Aggregating Router Keys for Compact Forwarding Tables
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Public IP networks lack mechanisms to prevent unwanted data packets from illicit or corrupt end-users, leading to issues like flooding, spamming, and Denial-of-Service threats, and existing security solutions increase the complexity and overhead of forwarding tables in routers.
Innovation Solution
Implementing a method and apparatus that use aggregating router keys and associated aggregation-related instructions to configure forwarding tables in routers, allowing data packets to be routed securely by attaching tags derived from destination keys and router keys, reducing the size of forwarding tables and preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional forwarding tables with individual destination addresses are used, then routing precision is maintained, but forwarding table size and complexity increase significantly
Solution Approach 1:
The patent merges multiple destination addresses that share common prefix bits into single aggregated routing entries. Instead of storing each destination address separately, the forwarding table stores aggregated entries representing groups of destinations, thereby reducing table size while maintaining routing precision through the aggregation mechanism
Solution Approach 2:
The patent segments the forwarding table into multiple levels or tiers, where higher-level entries represent aggregated routes and lower-level entries provide more specific routing information. This hierarchical segmentation allows the system to balance between table compactness and routing precision by selectively applying aggregation at different levels
2Reliability
If security functions are added to filter unwanted packets, then network security improves, but router processing complexity and overhead increase
Solution Approach 1:
The patent performs preliminary security filtering by aggregating routing information before packets arrive at individual routers. Security policies and filtering rules are pre-configured in the aggregated forwarding tables, allowing routers to make fast forwarding decisions based on pre-computed aggregation results rather than evaluating individual security rules for each packet
Solution Approach 2:
The patent introduces an intermediary aggregation mechanism that sits between the security policy layer and the packet forwarding layer. This intermediary translates security requirements into aggregated routing entries, thereby decoupling security function complexity from router processing complexity while maintaining both security and forwarding efficiency
3Measurement precision
If detailed routing information is maintained for all destinations, then routing accuracy is preserved, but memory requirements and processing overhead increase
Solution Approach 1:
The patent combines multiple destination routing entries that share common characteristics into single aggregated entries in the forwarding table. By merging entries based on common prefix bits or routing patterns, the system reduces memory requirements while preserving routing accuracy through the aggregation structure that maintains the ability to distinguish between different destination groups
Data Source
AI summary
Method and apparatus for supporting the forwarding of received data packets in a router (402,702) of a packet-switched network. A forwarding table (706a) is configured in the router based on aggregating router keys and associated aggregation related instructions received from a key manager (400,700). Each aggregating router key represents a set of destinations. When a data packet (P) is received comprising an ingress tag derived from a sender key or router key, the ingress tag is matched with entries in the forwarding table. An outgoing port is selected for the packet according to a found matching table entry that further comprises an associated aggregation related instruction. An egress tag is then created according to the aggregation related instruction, and the packet with the created egress tag attached is sent from the selected outgoing port to a next hop router.