voting even in the presence of mutipe GMR-ARP nodes. We attempt to recover the impaired fairness in such a case by dropping the too eary repy messages. To derive the condition to determine the too eary packet arriva, we consider an exampe case where 3 GMR-ARP nodes and 2 attacker nodes are connected through the Ethernet. We performed an experiment where one GMR-ARP node sends a voting request message, and each of the other 4 nodes responds by transmitting 5 voting repy messages. a i (i =, 2,..., 5) denotes the time when the i-th repy message of the eariest repying node arrives at the voting request node. The eariest repying node means the node that deivers the 5 repy messages to the voting request node the eariest. N t denotes the number of the neighbor nodes that have sent at east one voting repy message up to time t. Fig. 7 shows the change of N ai obtained from the experiment. In this experiment, the eariest repying node is one of the attacker nodes, and two attacker nodes respond much earier than two GMR-ARP nodes. In more detai, the repies from the GMR-ARP nodes arrived ony after the arriva of the 26-th repy packet of the eariest attacker node, and the numbers of the repy messages from the two GMR-ARP nodes were measured to be ess than 3. Because we fixed the vaues of and ζ to 5 and.6, respectivey, those two GMR-ARP nodes cannot contribute any vaid vote to the voting, and the eary repying attacker can win the voting even without N v = N ai, i= I th = max { j N a j N v, j }, I th = min { I th, ( ζ)}. (8) N v is simpy the average of N ai. We can easiy know that N ai is a non-decreasing function with respect to i, and Ith finds the crossing point between the graph, y = g(i) = N ai, and the constant ine y = N v. The arrivas ahead of that cross-point are considered as too eary arrivas, and those arrivas are discarded. To avoid the case where most of the packet arrivas of the eariest repying node are discarded, a ower bound I th is cacuated by the third reation of (8), and the arriva time of the (I th + )-th packet of the eariest repying node is set to the threshod to discriminate the too eary arrivas. In more detai, we ony consider the voting repy packets which arrived in the interva of [a Ith +, a ] as vaid arrivas. Then, the number of the vaid voting packet arrivas from the eariest repying node is guaranteed to be at east ζ, i.e. 3 when ζ =.6 and = 5. In this case, the rue to count vaid votes needs to be modified sighty as foows. The maximum of the vaid repies from each node ( ) is cacuated again after the too eary arrivas are discarded. If the number of repies from a specific node is equa to or arger than ζ, then that node contributes one vaid vote. In the above sampe experiment, the numbers of the vaid voting repies from the GMR-ARP nodes were 25 and 24, and the numbers of the vaid voting repies from the attacker nodes were 49 and 5. When the above fitering scheme was appied to this experiment resut, the numbers of the vaid repies for the GMR-ARP nodes did not change because those repies arrived rather ate. On the other hand, the numbers of the vaid repies for the attackers decreased to 29 and 3, respectivey. Therefore, the above fitering, i.e. rejecting the too eary arrivas, heps to improve the fairness in this exampe case. 4.. Anaysis of the impact of the fitering scheme on the voting fairness In this subsection, we anayze the impact of the fitering scheme on the voting fairness in more detai. When

11 a voting request packet is transmitted, if a the other GMR-ARP nodes start to respond simutaneousy, the fitering scheme expained above need not be appied since the fairness is good aready. Thus, we consider the case where the response of the different neighbor nodes is not synchronized in this subsection. In more detai, the considered environment is described by the foowing assumptions. The number of the neighbor GMR-ARP nodes excuding the voting request node is N, and a the GMR-ARP nodes are connected through the same Ethernet switch. The Ethernet switch serves the packets from each GMR-ARP node in a fair manner, e.g. using round-robin agorithm. When ti ( i ) denotes the transmission time of the i-th repy message of the eariest repying node, the response start times, i.e. the transmission times of the first repy messages, of the other neighbor nodes are uniformed distributed in [t, t ]. N e is a random variabe denoting the number of neighbor nodes contributing a vaid vote to the voting. We attempt to measure the improvement in the voting fairness based on E[N e ], since E[N e ] increases as the fairness in voting improves. If one neighbor node transmits the first repy message at t (t t t ), the number of repies that can arrive in time from this node becomes (t t)/(t t ) ( ), or (t t)/(t t ) ( ) + under the above assumptions. The eariest repying node can send repy messages, but the other nodes cannot send more than messages by the definition of the eariest repying node. To simpify the anaysis, we