Cryptographically Generated Address Authentication for IP Spoofing Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Unicast Reverse Path Forwarding (URPF) solutions are inadequate in blocking Distributed Denial of Service (DDoS) attacks that use fake IP addresses, as attackers can spoof internal subnet addresses to bypass protection policies.
Innovation Solution
Implementing a method that uses Cryptographically Generated Address (CGA) parameters and CGA signatures to authenticate communication parties, adding a CGA extension header to IPv6 packets to verify the authenticity of IP addresses and prevent spoofing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If URPF is used to block fake source IP addresses at the network border, then network security is improved, but attackers can spoof internal subnet addresses to bypass the protection
Solution Approach 1:
The patent applies preliminary action by pre-generating cryptographic signatures for IP addresses using CGA parameters before actual communication occurs. The binding between IP address and cryptographic key is established in advance, allowing routers to verify authenticity without complex real-time checks. This pre-established cryptographic binding prevents attackers from spoofing addresses even within internal subnets, as they cannot generate valid signatures without the private keys.
Solution Approach 2:
The patent introduces cryptographic parameters and signatures as an intermediary mechanism between the router and IP addresses. Instead of directly trusting or blocking based on IP address patterns, the system uses cryptographic verification as a mediator to authenticate the legitimacy of each packet's source address. This intermediary layer of cryptographic proof fundamentally changes how address validation works, making spoofing impossible without the corresponding private key.
2Adaptability or versatility
If IP address spoofing is allowed for network flexibility, then network adaptability is improved, but the Internet becomes vulnerable to various attacks
Solution Approach 1:
The patent fundamentally changes the parameters of IP address validation by transitioning from simple routing table lookups to cryptographic verification. Instead of checking whether an IP address exists in routing tables, the system verifies cryptographic signatures attached to packets. This parameter change maintains network flexibility for legitimate traffic while automatically blocking spoofed packets, as the cryptographic verification fails for any fake addresses regardless of how they are constructed.
3Reliability
If source address authentication is implemented to prevent spoofing, then network security is improved, but the complexity of the communication protocol increases
Solution Approach 1:
The patent reduces protocol complexity through preliminary action by pre-computing and attaching cryptographic signatures to packets at the source before transmission. The verification process at the router becomes a relatively simple signature check against pre-established cryptographic parameters, rather than implementing complex real-time authentication protocols. This shifts the computational burden to the packet generation stage, simplifying the forwarding and verification processes in the network core.
Data Source
AI summary
A method, a system, and an apparatus for establishing communication are disclosed. The method is invented to establish communication between at least two communication parties including a first communication party and a second communication party. The method includes: sending a Cryptographically Generated Address (CGA) request to the first communication party; receiving CGA parameters and a CGA signature returned by the first communication party; and authenticating the CGA parameters and the CGA signature, and establishing communication with the first communication party if the authentication succeeds. By using the method disclosed herein, in the process of establishing communication, the communication party authenticates the CGA parameters and CGA signature carried in the CGA extension header to determine authenticity of the CGA, thus preventing the IP address spoofing and preventing or mitigating the network security problems caused by the IP address spoofing.