Link State Packet Validation Using Authentication and Purging
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In computer networks using the IS-IS protocol, stale or invalid Link State Packets (LSPs) are not properly handled, leading to incorrect routing and security issues, as nodes may continue to use outdated LSPs, and there is a lack of effective mechanisms to isolate compromised nodes.
Innovation Solution
The solution involves recognizing and updating LSPs even if they appear older, and purging invalid LSPs by sending a modified LSP with a higher sequence number, which is authenticated and flooded to neighbors to isolate the sending node, under specific conditions to minimize security breaches.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If nodes strictly follow sequence number comparison to determine LSP validity, then routing reliability is maintained, but updated LSPs may be discarded as stale causing routing information to become outdated
Solution Approach 1:
The patent changes the evaluation parameters for LSP validity by introducing authentication results and purging conditions as new criteria. Instead of relying solely on sequence numbers, the system now considers authentication outcomes and specific purging conditions (such as security violations or node isolation requirements) to determine whether to accept or discard LSPs. This multi-parameter approach resolves the contradiction by allowing updated LSPs to be accepted when they meet authentication and condition requirements, while still maintaining reliability through strict validation rules.
2Ease of operation
If a single password is used for LSP authentication, then network operation simplicity is maintained, but network security is compromised when personnel leave the company
Solution Approach 1:
The patent implements dynamic authentication mechanisms where authentication credentials can be updated, revoked, or changed over time. Instead of using a static single password, the system allows for dynamic credential management including key rotation, individual node authentication keys, and the ability to revoke access when personnel leave. This dynamic approach maintains operational simplicity through automated credential management while significantly improving security by preventing unauthorized access from departed employees.
3Stability of the object's composition
If outdated LSPs are not purged from the network, then network stability is maintained, but incorrect routing paths are used leading to network inefficiency and security issues
Solution Approach 1:
The patent implements preliminary purging actions through authentication failures and purging conditions. When an LSP fails authentication or meets specific purging conditions (such as security violations or node isolation requirements), the system proactively purges the LSP and notifies neighboring nodes before incorrect routing can cause significant problems. This preliminary action approach maintains network stability by using controlled, notified purging while improving routing efficiency by eliminating outdated LSPs before they can be used for incorrect routing decisions.
4Productivity
If there is no mechanism to isolate compromised nodes, then network connectivity is maintained, but network security is compromised allowing attacks to propagate
Solution Approach 1:
The patent introduces authentication mechanisms and purging condition checks as intermediary layers between nodes. When a node is compromised or fails authentication, these intermediary mechanisms detect the issue and trigger isolation procedures. The authentication system acts as a mediator that verifies node legitimacy, and when failures occur, it initiates controlled disconnection of the compromised node. This intermediary approach maintains security by blocking attack propagation while preserving connectivity for legitimate nodes through selective isolation rather than blanket disconnection.
Data Source
AI summary
Disclosed are methods and apparatus for handling Link State Packets (LSPs) sent between processing nodes within a computer network. At a first node, an LSP sent by a second node is received. The received LSP specifies connectivity information regarding the second node. It is then determined whether one of two conditions is met: either the received LSP is an updated LSP even though it appears older and a corresponding stored LSP fails authentication, or the received LSP fails authentication and it appears newer. If it is determined that one of these conditions is met, as well as purging criteria, then updating procedures are then performed on the LSP information that is maintained by the first node, where the LSP information was originally obtained from a corresponding LSP sent by the second node.