Packet Filter Fragment Tracking for Network Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional packet-filtering systems in network devices are unable to effectively detect and discard fragmented malicious packets, leading to increased workload and potential security threats as they forward incomplete packet fragments to processing units.
Innovation Solution
A method and system that flag and discard packet fragments by determining if they are part of a set of related packets, using a packet filter to dynamically generate and implement rules to detect and discard remaining fragments before they reach the routing or forwarding engine, thereby preventing unnecessary processing and potential security risks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a conventional packet filter forwards packet fragments without the malicious characteristic to a processing unit, then the processing unit can potentially handle legitimate packets, but the workload of the network device increases unnecessarily and security threats are exposed
Solution Approach 1:
The patent applies preliminary action by performing packet fragment tracking and identification at the packet filter stage before packets reach the processing unit. The system proactively identifies fragments of malicious packets using tracking data structures that record fragment characteristics, and discards them in advance, preventing unnecessary processing workload while maintaining security detection accuracy
Solution Approach 2:
The patent introduces an intermediary mechanism between the packet filter and processing unit through tracking data structures. These structures serve as a mediator that stores fragment identification information, allowing the packet filter to efficiently recognize and discard malicious fragments without requiring the processing unit to analyze each fragment, thus reducing workload while maintaining security
2Reliability
If a packet filter discards all packet fragments to prevent security threats, then security is improved, but legitimate fragmented packets are also discarded causing loss of information
Solution Approach 1:
The patent applies segmentation by dividing packet filtering into distinct stages: fragment identification using tracking data structures, malicious fragment detection, and selective discarding. This segmented approach allows the system to differentiate between malicious and legitimate fragments, discarding only harmful ones while preserving legitimate packet data, thus maintaining both security and information integrity
Solution Approach 2:
The patent applies local quality by implementing differential treatment of packet fragments based on their specific characteristics. The tracking data structures enable the packet filter to identify fragments with malicious characteristics and discard them locally, while allowing fragments without malicious characteristics to proceed to the processing unit, thus providing targeted security protection without unnecessary data loss
3Measurement precision
If a packet filter monitors and tracks all incoming packets to identify fragmented malicious packets, then detection precision is improved, but device complexity increases
Solution Approach 1:
The patent applies preliminary action by pre-establishing tracking data structures that store fragment identification information before packets arrive. This preliminary setup enables the packet filter to quickly match incoming fragments against stored characteristics without complex real-time analysis, improving detection precision while minimizing the increase in device complexity
Solution Approach 2:
The patent applies copying by creating simplified copies of fragment characteristics in tracking data structures. Instead of analyzing complete complex packets, the system copies and stores essential identification features (such as source/destination addresses, ports, and fragment offsets), enabling efficient matching and detection with reduced computational complexity
Data Source
AI summary
The disclosed apparatus may include (1) flagging, at a packet filter within a network device, a packet to be discarded instead of passed to a processing unit within the network device, (2) determining that the packet is part of a set of related packets that includes at least one additional packet destined at least intermediately for the network device, (3) identifying, by monitoring incoming packets received at the packet filter, the additional packet within the set of related packets, and then (4) discarding, due to the additional packet being included within the set of related packets, the additional packet instead of passing the additional packet to the processing unit. Various other apparatuses, systems, and methods are also disclosed.