DAD Proxy Selective Forwarding for IPv6 Address Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing duplicate address detection (DAD) proxy methods in IPv6 networks face issues such as resource wastage, security risks, and prolonged detection times due to unconditional multicast packet forwarding, especially in scenarios like DSL and PON networks, where DAD function is disabled, leading to incorrect address configuration and security breaches.
Innovation Solution
A method and apparatus for DAD proxy that compares DAD-NS messages with locally stored information, initiates unreachability detection when necessary, and selectively forwards DAD-NA messages, preventing multicast packet flooding and ensuring correct DAD functionality by only sending DAD-NA messages to subscribers who need them, thus reducing resource wastage and enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the ND proxy unconditionally forwards DAD-NS multicast packets to all other ports, then the DAD function can be implemented across the network, but network resources are wasted and bandwidth is consumed
Solution Approach 1:
The patent applies local quality by making the DAD proxy forwarding behavior context-dependent rather than uniform. The proxy examines the source port of incoming DAD-NS packets and selectively forwards them only to ports that are not the source port, creating different forwarding behaviors for different local contexts (source ports). This resolves the contradiction by enabling DAD functionality where needed while avoiding unnecessary resource consumption on ports where it is not required.
2Reliability
If the DAD-NS multicast packet is forwarded to all other subscribers, then duplicate addresses can be detected, but security risks increase as subscribers obtain address information they should not access
Solution Approach 1:
The patent extracts and removes the harmful aspect of unconditional multicast forwarding by implementing selective forwarding based on source port identification. Instead of forwarding DAD-NS packets to all subscribers (which causes security risks), the system extracts only the necessary forwarding action to ports that are not the source port. This extraction principle resolves the contradiction by maintaining duplicate address detection capability while eliminating unnecessary information exposure to unauthorized subscribers.
3Reliability
If the DAD-NS multicast packet is forwarded through the ND proxy to all ports, then address detection can occur, but the detection delay is prolonged
Solution Approach 1:
The patent applies the skipping principle by enabling direct peer-to-peer DAD communication between subscribers on the same port, bypassing the need for proxy-mediated forwarding. When both source and destination are on the same port, the DAD packet is handled locally without being forwarded through the proxy to other ports and back. This skipping of unnecessary forwarding steps resolves the contradiction by maintaining detection capability while significantly reducing detection delay.
4Reliability
If the ND proxy forwards DAD packets in N:1 VLAN scenarios, then DAD function is enabled, but the network device must modify VLAN IDs which increases device complexity
Solution Approach 1:
The patent applies the intermediary principle by introducing the DAD proxy as a mediator between subscribers in N:1 VLAN scenarios. Instead of requiring network devices to perform complex VLAN ID modification, the proxy acts as an intermediate entity that receives DAD-NS packets from one subscriber and selectively forwards them to appropriate ports. This intermediary approach resolves the contradiction by enabling DAD functionality in VLAN networks while avoiding the need for complex VLAN ID modification capabilities in network devices.
Data Source
AI summary
Embodiments of the present invention disclose a method, apparatus, and system of DAD proxy. The method includes: obtaining a DAD-NS message; comparing the obtained DAD-NS message with locally stored DAD information, and adding the DAD-NS information to the locally stored DAD information when it is determined, according to a comparison result, that the IP address to be detected is not duplicate; when it cannot be determined whether the IP address to be detected is duplicate or not, initiating, according to the address information included in the locally stored DAD information after comparison, an unreachability detection to the IP address to be detected to determine whether the IP address to be detected is duplicate. The apparatus includes: an obtaining module, a storing module, and a processing module. The system includes: an apparatus of DAD proxy and an access device.