BIER Packet Verification via HMAC Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is a lack of effective security mechanisms in Bit Index Explicit Replication (BIER) technologies, leading to the replication of invalid BIER packets and wastage of link bandwidth, potentially causing denial-of-service issues due to the absence of valid packet verification processes.
Innovation Solution
A packet verification method is introduced, where a first network device receives a BIER packet with a keyed-hash message authentication code (HMAC) and determines a second HMAC based on a configured key and packet header information, comparing it to the carried HMAC to verify the packet's validity, thereby enhancing security and accuracy in the forwarding process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If BIER packet forwarding is implemented without verification mechanisms, then network bandwidth is saved and forwarding efficiency is improved, but security is compromised and invalid packets are replicated causing bandwidth wastage
Solution Approach 1:
The patent applies preliminary action by calculating and attaching the HMAC value to the BIER packet header during the packet encapsulation phase at the ingress node. This verification data is prepared in advance before packet forwarding, enabling rapid validation at intermediate nodes without disrupting the efficient BIER forwarding process. The HMAC is computed over specific header fields using a pre-shared key, creating a security mechanism that operates transparently to the high-speed BIER forwarding plane.
2Reliability
If HMAC verification is added to BIER packets, then packet security and integrity are improved, but device complexity and processing overhead increase
Solution Approach 1:
The patent applies local quality by selectively applying HMAC verification only to specific fields in the BIER packet header that are critical for forwarding correctness, rather than verifying the entire packet. The verification focuses on localized header elements such as the BIER header fields that could be modified to redirect traffic. This targeted approach reduces computational complexity while maintaining security for the most vulnerable parts of the packet structure.
3Measurement precision
If comprehensive packet verification is implemented, then accuracy of packet forwarding is improved, but processing time and network latency increase
Solution Approach 1:
The patent extracts the security verification function into a separate, dedicated mechanism that operates independently from the main BIER forwarding path. The HMAC verification is performed as a distinct check that can be executed in parallel or as a quick validation step, separating the security function from the high-speed forwarding plane. This extraction allows the forwarding engine to maintain its optimized performance while a separate verification module handles security checks with minimal impact on overall packet transmission time.
Data Source
AI summary
This application provides a packet verification method, and the method includes: A first network device receives a BIER packet, where packet header information of the BIER packet includes a first keyed-hash message authentication code HMAC, and the first HMAC is used to verify whether the BIER packet is a valid BIER packet; determines a second HMAC based on a first key and first information in the packet header information, where the first information is used to indicate forwarding information of the BIER packet; determines whether the first HMAC is the same as the second HMAC; and when determining that the first HMAC is different from the second HMAC, determines that the BIER packet is an invalid BIER packet.