IPv6 Host Fingerprinting for Malicious Traffic Blocking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing IP blocking methods, particularly in IPv4 networks, become ineffective with the advent of IPv6, which uses prefixes rather than single IP addresses, leading to a vast number of possible addresses and complicating the identification and blocking of malicious traffic due to the ability of hosts to assign multiple addresses and switch prefixes, making traditional blacklisting resource-intensive and prone to false positives among legitimate users.
Innovation Solution
A method that generates a fingerprint based on the structure and content of incoming connection requests and physical connections, allowing for the identification and blocking of attackers using a unique signature that combines host and connection behavior, even when attackers use multiple IP addresses or hide behind NAT gateways, thereby reducing storage requirements and minimizing the risk of blocking legitimate users.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional IP blacklisting is used in IPv6 networks, then blocking of malicious traffic becomes resource-intensive and complex, but the ability to identify and block attackers is maintained
Solution Approach 1:
The patent segments the IPv6 address into multiple components (prefix, interface identifier, etc.) and analyzes each segment separately. Instead of treating the entire 128-bit address as a single blacklisting unit, the system divides it into manageable parts that can be independently evaluated, reducing the complexity of storing and processing blacklist data while maintaining reliable attacker identification.
Solution Approach 2:
The patent introduces a new dimension of analysis by examining the structure and composition of IPv6 addresses beyond simple blacklisting. It analyzes the prefix length, interface identifier patterns, and address formation methods to identify malicious traffic. This dimensional approach transforms the problem from storing vast numbers of individual address blacklists to analyzing address structure characteristics, significantly reducing system complexity.
2Reliability
If every IP address is blacklisted individually, then storage requirements become prohibitively large, but blocking effectiveness is maintained
Solution Approach 1:
The patent merges multiple individual IP address blacklisting requirements into a single unified blacklist entry by analyzing common structural characteristics. When multiple malicious addresses share the same prefix or structural pattern, they are combined into one representative entry, dramatically reducing storage requirements while maintaining blocking effectiveness against all addresses sharing that malicious pattern.
Solution Approach 2:
The patent changes the parameters used for blacklisting from storing complete IP addresses to storing structural parameters such as prefix length, address type indicators, and formation patterns. This parameter transformation allows the system to represent thousands of potential malicious addresses with a single compact entry, reducing storage from terabytes to kilobytes while preserving blocking effectiveness.
3Adaptability or versatility
If hosts are assigned multiple IPv6 addresses, then identification of malicious hosts becomes more difficult, but flexibility and usability of IPv6 networks is improved
Solution Approach 1:
The patent implements a feedback mechanism that monitors the behavior and performance of each IPv6 address assigned to a host. By continuously analyzing connection patterns, traffic characteristics, and security events associated with multiple addresses, the system builds a reputation profile for each host. This feedback loop enables reliable identification of malicious hosts even when they use multiple addresses, as the behavioral patterns provide consistent identifying characteristics across all their addresses.
Data Source
AI summary
A mechanism is provided for blocking IP connection addresses and prefixes. Header information is extracted from an incoming connection request. A determination is made as to whether a portion of an Internet Protocol address comprised in the header information is blacklisted. Responsive to a portion of the Internet Protocol address being blacklisted, a fingerprint is generated, and a determination is made as to whether the fingerprint is blacklisted. Responsive to the fingerprint being blacklisted, the underlying physical connection is dropped; data associated with the incoming connection request is stored in a buffer, the fingerprint is associated to the incoming connection request; the incoming connection request is merged with stored blacklisted requests of a related originating system; and shared prefixes of the Internet Protocol address of the stored blacklisted requests are filtered out.