Network Device Multicast Protocol Error State
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Multicast deployments are vulnerable to Denial of Service (DoS) attacks that can lead to hardware filter exhaustion and device failure due to an overwhelming number of IGMP or MLD join messages, causing network devices to crash.
Innovation Solution
A mechanism is implemented where a network device changes the state of the IP multicast protocol to an error state when hardware filters are exhausted, preventing further join requests and thus mitigating the risk of DoS attacks by discarding new IP multicast group join messages and deleting filtered group entries, while ensuring existing multicast traffic is not disrupted.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the network device processes all IGMP or MLD join messages to support multicast groups, then the multicast service coverage is improved, but the hardware filters are exhausted leading to device failure
Solution Approach 1:
The patent applies preliminary anti-action by implementing a protection mechanism that proactively prevents DoS attacks before they can exhaust hardware filters. The system monitors the number of active multicast groups and preemptively blocks additional join requests when a threshold is reached, preventing the attack from progressing to filter exhaustion and device failure.
Solution Approach 2:
The patent introduces an intermediary protection layer between the incoming IGMP/MLD join messages and the hardware filters. This intermediary mechanism validates and controls the flow of join requests, acting as a buffer that protects the vulnerable hardware filters from being overwhelmed by malicious traffic while still allowing legitimate multicast traffic to pass through.
2Reliability
If the network device limits the number of multicast groups to prevent filter exhaustion, then device reliability is improved, but the ability to support new multicast groups is reduced
Solution Approach 1:
The patent applies dynamics by implementing adaptive threshold adjustment mechanisms. The system dynamically modifies the maximum number of multicast groups based on observed traffic patterns, attack characteristics, and network conditions. This allows the device to be more permissive during normal operation to support legitimate multicast services while becoming more restrictive when attacks are detected, thus balancing reliability and adaptability.
Solution Approach 2:
The patent utilizes parameter changes by modifying operational parameters such as the maximum multicast group count threshold based on system state. The device can adjust this parameter in response to detected attacks or abnormal conditions, changing from a static limitation to a flexible control mechanism that maintains reliability while preserving service capability when appropriate.
3Measurement precision
If the network device processes every join message to maintain accurate multicast group information, then the multicast routing accuracy is improved, but the processing load increases making the device vulnerable to DoS attacks
Solution Approach 1:
The patent extracts and separates the validation and filtering functions from the main multicast processing path. By isolating the security check mechanism that verifies join requests against the maximum group threshold, the system can perform essential accuracy checks without processing every single join message through the full routing computation pipeline, thus reducing overall processing load while maintaining necessary precision.
Data Source
AI summary
Some examples relate to managing multicast scaling. In an example, a network device may receive a message to join an IP multicast group. The network device may determine whether a hardware filter is available on the network device to process the received message. In response to the determination that the hardware filter is not available on the network device to process the received message, a current state of an IP multicast protocol associated with the message may be changed to an error state on the network device, wherein in the error state, further messages to join the IP multicast group that are received by the network device are discarded by the network device.