BFD Data Plane Security Authentication via Control Plane Token Distribution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Bidirectional Forwarding Detection (BFD) protocols lack security authentication mechanisms in the data plane, leaving network devices vulnerable to cyberattacks, as they only provide authentication methods in the control plane.
Innovation Solution
A security authentication method is introduced where a BFD device's control plane generates a token value based on a random nonce and sends it to the data plane, which then authenticates incoming packets by comparing the token values, ensuring that only authorized packets are processed, using the same calculation method as the control plane.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security authentication is implemented only in the control plane, then the control plane can authenticate BFD packets, but the data plane remains vulnerable to cyberattacks
Solution Approach 1:
The patent divides the authentication mechanism into two independent parts: control plane authentication (using existing MD5/SHA1 methods) and data plane authentication (using token values). The control plane generates and distributes token values to the data plane, which then independently authenticates BFD packets using these tokens. This segmentation allows security authentication to be implemented in both planes without requiring complete redesign of either plane's authentication system.
Solution Approach 2:
The patent introduces token values as an intermediary element between the control plane and data plane. The control plane generates token values based on random nonces and distributes them to the data plane, which then uses these tokens to authenticate incoming BFD packets. This intermediary mechanism enables the data plane to perform authentication without directly implementing complex cryptographic algorithms, thus reducing data plane complexity while expanding security coverage.
2Reliability
If the data plane implements security authentication using the same calculation method as the control plane, then authentication consistency is achieved, but computational overhead increases
Solution Approach 1:
The control plane performs the computationally intensive task of generating token values in advance, using random nonces and cryptographic algorithms. These pre-generated token values are then distributed to the data plane for storage and subsequent authentication use. This preliminary action shifts the computational burden from the data plane to the control plane, allowing the data plane to perform simple token comparison operations while maintaining authentication consistency.
Solution Approach 2:
The data plane uses copied token values (generated by the control plane) instead of independently generating its own cryptographic authentication data. The control plane creates the authoritative token values based on random nonces, and the data plane copies and stores these tokens for authentication. This copying approach ensures authentication consistency between planes while significantly reducing the computational overhead in the data plane.
Data Source
AI summary
A security authentication method includes: receiving, by a control plane of a BFD device, a first BFD packet that is sent by a control plane of a peer BFD device; generating, by the control plane, a first token value according to the random nonce; sending the first token value to a data plane; receiving, by the data plane, a second BFD packet that is sent by a data plane of the peer BFD device, where the second BFD packet carries authentication information, and the authentication information includes a random nonce; and generating, by the data plane, a second token value according to the random nonce included in the authentication information and by using a calculation method the same as that of the control plane, and successfully authenticating, by the data plane, the second BFD packet if the first token value and the second token value are the same.