Network Device Port Trust Classification via Protocol Negotiation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Manual configuration of trusted and untrusted ports in network devices leads to incorrect configurations and increased workload, resulting in potential denial-of-service-like attacks due to shared ACL and CAR settings across multiple ports.
Innovation Solution
Automatically determine ports that succeed or fail in network protocol negotiation and set them as trusted or untrusted, respectively, using different ACLs and CARs to manage packet rates without manual intervention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual configuration is used to set trusted and untrusted ports, then port security can be established, but configuration workload increases and incorrect configurations may occur
Solution Approach 1:
The system automatically identifies and configures trusted and untrusted ports based on network protocol negotiation status without requiring manual intervention. The network device itself performs the configuration task that would otherwise require human operators, eliminating configuration workload and reducing human error.
Solution Approach 2:
The system performs preliminary automatic configuration of port trust status based on protocol negotiation outcomes before any potential attacks can occur. By pre-establishing correct trusted/untrusted port classifications through automated detection, the system ensures security is in place without manual configuration steps.
2Quantity of substance
If the same ACL and CAR are used for multiple ports to reduce hardware resources, then hardware resource usage decreases, but ports become vulnerable to DOS-like attacks
Solution Approach 1:
The system applies different ACL and CAR configurations to different ports based on their trusted/untrusted status. Instead of using a uniform configuration across all ports, each port receives customized security parameters appropriate to its function, allowing resource-efficient grouping while maintaining security differentiation.
Solution Approach 2:
The system segments ports into distinct groups (trusted and untrusted) with different security policies. This segmentation allows the network device to apply separate ACL and CAR settings to each group, reducing the need for individual port configurations while maintaining security isolation between port types.
3Ease of operation
If untrusted ports receive protocol packets with same CAR as trusted ports, then configuration simplicity increases, but trusted ports cannot process normal packets when untrusted ports are attacked
Solution Approach 1:
The system applies different CAR rate limits to trusted and untrusted ports based on their security classifications. Trusted ports receive higher rate limits appropriate for normal operations, while untrusted ports receive stricter limits to prevent abuse, ensuring each port type has locally optimized performance characteristics.
Solution Approach 2:
The system preemptively applies stricter CAR limits to untrusted ports before attacks can occur. By pre-configuring more restrictive rate limiting on untrusted ports based on their classification, the system prevents potential DOS attacks from affecting trusted port operations, maintaining productivity even under attack conditions.
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
A processing method and apparatus for preventing a packet attack. A network protocol negotiation status of a port of a network device is monitored; a port that succeeds in network protocol negotiation is set to a trusted port, a protocol packet is selected, according to a first access control list (ACL), from packets received by the trusted port, and a rate at which the protocol packet is sent to a central processing unit (CPU) is limited to a first committed access rate (CAR); a port that fails in network protocol negotiation is set to an untrusted port, a protocol packet is selected, according to a second ACL, from packets received by the untrusted port, and a rate at which the protocol packet is sent to the CPU is limited to a second CAR. Configuration accuracy of the trusted port and the untrusted port is improved, and a packet attack is prevented.