Distributed Firewall Detecting SCTP Quantum Insert Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current firewall technologies are unable to detect quantum insert attacks on the SCTP protocol in telecom networks, as these attacks do not propagate across multiple hops and are undetectable by traditional firewall techniques.
Innovation Solution
A distributed firewall system is implemented, comprising firewall components embedded within network nodes and a central firewall unit. Each firewall component computes and logs checksums of received payloads and transmits them to the central unit, which compares checksums to detect malicious responses and instructs nodes to block harmful traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional firewall techniques are used to monitor network traffic, then general network security is maintained, but quantum insert attacks on SCTP protocol cannot be detected
Solution Approach 1:
The firewall system is segmented into protocol-specific modules, including a dedicated SCTP protocol parser and multiple protocol handlers (TCP, UDP, SCTP, Diameter, SS7). Each module specializes in detecting attacks for its specific protocol, enabling the firewall to maintain high detection capability for quantum insert attacks while supporting multiple telecom protocols simultaneously
Solution Approach 2:
The firewall appliance is designed with universal multi-functionality to handle both traditional firewall tasks and quantum insert attack detection. It implements a unified architecture that processes multiple protocols (TCP, UDP, SCTP, Diameter, SS7) and performs both standard packet filtering and specialized retransmission detection, making it adaptable to diverse security requirements across different protocol layers
2Measurement precision
If checksum computation is performed on every payload to detect attacks, then detection accuracy improves, but processing overhead increases
Solution Approach 1:
The system performs preliminary actions by computing checksums of payloads as they are received and stored in a database with associated metadata (source IP, destination IP, timestamp, sequence number). This preliminary checksum computation enables rapid comparison with subsequent retransmitted payloads, improving detection accuracy while distributing the processing load over time rather than requiring intensive real-time computation at each comparison point
Solution Approach 2:
The firewall creates copies of payload data and stores them in a database along with computed checksums. Instead of repeatedly processing original payloads, the system works with stored copies and their checksums, reducing processing complexity for detection operations while maintaining detection precision through accurate checksum comparison
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed is a distributed firewall system for a mobile network that uses hop-by-hop protocol, that includes a plurality of firewall components embedded within respective plurality of network nodes of the mobile network, and a central firewall unit communicatively coupled to each firewall component. Each firewall component is configured to compute and log checksum of each payload received by the respective node, and optionally transmit the logged checksums to the central firewall unit, and wherein the central firewall unit or each firewall component is configured to compare checksums of a payload that is received twice by respective network node, and determine whether the re-reception of the payload is a malicious response.