Hardware Tunnel Endpoint MAC-IP Validation for DoS Protection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Logical overlay networks are vulnerable to denial of service (DoS) attacks due to improper mappings between MAC addresses and IP addresses, which can lead to physical servers becoming inaccessible and exhausting network resources.

Innovation Solution

A hardware tunnel endpoint is configured with MAC addresses of virtual computing instances and IP addresses associated with hypervisors to check and drop packets with invalid mappings, preventing such attacks by ensuring only legitimate packets are forwarded.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If hardware VTEPs are utilized to bridge physical machines into the overlay network, then physical machines can access overlay network services, but the network becomes vulnerable to DoS attacks with improper MAC-IP mappings

Engineering Contradiction:

Improveability to connect physical machines to overlay networkVSAvoidnetwork security against DoS attacks

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The hardware VTEP performs preliminary validation of MAC-IP address mappings before forwarding packets into the overlay network. By checking whether the source MAC address in encapsulated packets matches the expected MAC address for the source IP address in the outer header, the system prevents malformed packets from entering the network, thereby maintaining security while enabling physical machine connectivity

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The hardware VTEP acts as an intermediary device between physical machines and the virtualized overlay network. It mediates packet forwarding by validating address mappings and dropping invalid packets, thus protecting the overlay network from DoS attacks while allowing legitimate traffic from physical machines to pass through

Inventive Principle:

Principle #24Intermediary (Mediator)

2Productivity

If all encapsulated packets are forwarded without validation, then network traffic flows freely, but resources are exhausted by malicious packets with invalid address mappings

Engineering Contradiction:

Improvepacket forwarding throughputVSAvoidnetwork resource exhaustion from malicious packets

Core Design Contradiction:

ProductivityVSLoss of energy

Solution Approach 1:

The hardware VTEP extracts and validates the source MAC address from the inner header and compares it against the source IP address in the outer header using stored MAC-IP mappings. By taking out and validating this specific field, the system identifies and drops malicious packets with invalid mappings while allowing legitimate traffic to pass, thus preventing resource exhaustion without significantly impacting throughput

Inventive Principle:

Principle #2Taking out (Extraction)

3Reliability

If MAC-IP address validation is performed at hardware VTEP, then DoS attacks are prevented, but additional processing requirements increase device complexity

Engineering Contradiction:

Improveprotection against DoS attacksVSAvoidhardware VTEP processing requirements

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent implements MAC-IP validation logic in hardware at the VTEP device rather than using software-based processing. By substituting hardware implementation for software processing, the system achieves robust DoS protection with minimal impact on packet forwarding performance, as the validation occurs in parallel with the encapsulation/decapsulation process

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS10469529B2Address checking to protect against denial of service attack

Publication Date: 2019.11.05 VMWARE INC

AI summary

Certain embodiments described herein are generally directed to checking packets at a hardware tunnel endpoint. In some embodiments, an encapsulated packet is received at a hardware tunnel endpoint. It is determined if an inner source media access control (MAC) address is associated with an outer source internet protocol (IP) address of the encapsulated packet based on a mapping of MAC addresses of virtual computing instances to IP addresses of tunnel endpoints stored at the hardware tunnel endpoint. If it is determined the inner source MAC address is not associated with the outer source IP address, the packet is dropped.