IPv6 Flow Label for Stateless IPv4 Fragment Anti-Spoofing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In IPv4 to IPv6 transition networks, performing stateless anti-spoofing checks on fragmented IPv4 packets without reassembling them is challenging due to the need for buffering and processing resources, especially when only some fragments contain the source port information, leading to inefficiencies in resource usage.
Innovation Solution
Incorporating a flow label in each IPv6 packet that encapsulates an IPv4 packet fragment, which indicates the source port, allowing the network device to perform anti-spoof checks without buffering or reassembling the IPv4 packet, thereby reducing processor and memory resource utilization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the network device buffers IPv4 packet fragments until the fragment containing source port information is received, then anti-spoofing checks can be performed, but additional memory resources and processing resources are consumed
Solution Approach 1:
The source port information is extracted and embedded in the flow label of each IPv6 packet during the fragmentation process at the edge device, before the packets are transmitted over the IPv6 network. This preliminary action ensures that the network device receives all necessary anti-spoofing information immediately with each fragment, eliminating the need to buffer fragments waiting for the one containing source port information.
2Reliability
If the network device buffers IPv4 packet fragments to perform anti-spoofing checks, then security validation is achieved, but additional processing resources are consumed to track fragments
Solution Approach 1:
The edge device performs the action of extracting and embedding the source port information in the flow label of each IPv6 packet before transmission. This preliminary action shifts the processing burden from the network device (which would need to track and buffer fragments) to the edge device (which performs the embedding once during fragmentation), thereby reducing the processing resources required at the network device.
Solution Approach 2:
The source port information is extracted from the IPv4 packet header and placed into the flow label field of the encapsulating IPv6 packet header. This extraction separates the anti-spoofing information from the fragment payload, making it immediately accessible to the network device without requiring fragment reassembly or buffering.
3Reliability
If IPv4 packets are reassembled from fragments before anti-spoofing checks, then complete packet validation is possible, but network device performance decreases
Solution Approach 1:
The necessary anti-spoofing information (source port) is extracted from the IPv4 packet and embedded in the IPv6 flow label, allowing the network device to perform validation on individual fragments without reassembling the complete IPv4 packet. This extraction enables anti-spoofing checks to be performed on a per-fragment basis, maintaining validation accuracy while improving performance.
Solution Approach 2:
The source port information is preliminarily embedded in the flow label during the fragmentation process, enabling the network device to perform anti-spoofing checks immediately upon receiving each fragment. This eliminates the need to wait for and reassemble all fragments before validation, thereby maintaining complete packet validation capability while significantly improving processing throughput.
Data Source
AI summary
A network device may receive, from a first network, a network packet of a first network packet type that encapsulates a fragment of a second network packet of a second network packet type, where the network packet is part of a flow of a plurality of network packets of the first network packet type that encapsulates fragments of the second network packet, and where the network packet includes a flow label that indicates a source port for the second network packet. The network device may perform an anti-spoof check on the fragment of the second network packet based at least in part on the source port for the second network packet that is indicated by the flow label of the network packet. The network device may, based on the fragment passing the anti-spoof check, forward the fragment of the second network packet to a second network.