Network Protection Entity for Malformed Packet Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network protection methods are inadequate in effectively defending against malformed data packets, particularly from fraud messages and network failures, as they often lead to processor overload and connection interruptions due to flooding attacks, which can collapse networks.
Innovation Solution
A network protection entity that checks OSI-L3 and OSI-L7 information in parallel by mirroring incoming data streams to monitor traffic and detect abnormalities, allowing for efficient discrimination between real and malformed data packets without adding delay, using standardized Layer 3 and Layer 7 information to identify and discard malicious packets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If firewalls, load balancers, and control lists are used to defend against attacks, then network security is improved, but the processor becomes overloaded and the network collapses under flooding attacks
Solution Approach 1:
The patent divides the network protection function into two separate components: a gateway/router that handles routing decisions based on OSI-L3 information, and a network protection entity that performs security checks based on OSI-L7 information. This segmentation allows the routing function to remain fast and simple while the protection function handles complex security analysis, preventing processor overload.
Solution Approach 2:
The patent introduces a network protection entity as an intermediary component between the gateway/router and the network. This entity receives copies of data packets, performs security checks independently, and communicates with the gateway/router only when abnormalities are detected. This intermediary approach allows the main routing processor to remain lightweight while security checks are performed separately.
2Measurement precision
If parallel checking of OSI-L3 and OSI-L7 information is performed, then detection precision is improved, but device complexity increases
Solution Approach 1:
The patent segments the information checking process into two distinct stages: first, the gateway/router checks OSI-L3 routing information to determine basic packet forwarding; second, the network protection entity checks OSI-L7 application layer information for security abnormalities. This segmentation enables comprehensive detection without requiring a single complex system to handle all checks simultaneously.
Solution Approach 2:
The patent implements parallel checking by creating a copy of the data packet stream and directing it to the network protection entity, which independently analyzes OSI-L7 information while the original stream continues through the gateway/router for OSI-L3 processing. This copying approach enables simultaneous multi-layer checking without requiring complex integration of checking functions.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The disclosure relates to a network protection entity (203) for protecting a communication network against malformed data packets, the network protection entity (203) comprising: an interface (205) to a network entity (201) within the communication network, wherein the network entity (201) is configured to transfer a stream of data packets (202) entering the network entity (201) based on network address information (206) comprised in the data packets (202); a memory (207) configured to temporarily store the network address information (206) together with application information (208) comprised in the data packets (202), wherein the application information (208) indicates application and support protocols for communication via the communication network; and a processor (209) configured to detect an abnormality in the stream of data packets (202) based on checking a relation between the application information (208) and the network address information (206) of the data packets (202); and if an abnormality is detected to transmit information about the abnormality (210) to the network entity (201) for discarding data packets (202) showing the abnormality.