Reverse Path Forwarding Router Interface Bundle Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Unicast Reverse-Path Forwarding (uRPF) technologies face challenges in distinguishing between valid and spoofed packets, leading to the unintended dropping of legitimate packets when strict criteria are applied, and offer insufficient protection when loose criteria are used, especially in networks with numerous interfaces.
Innovation Solution
A routing device is configured with a validity module that determines whether a received packet is valid by comparing the interface it was received on with a bundle of acceptable interfaces associated with the packet's source, allowing for a middle ground between strict and loose uRPF modes by considering multiple but not all interfaces as valid paths.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If strict uRPF criteria are applied to block packet spoofing, then protection against spoofing is improved, but legitimate packets are dropped
Solution Approach 1:
The patent segments the interface validation process by dividing interfaces into bundles associated with specific sources. Instead of applying a uniform strict check to all interfaces, the system creates multiple interface bundles (e.g., bundle1, bundle2) where each bundle contains interfaces that are acceptable for receiving packets from a particular source. This segmentation allows the router to apply differentiated validation rules, reducing false positives while maintaining security.
Solution Approach 2:
The patent changes the validation parameter from a binary strict/loose mode to a configurable bundle-based approach. By modifying the uRPF check to reference interface bundles rather than individual interfaces or all interfaces, the system adjusts the validation stringency dynamically based on source-specific configurations. This parameter change enables flexible control over the trade-off between security and packet throughput.
2Productivity
If loose uRPF criteria are used to allow more packets through, then packet forwarding is improved, but protection against spoofing is reduced
Solution Approach 1:
The patent applies local quality by making uRPF validation source-specific rather than uniform across all sources. Each source can have its own interface bundle configuration, allowing the system to apply different levels of strictness locally. For example, trusted sources can have more permissive bundle configurations while maintaining strict validation for other sources, achieving both high forwarding rates for legitimate traffic and strong protection for suspicious traffic.
3Productivity
If all interfaces are considered acceptable for any source, then packet forwarding is improved, but security against spoofing is weakened
Solution Approach 1:
The patent segments the interface space into source-specific bundles, creating a many-to-many relationship between sources and interfaces. Instead of a single bundle containing all interfaces for all sources, the system creates multiple segmented bundles (bundle1, bundle2, etc.) where each bundle is associated with specific sources and contains only the interfaces acceptable for those sources. This segmentation prevents spoofing by ensuring that packets from any source are only accepted on interfaces that are explicitly included in that source's bundle.
Data Source
AI summary
An apparatus configured to route packets over networks may be configured to determine whether a packet is valid prior to routing a received packet. The apparatus may receive the packet on one of a plurality of interfaces. The apparatus may identify the interface on which the packet is received and also a source of the packet. Additionally, the apparatus may access a bundle of acceptable interfaces on which a packet from the source may be received. The number of acceptable interfaces may be greater than a single interface, but less that all of the interfaces of the apparatus configured to receive packets from over the networks. If the interface on which the packet is received is an acceptable interface identified by the bundle, then the packet is valid and routed to a next location. Otherwise, the packet is determined to be invalid and dropped.