Packet Processing for Network Security via Table Entry Removal
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Firewall devices face a security risk due to the lack of attack detection on packets with existing table entries in fast forwarding tables, which can be exploited by attackers, leading to potential network threats.
Innovation Solution
Implementing a packet processing method that performs potential-attack detection by counting identical packet information within a preset duration, removing table entries if the packet count exceeds a threshold, and subsequently conducting attack detection to prevent direct forwarding and reduce security risks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If fast forwarding function is enabled to improve packet forwarding efficiency, then forwarding speed is improved, but security risk increases due to lack of attack detection on packets with existing table entries
Solution Approach 1:
The system performs preliminary attack detection on the first packet of a service before adding it to the fast forwarding table. This preliminary action ensures that malicious packets are identified and blocked before they can exploit the fast forwarding function, thus resolving the contradiction between forwarding efficiency and security.
Solution Approach 2:
The packet processing is segmented into two paths: one for packets with table entries (fast forwarding) and one for packets without table entries (attack detection). This segmentation allows the system to maintain high forwarding efficiency for legitimate traffic while performing thorough security checks on new service packets.
2Object-affected harmful factors
If attack detection is performed on all packets, then security is improved, but forwarding efficiency decreases due to additional processing time
Solution Approach 1:
The system segments packet processing into two categories: packets with fast forwarding table entries are forwarded directly without attack detection, while packets without entries undergo attack detection. This segmentation ensures that security checks are performed only when necessary, maintaining both security and forwarding efficiency.
Solution Approach 2:
Instead of performing attack detection on all packets, the system performs detection only on packets that are the first of a service (those without table entries). This partial action approach provides sufficient security coverage while avoiding unnecessary processing overhead on legitimate traffic.
3Speed
If fast forwarding table is used to speed up packet processing, then forwarding speed is improved, but the ability to detect attacks on subsequent packets is lost
Solution Approach 1:
The system performs attack detection as a preliminary action before packets are added to the fast forwarding table. By detecting attacks in advance on the first packet of each service, the system ensures that subsequent packets can be safely forwarded at high speed without compromising security detection capability.
Data Source
AI summary
Disclosed are a packet processing method and apparatus applicable to a network device. The method comprises: receiving a first packet; determining the number of second packets received within a preset duration after the first packet passes basic detection successfully, wherein packet information of the second packet is identical to first packet information of the first packet; determining whether the number of the second packets received is greater than a preset number threshold; if so, removing a first table entry from a fast forwarding table, wherein the first table entry contains second packet information of the first packet; and performing attack detection on the first packet. With the application of the technical solution provided by an example of the present disclosure, the security risk in a network device is efficiently reduced.