IP TTL Field Covert Channel for Source Traceback
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for tracing back anonymous network flows in packet switched networks, such as the Internet, face challenges in efficiently identifying the source of malicious attacks due to spoofing of IP source addresses, particularly when using IP Options or IP Identification fields, which lead to fragmentation issues and compatibility problems.
Innovation Solution
Utilizing the Time to Live (TTL) field in IP datagram headers to uniquely mark packets at upstream stations, allowing downstream stations to identify which routers the packets traversed, thereby tracing back the source of network flows without altering the standard operation of the TTL field.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If IP Options field is used for packet marking, then trace back capability is improved, but packet fragmentation and processing complexity increase
Solution Approach 1:
The patent extracts the marking function from the IP Options field and relocates it to the TTL field. By using the TTL field for trace back marking, the solution eliminates the need for additional IP Options, thereby avoiding packet fragmentation and reducing processing complexity while maintaining trace back capability.
Solution Approach 2:
The patent makes the TTL field multi-functional by using it for both its original purpose (controlling packet lifetime) and the trace back marking function. This eliminates the need for separate dedicated marking fields and reduces overall device complexity.
2Measurement precision
If IP Identification field is used for packet marking, then trace back capability is improved, but backward compatibility is compromised
Solution Approach 1:
The patent extracts the marking function from the IP Identification field and relocates it to the TTL field. This preserves the original semantics of the IP Identification field for fragment reassembly, thereby maintaining backward compatibility while achieving trace back capability through the TTL field.
3Measurement precision
If dedicated IP Option is appended for marking, then trace back capability is improved, but packet length increases and fragmentation occurs
Solution Approach 1:
The patent removes the need for additional IP Options by using the existing TTL field for marking. This prevents packet length increase and avoids fragmentation issues that would occur if IP Options were appended to packets already close to MTU limits.
4Measurement precision
If IP Options field is used for marking, then trace back capability is improved, but routing performance deteriorates due to slow path processing
Solution Approach 1:
The patent extracts the marking function from IP Options and implements it through TTL modification, which can be performed in the fast path of router processing. This eliminates the need for slow path processing and maintains high routing performance while achieving trace back capability.
Data Source
AI summary
The Time to Live (TTL) field in an IP header is used as a covert channel in a communication system. More particularly the TTL field can be used to selectively mark packets with unique identifiers as they pass through an upstream station on their way to a downstream station. In this way the source of a traffic flow at least within a particular domain can be absolutely identified. This method of performing a traceback operation doesn't utilize additional resources as it relies on functionality which already exists in the system.