Network Link Verification via Deceptive Probing Packets
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional Software Defined Networking (SDN) topology discovery mechanisms are vulnerable to attacks that create fake links, leading to incorrect network views and potential security threats, as they lack effective authentication and verification methods for Link Layer Discovery Protocol (LLDP) packets.
Innovation Solution
The Deceptive Link Verifier (DLV) system generates indistinguishable probing packets to verify the validity of switch links by mimicking normal traffic, using a Deceptive Packet Handler to inject verification packets into the network and determine link authenticity based on responses from switches, thereby preventing malicious switches from deceiving the controller about network topology.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional SDN topology discovery mechanisms are used, then network topology can be discovered through LLDP packets, but the system becomes vulnerable to attacks that create fake links leading to incorrect network views
Solution Approach 1:
The system performs preliminary actions by installing packet handling rules on switches before injecting verification packets into the network. These rules pre-configure the expected behavior of legitimate switches, enabling the system to distinguish authentic switches from malicious ones that attempt to create fake links. This preliminary configuration ensures that only switches with proper routing rules can correctly handle verification packets, thereby preventing topology poisoning attacks while maintaining reliable network topology discovery.
2Ease of operation
If LLDP packets are used for link discovery, then switch links can be discovered throughout the network, but authentication and verification methods are lacking making the system susceptible to deception
Solution Approach 1:
The system implements feedback by injecting verification packets into the network and monitoring the responses from switches. When a verification packet is injected, the system expects specific responses based on the pre-installed packet handling rules. Legitimate switches that have the correct rules will respond appropriately, while malicious switches attempting to create fake links will either not respond or respond incorrectly. This feedback mechanism provides authentication and verification for discovered links, ensuring link authenticity while maintaining ease of operation.
3Productivity
If the controller trusts discovered topology information, then network management decisions can be made efficiently, but malicious switches can deceive the controller about network topology
Solution Approach 1:
The system performs preliminary verification by installing packet handling rules on switches before trusting the discovered topology information. This preliminary action creates a verification layer that authenticates switches and links before the controller makes network management decisions. The controller can efficiently manage the network by trusting only those topology elements that have passed verification through the pre-configured packet handling rules, thus preventing controller deception while maintaining network management efficiency.
4Reliability
If verification packets are injected into the network, then link authenticity can be determined, but normal traffic patterns may be disrupted
Solution Approach 1:
The system applies local quality by making verification packets distinctive and targeted rather than broadcast throughout the entire network. The packet handling rules are installed locally on specific switches, and verification packets are injected only where needed to verify specific links. This localized approach allows link verification to occur without disrupting overall network traffic patterns, as the verification process is confined to specific paths and switches rather than affecting the entire network uniformly.
Data Source
AI summary
Systems and methods for verifying the validity of a network link are described herein. A verification packet and an associated packet handling flow can be generated and added to a network in order to investigate a link between network nodes (e.g. switches).