IPv6 Reputation Scoring for Spam Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Preventing spam in IPv6 networks is challenging due to large address blocks and frequent address changes, making it difficult to effectively block malicious IP addresses, as existing reputation-based systems are not scalable and require widespread adoption and cooperation from ISPs.
Innovation Solution
Implementing a mechanism that assigns a negative reputation to the smallest delegable block (/64) and adjacent blocks, allowing organizations to block traffic from hosts with insufficient reputation, independent of other networks, without requiring new record types or widespread adoption, and using a scoring system to increment reputation scores based on inappropriate traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If reputation-based systems block spam by flagging IP addresses, then spam prevention effectiveness is improved, but scalability and widespread adoption are worsened due to requiring cooperation from all ISPs
Solution Approach 1:
The patent segments the IPv6 address space into hierarchical blocks (e.g., /48, /56, /64 prefixes) and assigns reputation scores at each hierarchical level. This allows the system to block spam at multiple granularities - from individual /64 blocks to larger /48 blocks - enabling effective spam prevention without requiring complete IPv6 adoption across all networks. Organizations can implement the system independently at their own hierarchical level.
Solution Approach 2:
The patent introduces a new dimension to reputation systems by implementing hierarchical blocking across multiple IPv6 prefix levels. Instead of a flat IP address blocking approach, the system creates a multi-dimensional reputation structure where blocks can be scored and blocked at different hierarchical depths, allowing partial implementation and gradual adoption without requiring universal ISP cooperation.
2Measurement precision
If the system assigns negative reputation to smallest delegable blocks (/64), then precision in blocking malicious addresses is improved, but complexity of the reputation management system is worsened
Solution Approach 1:
The patent divides the IPv6 address space into hierarchical segments (/48, /56, /64 blocks) and maintains reputation scores at each segment level. This segmentation allows precise blocking of malicious /64 blocks while automatically propagating reputation information to parent hierarchical levels, reducing the overall complexity of tracking individual addresses across the entire IPv6 space.
Solution Approach 2:
The patent merges reputation management across multiple hierarchical levels by allowing reputation scores to be inherited and propagated from child blocks to parent blocks. When a /64 block receives a negative reputation, this automatically affects parent /56 and /48 blocks, consolidating the reputation management complexity into a unified hierarchical system rather than requiring separate tracking for each individual address.
3Reliability
If the system increments reputation scores for adjacent blocks, then comprehensive spam blocking is improved, but false positive rate is worsened due to blocking potentially legitimate traffic
Solution Approach 1:
The patent applies different reputation scoring weights to different hierarchical levels and adjacent blocks. When spam is detected from a specific /64 block, the system assigns a higher penalty to that exact block and progressively lower penalties to adjacent blocks and parent blocks. This local quality differentiation allows comprehensive spam blocking at the source while reducing false positives for potentially legitimate adjacent networks.
Solution Approach 2:
The patent dynamically adjusts reputation score parameters based on hierarchical level and proximity to the offending block. The system changes the magnitude of reputation penalties applied at different levels (e.g., -10 for the offending /64 block, -5 for adjacent /64 blocks, -2 for parent /56 blocks), allowing comprehensive blocking coverage while progressively reducing the impact on potentially legitimate traffic from adjacent or parent blocks.
Data Source
AI summary
Traffic is obtained from a plurality of internet protocol version six addresses within a plurality of internet protocol version six blocks; and a first indication of inappropriate traffic is obtained from a first one of the addresses. Responsive to the first indication of inappropriate traffic, a reputation score for a first given one of the blocks, containing the first one of addresses, is incremented by a first predetermined amount; and a reputation score for a second given one of the blocks, adjacent the first given one of the blocks, is incremented by a second predetermined amount which is less than the first predetermined amount. Traffic from the plurality of addresses within the plurality of blocks is passed or blocked in accordance with a policy based on the incremented reputation scores for the first and second given ones of the blocks.