Firewall Authentication for ICMP Echo Requests

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Firewalls often block ICMP messages, preventing network connectivity tests like ping and traceroute, which are essential for network management and troubleshooting, due to their packet filtering rules.

Innovation Solution

Implementing an authentication mechanism between network controllers and firewalls using extended ICMP echo request messages with a firewall authentication token field, allowing trusted network controllers to pass through test messages while rejecting untrusted ones, thereby enabling secure and authenticated network tests.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If firewalls block ICMP messages to prevent unauthorized access, then network security is improved, but network connectivity tests cannot be performed

Engineering Contradiction:
Improvenetwork securityVSAvoidnetwork connectivity testing
Core Design Contradiction:
ReliabilityVSEase of operation

Solution Approach 1:

The patent introduces an intermediary authentication mechanism between the firewall and network controllers. The firewall receives authentication tokens from authorized network controllers and uses these tokens to verify the legitimacy of ICMP echo request messages before allowing them through. This intermediary verification process enables the firewall to distinguish between legitimate network management traffic and unauthorized access attempts, resolving the contradiction between security and testing capability

Inventive Principle:
Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent modifies the parameters of ICMP echo request messages by adding authentication token fields. Instead of using standard ICMP messages alone, the system incorporates additional authentication parameters (tokens) that the firewall can verify. This parameter change allows the firewall to maintain security while permitting authenticated network connectivity tests to proceed

Inventive Principle:
Principle #35Parameter changes

2Ease of operation

If firewalls allow all ICMP messages through, then network connectivity tests can be performed, but network security is compromised

Engineering Contradiction:
Improvenetwork connectivity testingVSAvoidnetwork security
Core Design Contradiction:
Ease of operationVSReliability

Solution Approach 1:

The patent applies local quality by providing different treatment to different ICMP messages based on their authentication status. Authorized network controllers receive authentication tokens that enable their ICMP messages to pass through the firewall, while unauthorized messages are blocked. This localized differentiation of message treatment allows connectivity testing for trusted entities while maintaining security against untrusted sources

Inventive Principle:
Principle #3Local quality

3Reliability

If authentication tokens are added to ICMP messages, then message authentication capability is improved, but message format complexity increases

Engineering Contradiction:
Improvemessage authenticationVSAvoidmessage format
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent segments the authentication function from the core ICMP message structure. Instead of fundamentally redesigning ICMP, the system adds authentication tokens as separate, identifiable fields that can be independently processed. This segmentation allows the authentication mechanism to be implemented as an add-on layer, improving reliability without proportionally increasing overall message format complexity

Inventive Principle:
Principle #1Segmentation

Data Source

PatentEP3281383B1Firewall authentication of controller-generated internet control message protocol (ICMP) echo requests
Publication Date: 2020.07.08 HUAWEI TECH CO LTD
  • EP3281383B1 patent drawingFigure 1
  • EP3281383B1 patent drawingFigure 2
  • EP3281383B1 patent drawingFigure 3

AI summary

A method implemented by a network firewall, comprising obtaining a first authentication token for a network test, receiving a test request message for performing the network test on a network element (NE) connected to the network firewall, authenticating the test request message by determining whether the test request message includes a second authentication token that matches the first authentication token, and granting the network test on the NE when the second authentication token matches the first authentication token.