Fragmented Datagram Reassembly for Class-Based Attack Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
IP datagrams are vulnerable to fragmentation attacks such as tiny fragment attacks and overlapping fragment attacks, which can compromise network security and performance.
Innovation Solution
A security gateway reassembles IP datagrams based on class of service, filters out malicious fragments, and checks for replay attacks using a replay window determined by hardware latency and reassembly latency to protect the mobile core network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If IP datagrams are fragmented into multiple packets for transmission through different networks, then network routing flexibility and delivery capability are improved, but vulnerability to fragmentation attacks (tiny fragment attacks, overlapping fragment attacks, buffer overflow attacks) increases
Solution Approach 1:
The patent applies preliminary action by performing reassembly validation and attack detection before forwarding reconstructed datagrams. The system pre-establishes security rules and validation mechanisms to identify and block malicious fragments (tiny fragments, overlapping fragments) before they can exploit the system, thus preventing attacks while maintaining fragmentation benefits
Solution Approach 2:
The patent introduces an intermediary security gateway that sits between the fragmented packet transmission and the final destination. This intermediary component validates fragments, reconstructs datagrams securely, and filters out malicious packets, thus mediating between the need for fragmentation and the risk of attacks
2Reliability
If all fragmented packets are reassembled and processed equally, then complete datagram reconstruction is achieved, but high-priority traffic experiences delays due to lower-priority fragment processing
Solution Approach 1:
The patent applies local quality by assigning different processing priorities to different fragments based on their associated datagram's class of service. High-priority fragments are processed and reassembled faster than low-priority fragments, while still ensuring complete reconstruction of all datagrams. This differential processing maintains reliability for all traffic while improving speed for high-priority traffic
3Reliability
If security validation and replay attack detection are performed on all fragments, then network security is improved, but processing time and computational resources increase
Solution Approach 1:
The patent applies partial action by performing security validation selectively rather than uniformly on all fragments. The system performs replay attack detection and validation based on class of service priorities and fragment characteristics, applying more rigorous checks to high-priority traffic while using optimized or skipped validation for lower-priority traffic, thus maintaining security while reducing overall processing time
Data Source
AI summary
Techniques for reassembling fragmented datagrams are disclosed. Packets may be received and classified. Packets of a fragmented datagram may be stored for later reassembly. In the illustrative embodiment, a datagram is reassembled based on an identified class of service associated with the datagram. Additionally or alternatively, in the illustrative embodiment, a replay window of a replay attack detector may be tuned based on hardware performance of a compute device.