approximate the number of vaid repies for this node as ˆK(t) = t t t t ( ). (9) We assume that Node is the eariest repying node among N neighbor GMR-ARP nodes without oss of generaity. When the packet fitering scheme is not used, E[N e ] can be expressed as E[N e ] = + N Pr(K i ζ), () i=2 where K i is the number of voting repy packets received from Node i ( i N). Under the uniform distribution assumption for the response start time of the neighbor nodes, Pr(K i ζ)(i 2) can be expressed as foows using the approximation of (9): Pr(K i ζ) = t t t Pr(K i ζ t = τ) t t dτ Pr( ˆK(t) ζ t = τ) t t t dτ ( ) = ζ. Combining () and () yieds ( ( ) ) E[N e ] = ζ N + ( () ) ζ. (2) Hereafter, we investigate N v, Ith, I th of (8) in more detai. E[N v ] can be expressed as E[N v ] = E N ai = E[N ai ]. (3) i= Since we assume that every node transmits the repy packets at the ink rate, we have i= t i = t + (t t ) i. (4) Since N ai is equivaent to the number of neighbor nodes that started the response before the transmission of the i-th repy packet from the eariest repying node, the distribution of N ai can be obtained as ( ) ( n t Pr(N ai = j) = i t ) j ( t ti ) n j = j t t ( ) ( n i j t t ) j ( i ) n j, (5) where the second equaity is vaid by (4). Since E[N ai ] = N j= j Pr(N a i = j), E[N ai ] can be expressed as foows using the above reation: E[N ai ] = + (N ) i. (6) Combining (3) and (6) yieds E[N v ] = N +. (7) 2 To simpify the anaysis, we approximate N v by (N + )/2. E[Ith ] can be expressed as E[I th ] = Pr(Ith i). (8) i=

12 Since N a j is a non-decreasing function with respect to j, we can obtain from the definition of I th Pr(I th < i) = Pr(max{ j N a j N v, j } < i) = Pr(N ai > N v ). Because of the approximation of N v (N + )/2, the above reation can be changed into 5. Numerica Resuts In this section, we investigate the performance of the proposed address resoution protoco, i.e. GMR-ARP, and compare it with the performance of other votingbased schemes, i.e. MR-ARP and EMR-ARP, in terms of the voting traffic overhead, reiabiity in the presence of the attackers, and voting procedure deay. Pr(I th < i) Pr(N a i > (N + )/2). (9) Combining (5), (8), and (9) yieds E[I th ] = i= (N )/2<k N ( N k ) ( ) k ( i i ) (N ) k. It is possibe to simpify the above reation further and get the foowing resuts: , for even N, ( i= N ) ( ( i (N )/2 i (N )/2, )) for odd N. E[Ith ]= (2) Thus, we find that E[Ith ].5. Since ζ is fixed to.6, ( ζ) =.4, and it is ikey that I th = ( ζ) by (8). Then, the number of the vaid repy messages from the eariest repying node wi be ζ, i.e. 3, by the reason given beow (8). Since too eary packets are dropped when the fitering scheme is used,, i.e. the maximum of vaid repies from each node, wi be ζ. If the number of the vaid repies from a given GMR-ARP node is equa to or arger than ζ (= ζ ζ = ζ 2 ), then that node contributes one vaid vote. If the number of the repies from a specific node is ess than, no packet dropping is expected for that node, because the response start time of that node is highy ikey to be ater than a ( ζ)+, i.e. the threshod for the eary packet fitering. If we et Ne f denote the number of the neighbor nodes contributing a vaid vote to the voting when the fitering scheme is used, E[Ne f ] can be described as E[N f e ] = + N Pr(K i ζ 2 ). i=2 The foowing reation can be easiy derived in the same way as (2) has been derived for the non-fitering case: ( ( ) ) ( ) E[Ne f ] = ζ 2 N + ζ 2. When N =, E[N e ] = 4.5 and E[N f e ] = 6.7. Thus, the number of the contributing neighbor nodes increases by about 49% due to the improvement in the fairness of voting by the eary packet fitering Anaysis of Traffic Overhead The traffic overhead of GMR-ARP is cacuated and compared with the traffic overhead of MR-ARP and EMR-ARP. Because the traffic overhead of the votingbased scheme is due to the exchange of extra packets during the initiaization procedure and the exchange of the voting request and repy packets during the voting procedure, we focus on those components to anayze the additiona traffic overhead. We consider a simpe case with severa assumptions to simpify the anaysis. The IP addresses are assumed to be aocated through DHCP for a nodes in the same subnet. We assume that there are M GMR- ARP nodes, and A i (i =, 2,..., M) denotes the i-th GMR-ARP node. Initiay, A i has the IP address of IP i (i =, 2,..., M) assigned through DHCP, and we assume that each node changes its IP address in the foowing manner. Whenever a node is rebooted, a new IP address is assigned to the rebooted machine, and that IP address is seected from a poo of IP addresses, {IP, IP 2,..., IP M+ }. We aso assume that the rebooting time of one machine never overap with that of the other machines, and the rebooting time is negigiby sma compared to the ifetime of each machine. We assume that each machine is rebooted at the same interva of T D, but asynchronousy. In addition, it is assumed that there is no attacker in the