BIER Packet Trap Information Validation for DoS Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The Bit Index Explicit Replication (BIER) technology lacks effective security mechanisms, leading to potential denial of service (DoS) and bandwidth waste due to invalid packets being replicated and sent to unintended devices, as existing solutions fail to accurately detect malicious tampering or encapsulation errors in BIER packets.
Innovation Solution
A packet detection method that includes a first network device obtaining a BIER packet with trap information to determine its validity, identifying invalid packets and enhancing security by detecting malicious tampering or encapsulation errors, thereby preventing DoS and improving bandwidth efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If BIER packet forwarding is implemented without security mechanisms, then network bandwidth is saved and network load is reduced, but invalid packets can be replicated and sent to unintended devices causing bandwidth waste and DoS attacks
Solution Approach 1:
The patent applies preliminary action by verifying the trap information field in BIER packets before forwarding them. The network device checks whether the trap information is valid (equals to 0) prior to packet replication and forwarding, preventing invalid packets from being propagated throughout the network. This pre-verification mechanism blocks potential DoS attacks and bandwidth waste before they can affect the network, while still allowing efficient BIER packet forwarding for valid packets.
2Reliability
If trap information verification is added to BIER packet forwarding, then security against malicious tampering is enhanced, but device complexity increases
Solution Approach 1:
The patent extracts the security verification function as a separate, simple check on the trap information field within the BIER packet header. Rather than implementing complex security protocols, the solution isolates the verification to a specific field comparison (checking if trap information equals 0), which can be performed with minimal additional processing logic and does not require complex authentication or encryption mechanisms.
Solution Approach 2:
The patent applies local quality by focusing security verification on a specific field (the trap information field) within the BIER packet rather than requiring comprehensive verification of the entire packet. This localized approach checks only the relevant security indicator bit, minimizing the impact on overall device complexity while providing effective security against tampering.
3Measurement precision
If multiple trap bits are set in the BIER packet, then detection accuracy of malicious tampering is improved, but packet structure complexity increases
Solution Approach 1:
The patent segments the trap information into multiple independent bits within the BIER packet header, allowing individual bits to represent different trap conditions or verification aspects. This segmentation enables more granular and accurate detection of malicious tampering, as each bit can be independently verified and interpreted, while maintaining a structured and organized packet format that manages complexity through clear bit-field definitions.
Data Source
Figure 1~3
Figure 4
Figure 5
AI summary
This application provides a packet detection method. The method includes: obtaining, by a first network device, a bit index explicit replication BIER packet, where the BIER packet includes trap information, and the trap information is used to indicate whether the BIER packet is a valid BIER packet; determining, by the first network device, whether the trap information is valid; and determining, by the first network device, that the BIER packet is an invalid BIER packet when the first network device determines that the trap information is valid. According to the technical solutions provided in this application, the invalid BIER packet can be detected, to improve security in a BIER packet forwarding process or accuracy of BIER packet encapsulation.