Dynamic Ingress Packet Filter for BGP Asymmetry
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-spoofing methods, such as reverse path forwarding and ingress filtering, are inefficient and ineffective in preventing packet spoofing, particularly in multihomed customers with BGP asymmetry, and can result in significant performance impacts and service outages due to large filter sizes exceeding router limitations.
Innovation Solution
A dynamic ingress packet filter system that generates a smaller access control list by intersecting permitted source-address prefixes from route objects with actively generating traffic data, allowing only valid source addresses, and dynamically updates filters based on recent traffic flows to prevent spoofed packets while avoiding router capacity limits.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If large filter sizes are used to prevent packet spoofing, then security against spoofing attacks is improved, but router performance deteriorates and service outages occur due to exceeding router capacity limits
Solution Approach 1:
The patent extracts only the actively generating source-address prefixes from the complete route object information by comparing route object prefixes with actually observed traffic data. This extraction process removes unnecessary prefixes that do not correspond to active traffic flows, creating a reduced filter set that maintains security effectiveness while reducing filter size to within router capacity limits.
Solution Approach 2:
Instead of filtering all possible source-address prefixes from route objects, the patent applies partial action by filtering only those prefixes that are actively generating traffic. This partial approach focuses filtering resources on the subset of prefixes that actually matter for current traffic flows, avoiding the excessive action of maintaining filters for all possible prefixes including inactive ones.
2Reliability
If comprehensive route object information is filtered to ensure all permitted source addresses are blocked, then security coverage is improved, but device complexity increases due to managing large filter configurations
Solution Approach 1:
The system extracts the essential subset of source-address prefixes by comparing route object information with actually observed traffic data. This extraction automatically identifies which prefixes are actively generating traffic and should be filtered, eliminating the need to manually configure and manage comprehensive filter lists for all possible prefixes in the route objects.
Solution Approach 2:
The filter generation process is automated through self-service mechanisms where the system automatically collects route object information, observes actual traffic data, determines the intersection of permitted and active prefixes, and generates the appropriate filter configurations without manual intervention. This self-service approach reduces the complexity of filter configuration management.
3Reliability
If static filters based on route objects are used, then security policy compliance is improved, but adaptability to changing traffic patterns deteriorates
Solution Approach 1:
The patent transforms the static filter approach into a dynamic one by continuously observing traffic data and automatically updating filter configurations. The system monitors actual traffic flows and adjusts the filter set to reflect current traffic patterns while maintaining compliance with security policies defined in route objects. This dynamic adaptation allows the system to respond to changing traffic conditions without manual reconfiguration.
Solution Approach 2:
The system implements feedback mechanisms by continuously collecting traffic data and using this information to adjust filter configurations. The observed traffic patterns provide feedback that informs which source-address prefixes should be actively filtered, creating a closed-loop system that adapts to changing traffic conditions while maintaining security policy compliance.
Data Source
AI summary
Systems and methods are provided for generating a network ingress filter based on both a customer's route object and recent traffic data for the customer. In examples, even though a customer of a provider network may have many routing prefixes in its route object, the customer may genuinely generate traffic from only a very small percentage of such prefixes. Accordingly, a combination of a system to generate all the prefixes based on a route object, along with the results of collected traffic data, may be used to generate a much smaller ingress filter. In examples, this filter may comprise an intersection of the prefixes generated by the customer's route object and the prefixes that have been actively generating traffic on the inbound interface of the router (or other provider edge system). This results in a smaller ingress filter that can be reliably configured on the provider edge system.