Hierarchical IPv6 Access Control via Multi-Stage Counting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network management technologies face challenges in accurately determining unauthorized access areas, particularly with IPv6 addresses, where conventional filtering methods are impractical due to the large number of addresses, and short network masks can inadvertently restrict legitimate user access, reducing convenience.
Innovation Solution
A communication control apparatus and method that receive request packets, count them in multiple stages corresponding to different address ranges, and determine the address area where the count exceeds a threshold as the source of unauthorized access, allowing for precise identification and blocking of unauthorized access areas.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional filtering with specified address is used, then unauthorized access can be blocked, but it is practically unavailable for IPv6 addresses due to the huge number of addresses
Solution Approach 1:
The patent segments the IPv6 address space into hierarchical groups based on prefix lengths (e.g., /32, /48, /64). Instead of filtering individual IPv6 addresses, the system divides the vast address space into manageable segments and applies counting filters at each hierarchical level, making IPv6 traffic management practically feasible.
Solution Approach 2:
The patent introduces a new dimension of hierarchical grouping by prefix length. Rather than operating in the single dimension of individual address filtering, it creates multiple hierarchical levels (dimensions) of address aggregation, allowing effective filtering in the IPv6 address space through multi-level prefix-based counting.
2Reliability
If a short network mask is used for filtering, then unauthorized access can be restricted, but access by a large number of legitimate users may also be restricted
Solution Approach 1:
The patent implements dynamic threshold adjustment based on the hierarchical level. Different prefix lengths have different counting thresholds - higher levels (shorter masks like /32) have higher thresholds to avoid blocking legitimate traffic, while lower levels (longer masks like /64) have lower thresholds for precise unauthorized access detection. This dynamic adaptation resolves the contradiction between security and user convenience.
Solution Approach 2:
The patent applies different filtering characteristics to different hierarchical levels. Each prefix length level has customized counting thresholds and filtering rules tailored to its scope. This local optimization ensures that short network masks don't unnecessarily block legitimate users while still providing effective unauthorized access restriction at appropriate hierarchical levels.
3Measurement precision
If multiple stage counting is performed, then accurate unauthorized access area determination is achieved, but system complexity increases
Solution Approach 1:
The patent segments the counting process into hierarchical stages corresponding to different prefix lengths. Each stage counts packets for a specific hierarchical level independently. This segmentation achieves accurate unauthorized access area determination by identifying which hierarchical level exceeds thresholds, while keeping each individual counting operation relatively simple and manageable.
Solution Approach 2:
The patent implements dynamic threshold comparison at each hierarchical level. The system automatically determines which level's threshold is exceeded first, providing accurate unauthorized access identification without requiring complex cross-level analysis. This dynamic approach simplifies the overall system complexity while maintaining high measurement precision.
Data Source
AI summary
The communication control apparatus (10) performs a receiving process, a counting process, and a determination process. The receiving process is a process for receiving a request packet to query a predetermined server. The counting process is a process for counting, based on a source address of the request packet, in multiple stages corresponding to different ranges of address areas that include the source address. The determination process is a process for determining an address area corresponding to a stage, from the multiple stage, in which a count value by the counting process exceeds a predetermined threshold value as an unauthorized access address area.