Secure spanning tree protocol using network partitioning

Ethernet networks rely on the spanning tree protocol (STP or IEEE 802.1D) to break loops. Recent research, however, shows that networks using STP are subjected to various kinds of attacks. This paper presents a modified STP to solve the security problems of conventional spanning tree protocol. A network using the modified STP is partitioned into many tiers. This prevents attadcs launched at a lower tier from affecting the high tiers of network. Implementations on the modified protocol are made on Linux-based computers and broadband routers. When tested on an experimental network, the implementations demonstrate the feasibility and compatibility of the modified protocol. The security performance of the modified protocol is studied and compared with that of the conventional STP under all known STP attacks. The results show significant reduction in number of affected switches under the Non-DoS STP attack when the modified STP is used. For DoS STP attacks, the CPU utilization of switches in handling STP topology changes can be reduced by many orders of magnitude when the modified STP is used.