A Secure Token-Based Approach for DHCP Client Authentication and Replay Attack Prevention

Dynamic Host Configuration Protocol (DHCP) plays a crucial role for assigning IP address and other related parameters to clients. Due to lack of client authentication and anti reply mechanism the DHCP protocol is susceptible to DHCP starvation attack. Although most of the existing researches proposed digital certificate based DHCP client authentication that involves a trusted third party named certificate authority (CA), but securing the private key of certificate authority is very challenging and risky task. Again, traditional MAC binding technique has been used to authenticate DHCP clients which could be easily evaded by MAC spoofing attack. Moreover, SMS based one time password (OTP) is also suggested to authenticate DHCP clients which is susceptible to Man-In-the-Middle (MITM) attack as OTP is transmitted in plain text. Therefore, the objective of this research is to propose an effective DHCP framework to authenticate DHCP clients and prevent DHCP replay attack. To achieve this objective, at first, DHCP starvation and DHCP replay attack and their consequences are briefly demonstrated. Secondly, a python-based secured DHCP framework was proposed that authenticates DHCP clients and prevents DHCP replay attack by exchanging security tokens uniquely generated from clients Pre-Shared Key (PSK), MAC address, PIN and system time. Finally, the effectiveness and validation of the proposed DHCP framework is demonstrated using the Multivendor Network Emulation Software (EVE-NG).