Firewall Authentication for ICMP Echo Requests
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Firewalls often block ICMP messages, preventing network connectivity tests like ping and traceroute, which are essential for network management and troubleshooting, due to their packet filtering rules.
Innovation Solution
Implementing an authentication mechanism between network controllers and firewalls using extended ICMP echo request messages with a firewall authentication token field, allowing trusted network controllers to pass through test messages while rejecting untrusted ones, thereby enabling secure and authenticated network tests.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If firewalls block ICMP messages to prevent unauthorized access, then network security is improved, but network connectivity tests cannot be performed
Solution Approach 1:
The patent introduces an intermediary authentication mechanism between the firewall and network controllers. The firewall receives authentication tokens from authorized network controllers and uses these tokens to verify the legitimacy of ICMP echo request messages before allowing them through. This intermediary verification process enables the firewall to distinguish between legitimate network management traffic and unauthorized access attempts, resolving the contradiction between security and testing capability
Solution Approach 2:
The patent modifies the parameters of ICMP echo request messages by adding authentication token fields. Instead of using standard ICMP messages alone, the system incorporates additional authentication parameters (tokens) that the firewall can verify. This parameter change allows the firewall to maintain security while permitting authenticated network connectivity tests to proceed
2Ease of operation
If firewalls allow all ICMP messages through, then network connectivity tests can be performed, but network security is compromised
Solution Approach 1:
The patent applies local quality by providing different treatment to different ICMP messages based on their authentication status. Authorized network controllers receive authentication tokens that enable their ICMP messages to pass through the firewall, while unauthorized messages are blocked. This localized differentiation of message treatment allows connectivity testing for trusted entities while maintaining security against untrusted sources
3Reliability
If authentication tokens are added to ICMP messages, then message authentication capability is improved, but message format complexity increases
Solution Approach 1:
The patent segments the authentication function from the core ICMP message structure. Instead of fundamentally redesigning ICMP, the system adds authentication tokens as separate, identifiable fields that can be independently processed. This segmentation allows the authentication mechanism to be implemented as an add-on layer, improving reliability without proportionally increasing overall message format complexity
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method implemented by a network firewall, comprising obtaining a first authentication token for a network test, receiving a test request message for performing the network test on a network element (NE) connected to the network firewall, authenticating the test request message by determining whether the test request message includes a second authentication token that matches the first authentication token, and granting the network test on the NE when the second authentication token matches the first authentication token.