Network Event Access Control with Entitlement-Based K-Way Merge
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Spoofing attacks using User Datagram Protocol (UDP) packets are prevalent due to its connectionless nature, making it difficult to distinguish between legitimate and spoofed packets, which leads to computational inefficiencies and inaccurate information.
Innovation Solution
A method involving the generation of probe UDP packets with ephemeral source port numbers and lossy hash functions to identify spoofed packets, combined with a database system for event data management and access control, effectively filtering out spoofed packets and improving computational efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If all received UDP packets are processed to ensure complete network scanning accuracy, then measurement precision is improved, but productivity deteriorates due to processing 90% or more spoofed packets wasting computational resources
Solution Approach 1:
The system performs preliminary actions by generating probe packets with ephemeral source port numbers before receiving responses, and pre-computing lossy hash values of these probe packets. When response packets are received, the system immediately compares their destination port numbers against the pre-computed hash values to quickly identify spoofed packets without extensive processing
Solution Approach 2:
The patent introduces lossy hash functions as an intermediary mechanism between probe packet generation and response verification. The hash function computes a condensed representation (ephemeral port number) that serves as a quick comparison key, allowing the system to filter spoofed packets efficiently without performing complex verification on every received packet
2Reliability
If source address verification is implemented to identify spoofed packets, then reliability is improved, but device complexity increases due to additional verification mechanisms
Solution Approach 1:
The system changes the parameter used for verification from full source address checking to comparing destination port numbers against lossy hash values of probe packets. This parameter transformation simplifies the verification process while maintaining reliability in identifying spoofed packets, as the hash comparison is computationally lighter than full address verification
Data Source
AI summary
Network events are recorded in a database. Entries for events are partitioned upon storage based on entitlements, e.g., a designation used to determine access privilege. Within a partition, events are sorted, such as based on time stamp. A request referencing an entity identifier from network events and associated with one or more entitlements is received. Entries including the entry identifier and the one or more entitlements are retrieved from the database and subject to a streaming in-memory K-way merge and the merged entries are processed to obtain an aggregation that may be output to a source of the request.