IPv6 Fragment Spoof Check via Port Encoding

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current techniques for performing MAP-T (Mapping of Address and Port using Translation) for BR upstream and downstream traffic consume excessive computing and networking resources due to the inability to identify spoofed traffic, lack of native IPv6 fragmentation support, and failure to drop spoofed traffic.

Innovation Solution

A network device without native IPv6 support receives IPv6 fragments, encodes source and/or destination port information into the IPv6 fragment header, performs a spoof check, drops spoofed fragments, and translates remaining fragments into IPv4 fragments based on the encoded information for forwarding to an IPv4 cloud network.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If MAP-T translation is performed for IPv6 fragments without port information encoding, then translation functionality is provided, but computing resources are excessively consumed and spoofed traffic cannot be identified

Engineering Contradiction:

Improvespoofed traffic identificationVSAvoidcomputing resource consumption

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The patent applies preliminary action by encoding source and destination port information into the IPv6 fragment header identification field before translation. This pre-encoding allows the network device to perform spoof checks on individual fragments without requiring full reassembly, enabling early identification and dropping of spoofed traffic while conserving computing resources.

Inventive Principle:

Principle #10Preliminary action

2Adaptability or versatility

If native IPv6 fragmentation support is implemented, then fragmentation handling capability is improved, but device complexity increases

Engineering Contradiction:

ImproveIPv6 fragmentation supportVSAvoidnative IPv6 support requirement

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent uses an intermediary approach by having the customer premises equipment (CPE) encode port information into the IPv6 fragment headers before forwarding to the network device. This intermediary encoding mechanism enables the network device to perform translation and spoof checks without requiring native IPv6 fragmentation support, thereby reducing device complexity while maintaining adaptability.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Reliability

If spoof check is performed on all IPv6 fragments, then traffic security is improved, but processing time increases

Engineering Contradiction:

Improvetraffic securityVSAvoidfragment processing time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent applies segmentation by performing spoof checks on individual IPv6 fragments independently using the port information encoded in each fragment's header. This segmented approach allows parallel processing of multiple fragments without requiring sequential reassembly, thereby maintaining high traffic security while minimizing processing time delays.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS20250047641A1Internet protocol (IP) version 6 fragmentation and reassembly optimization for port-aware IP translators

Publication Date: 2025.02.06 JUNIPER NETWORKS INC

AI summary

A network device may receive IPv6 fragments of a flow. Source and/or destination port information may be encoded into an upper sixteen bits of an identification number of an IPv6 fragment header of each of the IPv6 fragments. The network device may extract the source and/or destination port information from the IPv6 fragments, and may perform a spoof check of the IPv6 fragments. The network device may drop any of the IPv6 fragments that fail the spoof check, to generate remaining IPv6 fragments, and may translate the remaining IPv6 fragments into IPv4 fragments based on the source and/or destination port information. The network device may forward the IPv4 fragments toward an IPv4 cloud network.