IPv6 Router Advertisement Interception for IoT Device Profiling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
IPv6 protocols do not provide sufficient information for profiling Bring Your Own Device (BYOD) stations in Wi-Fi networks, making it difficult to apply network policies and manage IoT devices effectively.
Innovation Solution
A system that intercepts router advertisements and modifies them to include both O and M flags, prompting IoT devices to send DHCPv6 solicitation packets to gather configuration information, allowing for device and operating system identification and subsequent network policy application.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If router advertisements are sent with O and M flags not set to enable IPv6 autoconfiguration, then device compatibility is improved, but device profiling capability deteriorates
Solution Approach 1:
The system performs preliminary device profiling by examining DHCPv6 solicitation packets before full network integration. By intercepting and analyzing these packets early in the connection establishment process, the system collects device information proactively, enabling subsequent policy enforcement without requiring additional information exchange during normal operation.
Solution Approach 2:
The patent introduces an intermediary mechanism that intercepts DHCPv6 solicitation packets between the device and DHCPv6 server. This intermediary (the network device) examines the packets to extract device identity and operating system information, acting as a mediator that profiles devices without disrupting the standard IPv6 autoconfiguration process.
2Measurement precision
If DHCPv6 solicitation packets are intercepted to gather device information, then device profiling precision is improved, but network operation complexity increases
Solution Approach 1:
Devices automatically send DHCPv6 solicitation packets as part of the standard IPv6 autoconfiguration process. The system leverages this self-service behavior, where devices willingly provide information through their normal operation, eliminating the need for active probing or additional information requests from the network side.
Solution Approach 2:
The system changes the parameter being observed from router advertisement flags to DHCPv6 solicitation packet contents. By examining different fields in the DHCPv6 packets (such as client identifier and operating system information), the system achieves precise device profiling using existing protocol mechanisms rather than modifying protocol behavior.
Data Source
AI summary
IoT stations are profiled in an IPv6 protocol environment. Responsive to sending the modified router advertisement instead of the router advertisement to the station, a DHCPv6 solicitation packet is snooped. The DHPv6 solicitation packet is sent from the station to a DHCPv6 server to gather network configuration information stored in the router advertisement withheld by the access point. In turn, the access point examines the DHCPv6 solicitation packet to determine an identity of least one of device and operating system. The identity determination is stored for applying network policies (e.g., network security policies) during transactions with the station.