Conversation Identifier Packet Filtering for Network Security

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing network technologies lack the ability for routing devices to independently detect and filter undesirable packets without maintaining state flow information, making it difficult to effectively thwart denial of service attacks.

Innovation Solution

Implementing a deterministic function and secret value to generate a conversation identifier, which is included in packets by the server and verified by intermediate routing devices, allowing them to determine whether packets are part of a legitimate conversation, enabling independent detection and filtering of undesirable packets.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If routing devices maintain state flow information to detect undesirable packets, then detection accuracy is improved, but device complexity and memory requirements increase

Engineering Contradiction:

Improvedetection accuracyVSAvoiddevice complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The patent segments the detection function into two parts: the server generates conversation identifiers and maintains state, while routing devices only verify these identifiers without maintaining flow state. This segmentation allows routing devices to achieve accurate detection without the complexity of maintaining state flow information.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The conversation identifier acts as an intermediary that carries verification information from the server to the routing device. Instead of routing devices directly maintaining flow state, they use this intermediary token to verify packet legitimacy, significantly reducing their complexity while maintaining detection accuracy.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If distributed approaches are used to regulate network traffic, then detection capability is improved, but coordination overhead and system complexity increase

Engineering Contradiction:

Improvedetection capabilityVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent extracts the state maintenance function from the distributed routing devices and concentrates it in the server. Routing devices take only the verification function, which does not require coordination or state maintenance. This extraction reduces system complexity while preserving distributed detection capability.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

Each routing device independently verifies conversation identifiers using the deterministic function and secret value provided by the server. No coordination between routing devices is needed, as each device serves itself with the verification credentials it receives from the server, reducing coordination overhead.

Inventive Principle:

Principle #25Self-service

3Reliability

If progressive regulation approaches are implemented, then traffic control effectiveness is improved, but implementation complexity and processing overhead increase

Engineering Contradiction:

Improvetraffic control effectivenessVSAvoidimplementation complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The server performs preliminary action by generating conversation identifiers and providing verification credentials to routing devices before traffic regulation is needed. This preliminary setup eliminates the need for complex progressive regulation logic in routing devices, as they simply verify pre-generated identifiers.

Inventive Principle:

Principle #10Preliminary action

4Speed

If routing devices independently verify packets without state information, then processing speed is improved, but detection accuracy deteriorates

Engineering Contradiction:

Improveprocessing speedVSAvoiddetection accuracy

Core Design Contradiction:

SpeedVSMeasurement precision

Solution Approach 1:

The conversation identifier serves as an intermediary that encapsulates verification information, allowing routing devices to achieve both fast processing (by simply verifying the identifier) and accurate detection (by using the deterministic function with secret value to validate authenticity).

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent replaces the mechanical system of maintaining flow state in routing devices with a cryptographic verification system. The deterministic function and secret value provide a lightweight mechanism that achieves both speed and accuracy without complex state management.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS8271678B2Independent detection and filtering of undesirable packets

Publication Date: 2012.09.18 ARBOR NETWORKS INC

AI summary

A server, using a deterministic function, a secret value and persistent information of a packet, destined for a client device, generates and includes a conversation identifier for inclusion with the packet. The client device in turn includes the conversation identifier in a subsequent packet sent by the client device destined for the server. An intermediate routing device having knowledge of the deterministic function and the secret value, upon receiving the packet en-route from the client device to the server, would independently determine whether the packet is a part of a conversation between the client and the server, by independently verifying the included conversation identifier, and forward or not forward the packet accordingly. As result, undesirable packets may be independently detected and filtered for the server.