Pre-IP Packet Redirection for Network Security Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computers in a network cannot scan for malicious content in pre-IP packets generated before complete initialization of the networking stack, and antivirus enforcement policies at the switch level prevent these packets from being transmitted, hindering the boot-up process.
Innovation Solution
A Data Packet Detour Driver (DPDD) modifies pre-IP packets to redirect them to a packet relay server for scanning and processing before forwarding to the intended destination, allowing for virus scanning and compliance validation before the networking stack is fully initialized.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If antivirus enforcement policies are implemented at the switch level, then security scanning is improved, but packet transmission is blocked for pre-IP packets
Solution Approach 1:
A packet relay server is introduced as an intermediary component between the client computer and the network. The relay server receives pre-IP packets from the client before they reach the switch, scans them for viruses, and only forwards clean packets to the switch. This mediator approach allows security scanning to occur at the appropriate time without blocking legitimate packet transmission.
Solution Approach 2:
The packet relay server performs virus scanning as a preliminary action before packets reach the switch's antivirus enforcement policies. By scanning packets in advance and filtering out malicious content beforehand, the system enables security inspection without interfering with the normal packet transmission process that occurs after initialization.
2Productivity
If pre-IP packets are transmitted before networking stack initialization, then boot-up process is improved, but security scanning capability is lost
Solution Approach 1:
The packet relay server acts as an intermediary that bridges the gap between the uninitialization state and the secured network. It receives packets from the client during boot-up before the networking stack is fully initialized, performs security scanning, and forwards approved packets to the switch. This resolves the contradiction by enabling both early transmission and security scanning.
Solution Approach 2:
The relay server performs security scanning as a preliminary action during the boot-up process, before packets reach the switch. This preliminary scanning capability is established independently of the client's networking stack initialization state, allowing security inspection to occur at the appropriate time during boot-up without requiring the client's networking stack to be fully initialized.
3Reliability
If packets are scanned for viruses, then security is improved, but transmission time is increased
Solution Approach 1:
The packet relay server is positioned strategically in the network path to perform scanning as an intermediary function. By consolidating the scanning operation at this dedicated relay point, the system achieves thorough virus scanning while minimizing the time impact on overall packet transmission, as the relay server handles scanning efficiently and forwards approved packets quickly.
Data Source
AI summary
In one embodiment, a technique for controlling traffic in a computer network includes modifying a packet generated by a first computer. The packet may be intended for a second computer, but is modified to be redirected to a third computer. The packet may be processed in the third computer prior to being forwarded from the third computer to the second computer. The packet may be scanned for viruses at the third computer, for example. Among other advantages, the technique allows for scanning of early generated packets, redirection of selected packets, and routing of packets from a computer in general.