Control Plane Firewall Segmentation for Network Device Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional network devices, such as routers, are vulnerable to denial-of-service attacks due to the lack of effective protection for control plane traffic, which can overwhelm the device and impact bandwidth when traditional firewalls are used, affecting both control and data plane traffic.
Innovation Solution
Implementing a method to selectively apply firewall analysis only to control plane traffic within network devices, using a firewall component to process control plane packets without impeding data plane traffic, thereby providing stateful firewall services that detect and mitigate network attacks without degrading data plane traffic performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a firewall is placed between the router and external network to protect control plane traffic, then security against DoS attacks is improved, but bandwidth available for data plane traffic deteriorates
Solution Approach 1:
The patent segments the firewall functionality into two distinct planes: control plane firewall (CPFW) and data plane firewall (DPFW). The CPFW specifically protects control plane traffic by filtering BGP and other routing protocol packets, while the DPFW handles data plane traffic with high-speed forwarding. This segmentation allows security protection to be applied selectively without impacting overall bandwidth capacity for data traffic.
Solution Approach 2:
The patent introduces an intermediary mechanism where control plane traffic is extracted and routed through a dedicated CPFW processing path before reaching the control plane. This intermediary filtering layer prevents malicious control plane packets from overwhelming the router while allowing legitimate routing updates to pass through, thus protecting security without blocking data plane bandwidth.
2Reliability
If traditional firewall analysis is applied to all traffic, then security is improved, but processing overhead increases and impacts data plane performance
Solution Approach 1:
The patent applies local quality by implementing stateful firewall analysis only where needed - specifically for control plane traffic. The CPFW maintains connection state information and performs deep packet inspection on routing protocol packets, while data plane traffic receives simpler forwarding treatment. This localized application of complex security processing eliminates unnecessary overhead on high-volume data traffic while maintaining robust security for control functions.
Data Source
AI summary
A network device receives control plane packets and data plane packets from a network. The network device includes a forwarding component that forwards the data plane packets in accordance with routing information maintained by a routing component. The forwarding component directs the control plane packets to a firewall component that processes the control plane packets to apply firewall services and detect network attacks. After processing, the firewall component loops the control plane packets back to the forwarding components for forwarding to the routing component. The firewall component may be a security service card.