Packet Filtering in Multiple Forwarding Information Base Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing multiple forwarding information base (MFIB) systems face challenges in securely filtering network packets across different perimeters within a virtual private network (VPN), particularly in preventing split tunneling and ensuring that packets are routed through secure channels, as they lack effective mechanisms to manage access based on the presence of binding and IPsec interfaces across various perimeters.
Innovation Solution
The implementation of a method that determines the binding interface and IPsec interface for a communication session within a VPN tunnel, filtering packets to prevent direct access when they are in different perimeters and allowing routing when access conditions align with security policies, thereby preventing split tunneling and ensuring secure packet routing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If packets are routed directly to the binding interface without filtering, then routing efficiency is improved, but security is compromised due to potential split tunneling
Solution Approach 1:
The patent introduces a packet filtering mechanism as an intermediary between the routing decision and the actual packet forwarding. The filter checks whether packets should be routed directly to the binding interface or forced through the IPsec interface by comparing the binding interface's perimeter with the packet's source perimeter, thereby maintaining both routing efficiency and security.
2Reliability
If packet filtering is implemented to prevent split tunneling, then security is improved, but routing complexity increases
Solution Approach 1:
The patent applies local quality by making the filtering behavior context-dependent rather than uniform. The filter only activates when specific conditions are met (binding interface in one perimeter, packet source in another perimeter), allowing direct routing in safe cases and filtered routing in potentially risky cases, thus minimizing unnecessary complexity.
3Reliability
If packets from personal perimeter are filtered when binding interface is in enterprise perimeter, then policy compliance is improved, but network functionality may be restricted
Solution Approach 1:
The patent implements dynamic filtering that adapts to the specific configuration of perimeters and interfaces. The filter dynamically determines whether to block or allow direct routing based on the relationship between the binding interface's perimeter and the packet source's perimeter, enabling policy compliance while preserving necessary network functionality.
Data Source
AI summary
In some implementations, a method for routing communication includes determining a binding interface for a communication session based on a forwarding information base (FIB) and a destination for the communication session. The communication session is from an application running on user equipment (UE), and the binding interface is included in a virtual private network (VPN) tunnel established through an Internet Protocol (IP) security (IPsec) interface. Whether to filter the communication session is determined based on which perimeter of the UE includes the binding interface and which perimeter of the UE includes the IPsec interface.