Packet Transfer Apparatus Self-Origination Flag Spoofed Packet Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing packet transfer apparatuses face challenges in distinguishing own-apparatus-originated packets from other packets, particularly when spoofed packets are transmitted, and require a large number of ACL entries to filter out own-apparatus-originated packets, leading to inefficiencies and increased power consumption.
Innovation Solution
A packet transfer apparatus that includes a self-origination flag to identify own-apparatus-originated packets, using a ternary CAM and RAM to store flow entries with a self-origination flag, allowing for efficient flow control and spoofed packet identification without the need for numerous ACL entries.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If the IP address of the packet transfer apparatus is set in the ACL as the SIP to identify own-apparatus-originated packets, then the own-apparatus-originated packet can be identified, but spoofed packets with the same SIP cannot be distinguished
Solution Approach 1:
The invention segments the packet identification process into two independent parts: the packet transfer apparatus generates a unique identification value for itself and embeds it in outgoing packets, while receiving packets contain identification values from their respective sources. This segmentation allows the apparatus to compare identification values rather than relying solely on IP addresses, enabling distinction between legitimate and spoofed packets even when SIP is set to d.c.
2Ease of operation
If only own-apparatus-originated packets are allowed to pass through the CAM with filter control, then a large number of entries are required to exclude the own-apparatus-originated packet from filtering
Solution Approach 1:
The invention extracts the identification of own-apparatus-originated packets from the IP address field and places it in a dedicated identification value field. By doing so, the apparatus can exclude own-apparatus-originated packets using a single ACL entry with the identification value, rather than requiring multiple entries to cover all possible IP addresses. This extraction simplifies the flow control configuration and reduces CAM entry requirements.
3Productivity
If the same HW transfer path is allocated for own-apparatus-originated packets and other packets, then path utilization is improved, but the ability to distinguish own-apparatus-originated packets is lost when SIP is set to d.c.
Solution Approach 1:
The invention introduces an identification value as an intermediary element that mediates between the shared transfer path and packet distinction requirements. The identification value is embedded in packets and used by the flow control unit to distinguish own-apparatus-originated packets from other packets, even when they traverse the same hardware path. This intermediary enables both high path utilization and accurate packet distinction simultaneously.
Data Source
AI summary
It is provided a packet transfer apparatus comprising: a packet reception part; a packet transmission part; a packet generation part for generating an own-apparatus-originated packet serving as a packet for instructing a predetermined operation and outputting the own-apparatus-originated packet; a packet search part for determining a content of flow control and searching for an output circuit; a search memory for storing the content of the flow control and information for identifying the output circuit outputting the packet; and a packet transfer processing part. The packet reception part determines whether the received packet is the own-apparatus-originated packet; and outputs a self-origination flag indicating a result of the determining and header information of the received packet to the packet search part. The packet search part determines the content of the flow control for the received packet by referring to the search memory based on the self-origination flag and the header information.