IPv6 Packet Filtering Software Module for Network Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The transition from IPv4 to IPv6 networks poses challenges in maintaining security and protocol compatibility, as existing IP protocols like IPv4 and ARP do not provide the added security desired for IPv6-only networks, especially during the coexistence period of both protocol versions.
Innovation Solution
A software module running on a computer device's operating system filters incoming and outgoing data packets based on IP address criteria, ensuring only IPv6 packets are forwarded, while dropping non-compliant packets to maintain a runtime IPv6-only network environment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a dual-stack protocol is used to support both IPv4 and IPv6 during transition, then protocol compatibility is improved, but network security is worsened due to lack of IPv6-only security features
Solution Approach 1:
The patent segments the network protocol handling by introducing a separate software module that operates independently from the operating system's network stack. This module filters packets at the application layer, allowing IPv6-only security policies to be enforced while the underlying system maintains dual-stack capability for compatibility.
Solution Approach 2:
The software module acts as an intermediary between the network interface and the application layer. It intercepts and filters packets before they reach the OS network stack, enabling IPv6-only security enforcement without requiring changes to the underlying dual-stack protocol implementation.
2Object-affected harmful factors
If IPv6-only filtering is implemented at the operating system level, then network security is improved, but device complexity and infrastructure changes are worsened
Solution Approach 1:
The patent moves the filtering functionality from the traditional network stack dimension (kernel level) to the application layer dimension. This allows IPv6-only security to be implemented as a software module running on top of the existing OS, avoiding complex kernel modifications while achieving the same security effect.
Solution Approach 2:
The software module provides self-contained filtering functionality that does not require modifications to the operating system or network infrastructure. It independently inspects and filters packets based on IPv6 criteria, making the system self-sufficient for IPv6-only security enforcement.
3Ease of manufacture
If packet filtering is performed at the application layer, then system modification requirements are reduced, but processing overhead is increased
Solution Approach 1:
The software module performs preliminary filtering of packets before they are processed by the full OS network stack. By checking IPv6 criteria early in the packet handling chain, it prevents unnecessary processing of non-compliant packets, reducing overall processing time despite the added filtering step.
Data Source
AI summary
A system, method, and computer readable medium are disclosed that facilitates an IP network environment. The system includes a computer device having a software module running on an operating system of the computer device, the software module (a) establishes an IP network criteria for incoming and outgoing packets for the computer device; (b) retrieves the incoming and outgoing packets to determine if an IP address for the incoming and outgoing packets meet the IP network criteria; (c) if the IP address for the incoming and outgoing packets meets the IP network criteria, forwards the incoming packets having the IP address to a network layer, which is under or part of the operating system of the computer device and forwards outgoing packets to a network connection; and (d) if the IP address for the incoming and outgoing packets does not meet the IP network criteria, drops the incoming and outgoing packets.