Network Node Authentication via Pre-Distributed Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network protocols lack effective security measures to authenticate neighbor nodes, making them vulnerable to spoofing attacks that disrupt network topology generation, leading to malfunctioning applications and potential hacking or malicious interference.
Innovation Solution
A network system with designated processing nodes that receive a secured key to verify authentication codes in discovery packets, using techniques like message authentication codes (MAC) or encryption methods (RSA, Triple DES, AES) to ensure packet validity and prevent spoofing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If network nodes exchange discovery packets using standard protocols (LLDP, CDP), then neighbor information can be discovered and applications can be developed, but the network becomes vulnerable to spoofing attacks and malicious interference
Solution Approach 1:
The patent applies preliminary action by pre-distributing authentication keys to network nodes before discovery packet exchange. The control node generates and distributes keys to coordinate nodes in advance, enabling them to verify the authenticity of discovery packets. This preventive measure ensures that only authenticated nodes can participate in topology discovery, blocking spoofing attacks before they can disrupt the network.
Solution Approach 2:
The patent introduces an intermediary authentication mechanism where a control node acts as a mediator between network nodes. The control node distributes authentication keys to coordinate nodes, which then use these keys to verify discovery packets. This intermediary layer of authentication protects the network from malicious actors while maintaining the functionality of neighbor discovery protocols.
2Reliability
If authentication mechanisms are added to discovery packets, then network security is improved, but the complexity of the protocol increases
Solution Approach 1:
The patent applies local quality by implementing authentication only at specific points in the network topology - specifically at coordinate nodes that are directly connected to the control node. Not all network nodes require full authentication capabilities, only those in critical positions. This localized approach to security reduces overall protocol complexity while maintaining network security where it is most needed.
3Reliability
If all network nodes verify authentication codes in discovery packets, then spoofing attacks are prevented, but the processing overhead and time consumption increase
Solution Approach 1:
The patent segments the network into hierarchical levels: control nodes that manage key distribution, coordinate nodes that perform authentication verification, and regular network nodes that exchange discovery information. This segmentation allows authentication to be performed only by coordinate nodes rather than all nodes, reducing processing overhead while maintaining security. The division of responsibilities optimizes the balance between security and efficiency.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A network system is provided to coordinate nodes in a network topology to exchange neighbor information. The network system includes a plurality of processing nodes, where each processing node includes a processing node manager configured to receive a key via a secured connection, wherein the key comprises an instruction to forward advertised discovery packets to each of the plurality of processing nodes; send advertised discovery packets advertising network port information to each of the other plurality of processing nodes; and receive and examine advertised discovery packets from each of the other plurality of processing nodes, the advertised discovery packets comprising an authentication code, wherein examining the advertised discovery packets comprises verifying the authentication code is compliant with the received key.