subnet to focus on the traffic overhead under norma conditions. Let us consider the case where Node A M changes its IP address from IP M to IP M after A M changes its IP address from IP M to IP M+ to cacuate the voting procedure-reated traffic rate to Node A M. The initiaization stage of GMR-ARP consists of two steps: the first step is reated to the gratuitous ARP request message, and the second step is reated to the specia voting request message. We first count the number of packets that Node A M receives regarding the first step. A M receives (M ) gratuitous ARP request messages from the other (M ) GMR-ARP nodes, i.e. one gratuitous ARP request message from each rebooted GMR-ARP node. A M wi send unicast ARP request messages to the previous owner node whenever an existing IP is assigned to a newy rebooted node, but, there wi be no

13 repy if the owner of the IP address is changed egitimatey by the DHCP. On the other hand, when the IP address that has been used by A M, i.e. IP M, is assigned to some other node, e.g. A M 2, then each neighbor GMR-ARP node wi send unicast ARP request messages to A M as A M was the previous owner of IP M. Because there are (M ) neighbor GMR-ARP nodes, the aggregate number of unicast ARP requests destined to A M is (M ). Therefore, the number of packets that Node A M receives regarding the first step is (M ) ARP request messages. Regarding the second step of the initiaization stage, A M receives (M ) voting repy messages for the specia voting message sent by the node itsef. A M aso receives (M ) specia voting request messages, i.e. one specia voting request from each rebooted machine, and (M 2)(M ) voting repy messages, i.e. (M 2) voting repy messages for each specia voting request message. Because the voting request and repy messages have the same format as the ARP request message in GMR-ARP, the mean overhead traffic rate to Node A M can be expressed as r GMR-ARP A {(M ) + M(M )} 28 8(bits) = T D (sec).224(m + )(M ) = Kbps. T D (2) Athough GMR-ARP attempts to maintain the (IP, MAC) mapping ony for the GMR-ARP nodes, MR- ARP and EMR-ARP maintain the (IP, MAC) address mapping for a aive machines. If L denotes the tota number of aive machines in the subnet considered, then L M, and the voting-reated traffic overhead ra MR ARP and ra EMR ARP for MR-ARP and EMR-ARP, respectivey, are known as [5]: r EMR-ARP A = ra MR-ARP.4(L )(M ) = Kbps. (22) T D {.5L +.48(M 2)} (M ) Kbps, T D (23) A comparison of (2), (22) and (23) shows that the voting traffic overhead of GMR-ARP is ower than the traffic overhead of MR-ARP or EMR-ARP when M 3. The gap between the overhead of GMR-ARP and that of MR-ARP or EMR-ARP decreases as L approaches M. Thus, et us consider the case where L = M. In this case, if we compare the overhead of those three schemes 3 as M increases, then we can obtain im M im M ra MR-ARP =.4 ra GMR-ARP.224 = 5.9, ra EMR-ARP =.63 ra GMR-ARP.224 = 7.3. Therefore, the voting traffic overhead is reduced in GMR-ARP compared to the other voting-based schemes Anaysis of Reiabiity of the Proposed Scheme In this section, we evauate the reiabiity of the three voting-based schemes, i.e. the proposed GMR-ARP, EMR-ARP and MR-ARP, through the metric of the fase decision probabiity. In the voting-based ARP scheme, the voting procedure is triggered when a confict occurs on the (IP, MAC) address mapping by the fake voting repy of an attacker. In this case, if the voting request node seects an incorrect MAC address for a given IP address, the voting request node is considered to have made a fase decision. GMR-ARP, EMR-ARP and MR-ARP were impemented by modifying the ARP-reated code of Fedora 9 Linux (kerne ). EMR-ARP can work reiaby ony under the assumption that the computation power of different machines is not significanty different, i.e. no more than by a factor of 2 [5]. To test the performance of GMR-ARP when this assumption is not vaid, we use the machines with a higher CPU performance, i.e GHz quad-core PCs, for the attacker nodes, and the machines with a ower CPU performance,.4 GHz Inte Ceeron CPU netbooks, for the good neighbor nodes. The quad-core machines were used for the gateway router and the voting request node. The gateway router is aways connected to the Ethernet through a Mbps LAN card and LAN switch. Other machines can be connected to the same subnet through either a Mbps LAN card, or a USB-type wireess LAN card supporting 82.n. To investigate if the proposed scheme, i.e. GMR- ARP, overcomes the imitation of the existing votingbased ARP schemes, i.e. EMR-ARP and MR-ARP, we consider the four scenarios described in Tabe. In the tabe, the number of good nodes impies the number of good neighbor GMR-ARP, EMR-ARP, or MR-ARP nodes that can understand and react to the voting request If the voting request node cannot make a decision due to the same number of votes supporting either the correct MAC address or the fake MAC address, then this case is not considered as a fase decision.