GRE Packet Fragmentation Bypassing Security Policies

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing packet fragmentation methods in GRE tunnels are blocked by security policies that prevent IP-level fragmentation, leading to issues with throughput and packet dropping.

Innovation Solution

Performing packet fragmentation in the GRE header instead of the IP header, using a fragment indication in the GRE header to avoid security policy blocks and maintain throughput.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If packet fragmentation is performed in IP level, then packets can be transmitted through the tunnel, but security policies will block the fragmented packets

Engineering Contradiction:

Improvepacket transmissionVSAvoidpacket blocking by security policies

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent applies segmentation by dividing the fragmentation function into two parts: the original IP-level fragmentation is kept, but an additional GRE-level fragmentation indication is added. This allows the packet to carry fragment information in the GRE header that is not visible to security policies monitoring IP headers, effectively segmenting the fragmentation visibility between different protocol layers.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The GRE header acts as an intermediary layer between the IP header and the security policy. By placing fragment indications in the GRE header rather than the IP header, the patent creates a mediator that carries fragmentation information without triggering security policies that block IP-level fragmented packets.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If packet fragmentation is blocked by security policies, then IP-level fragmentation cannot be used, but throughput is impacted

Engineering Contradiction:

Improveavoiding packet blockingVSAvoidthroughput

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent changes the parameter location from IP header to GRE header. By moving the fragment indication from the IP header to the GRE header, the patent changes which layer's parameters are visible to security policies, allowing fragmentation to proceed without blocking while maintaining throughput.

Inventive Principle:

Principle #35Parameter changes

3Productivity

If IP-level fragmentation is used, then packets can be divided for transmission, but packet dropping due to out-of-order packets occurs

Engineering Contradiction:

Improvepacket division for transmissionVSAvoidpacket dropping from out-of-order

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent implements feedback by having the receiving end check the fragment indication in the GRE header to determine packet order and completeness. This feedback mechanism allows the receiver to properly reassemble fragmented packets in the correct order, preventing packet dropping due to out-of-order delivery.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS12341627B2Packet fragmentation in GRE

Publication Date: 2025.06.24 HEWLETT PACKARD ENTERPRISE DEV LP

AI summary

Implementations of the present disclosure relate to packet fragmentation in Generic Routing Encapsulation (GRE). A method comprises in accordance with a determination that the target packet is to be fragmented, generating at least two packets from the target packet. The at least two packets comprise an Internet Protocol (IP) header, a GRE header and a fragment of the payload of the target packet, respectively. The GRE header comprises a fragment indication indicating that the respective packet comprises a respective fragment of the payload of the target packet. The method further comprises transmitting the at least two packets to a second network device. In this way, the packet fragment dropping due to security policies will be avoided.