IPv6 CGA Extension Header Network Layer Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The Cryptographically Generated Addresses (CGA) protocol is not universally applicable across different network protocols, limiting its usage to specific application protocols due to lack of source address verification at the network layer.
Innovation Solution
A method and apparatus for processing IPv6 packets that include a CGA extension header with CGA parameters and signature, allowing verification of the source address at the network layer, thereby extending the applicability of CGA protocol and ensuring network security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If CGA is applied only in application protocols, then implementation complexity is reduced, but security coverage and versatility are limited
Solution Approach 1:
The patent applies CGA security mechanism at the network layer (IPv6 layer) instead of only at the application layer, moving to a different dimensional level in the protocol stack. This enables CGA to secure all IPv6 traffic regardless of the application protocol used, significantly expanding versatility while the modular extension header design keeps implementation manageable
Solution Approach 2:
The CGA extension header is designed as a universal security mechanism that can be applied to all IPv6 packets regardless of the upper-layer protocol. The extension header contains CGA parameters and signature that work across different application protocols, making the security mechanism universally applicable rather than protocol-specific
2Reliability
If source address verification is implemented at the network layer, then security coverage is improved, but processing overhead increases
Solution Approach 1:
The CGA parameters (public key, nonce, prefix) are pre-computed and embedded in the extension header before packet transmission. The verification process at the receiving end only needs to perform hash computation on these pre-prepared parameters, significantly reducing the computational overhead compared to performing full cryptographic verification without pre-computation
Solution Approach 2:
The CGA extension header acts as an intermediary structure that carries all necessary verification data (public key, nonce, prefix, signature) in a standardized format. This intermediary layer separates the verification logic from the core IPv6 processing, making the verification process modular and easier to implement without complicating the main network layer functionality
Data Source
Figure 1~2
Figure 3~4
Figure 5
AI summary
A method and apparatus for processing packets are provided to extend the usage of a Cryptographically Generated Addresses (CGA) protocol. The method includes: receiving an Internet Protocol version 6 (IPv6) packet carrying CGA related information from a sender; obtaining the CGA related information from the IPv6 packet at the network layer, where the CGA related information includes the CGA parameters (CGA Params) and CGA signature (CGA Sig) of the sender; verifying the source address of the IPv6 packet according to the CGA Params and CGA Sig; transmitting the payload of the IPv6 packet after the verification succeeds. In the present invention, the packet is not limited to the IPv6 packet; the IP packet of a version later than IPv6 or the IP packet compatible with IPv6 may also be used.