Multi-Homed Connection Firewall Rule Configuration

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Firewalls and other mechanisms often fail to adequately support multi-homed connections by blocking traffic directed to secondary IP addresses due to inaccurate firewall rules that do not account for ephemeral ports used in Stream Control Transmission Protocol (SCTP) connections.

Innovation Solution

Using non-ephemeral ports to initiate multi-homed connections and storing this information in a data store, allowing connection rules to be configured to support traffic from all associated paths, thereby ensuring that traffic is properly processed and not discarded.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If firewalls use traditional connection tracking methods, then security is maintained for single-homed connections, but multi-homed connection traffic is blocked due to inaccurate firewall rules

Engineering Contradiction:

Improvesupport for multi-homed connectionsVSAvoidtraffic delivery accuracy

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The system performs preliminary actions by determining whether an MH connection is enabled before configuring firewall rules. The connection manager proactively identifies the local initiate port and pre-configures connection rules to allow traffic from all paths associated with the MH connection, preventing traffic blocking before it occurs

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The invention changes the parameter used for firewall rule configuration from traditional connection tracking (which fails for MH connections) to using the local initiate port identifier. By configuring rules based on this specific port parameter, the system can accurately identify and allow MH connection traffic across multiple paths while maintaining security

Inventive Principle:

Principle #35Parameter changes

2Object-affected harmful factors

If firewalls block traffic to secondary IP addresses, then security is improved by preventing unauthorized access, but valid MH connection traffic is inadvertently blocked

Engineering Contradiction:

Improveunauthorized access preventionVSAvoidvalid traffic throughput

Core Design Contradiction:

Object-affected harmful factorsVSProductivity

Solution Approach 1:

The system applies local quality by configuring firewall rules with specific local initiate port identifiers for MH connections. This allows the firewall to treat MH connection traffic differently from other traffic, permitting valid MH traffic while maintaining blocking of unauthorized access through other means

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The connection manager implements feedback by monitoring incoming traffic and using the local initiate port to determine whether traffic belongs to an established MH connection. This feedback mechanism ensures that valid MH traffic is allowed while maintaining security controls for other traffic types

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS11233726B2Methods, systems, and computer readable media for supporting multi-homed connections

Publication Date: 2022.01.25 ORACLE INT CORP

AI summary

Methods, systems, and computer readable media for supporting multi-homed (MH) connections are disclosed. According to one method, the method comprises: determining that an MH connection is enabled; identifying a local initiate port associated with the MH connection; using the local initiate port to configure connection rules to allow traffic associated with a plurality of paths associated with the MH connection; and using the connection rules to process traffic received over the MH connection.