Network Device Path Verification Using Sequence Markers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing path verification methods, such as ICING, impose a high computing load on intermediate network devices due to the need for encryption and decryption, which can be resource-intensive and vulnerable to attacks like retransmission attacks.
Innovation Solution
A data packet sending method that uses sequence number markers and position markers to perform path verification without requiring intermediate network devices to perform encryption/decryption, utilizing a pseudo device sequence number to prevent retransmission attacks, and employing modulo prime number calculations for accumulated values to reduce computational load and enhance security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If ICING-based path verification is used, then path verification capability is achieved, but computing load on intermediate network devices becomes high
Solution Approach 1:
The patent extracts the encryption/decryption operations from intermediate network devices and concentrates them at the verification device. Intermediate devices only perform simple marker recording and accumulation, while the verification device handles the computationally intensive cryptographic operations, thereby reducing computing load on intermediate devices while maintaining path verification capability.
Solution Approach 2:
The patent applies preliminary action by pre-configuring pairing keys at intermediate network devices before path verification is needed. These pre-stored keys enable intermediate devices to perform simple verification without requiring complex cryptographic operations during data packet transmission, thus reducing real-time computing load while ensuring security.
2Reliability
If encryption and decryption are performed at each intermediate node, then path verification is secure, but computing resources are consumed excessively
Solution Approach 1:
The patent extracts heavy cryptographic operations from intermediate network devices and concentrates them at the verification device. Intermediate devices only perform simple marker recording and accumulation, while the verification device handles the computationally intensive cryptographic operations, thereby reducing computing load on intermediate devices while maintaining path verification capability.
Solution Approach 2:
The patent changes the operational parameters of intermediate network devices from performing full encryption/decryption to performing only lightweight marker manipulation and accumulation. This parameter change reduces computing resource consumption while the verification device maintains security through its cryptographic verification of accumulated markers.
3Reliability
If sequence number markers and position markers are used, then retransmission attacks are prevented, but data transmission requirements increase
Solution Approach 1:
The patent segments the verification information into separate sequence number markers and position markers that are accumulated at each intermediate device. This segmentation allows for efficient verification at the destination without requiring all intermediate devices to store complete packet histories, thus limiting data transmission requirements while maintaining attack prevention capability.
Solution Approach 2:
The patent applies partial action by having intermediate devices record only the necessary marker information (sequence numbers and positions) rather than transmitting complete packet data. This partial recording approach prevents retransmission attacks while minimizing data transmission requirements compared to full packet replay approaches.
Data Source
AI summary
A data packet sending method, a network device, a control device, and a network system includes receiving a first data packet sent by a first device, where a packet header of the first data packet includes a first sequence number marker sequence, a first position marker sequence, a first accumulated value, and a verification value; obtaining a second data packet, where a packet header of the second data packet includes a second sequence number marker sequence, a second position marker sequence, a second accumulated value, and the verification value; and sending the second data packet to a second device.