Router Packet Filtering for DoS Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current solutions for protecting IPsec tunnels from denial of service (DoS) and distributed denial of service (DDoS) attacks are costly, inefficient, and difficult to scale, as they rely on brute force analysis of all packets, which can lead to false positives and negatives, and require overprovisioning for maximum attack scenarios, making them economically unsustainable for frequent smaller attacks.
Innovation Solution
A method that uses a protection parameter included in packet fields, such as the destination IPv6 address, to filter out unauthorized traffic by routers, allowing only packets with the expected parameter to be routed to client nodes, thereby preventing DoS and DDoS attacks by dynamically adjusting the parameter and distributing the filtering load across neighboring routers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If brute force analysis of all packets is used to distinguish legitimate traffic from DDoS traffic, then protection capability is improved, but device complexity and cost increase significantly
Solution Approach 1:
The patent extracts a specific protection parameter from packet fields (such as destination IPv6 address) and uses it as a filtering criterion. Instead of analyzing all packets comprehensively, the system extracts and checks only the relevant protection parameter, significantly reducing analysis complexity while maintaining protection capability.
Solution Approach 2:
The patent changes the approach from comprehensive packet analysis to parameter-based filtering. By dynamically adjusting the protection parameter values and using them as filtering criteria, the system achieves effective protection with much lower computational complexity compared to brute force analysis of all packet characteristics.
2Reliability
If protection equipment is sized for the largest possible attack, then reliability against maximum attacks is improved, but cost increases and becomes difficult to amortize
Solution Approach 1:
The patent implements dynamic adjustment of protection parameters based on actual attack conditions. The protection capacity can be scaled and adapted in real-time according to the severity and nature of attacks, allowing the system to handle maximum attacks when necessary while reducing resources during normal operation, thus avoiding the need for permanent overprovisioning.
Solution Approach 2:
The system dynamically changes protection parameter values based on attack patterns and conditions. This allows the protection capacity to be adjusted flexibly - scaling up for major attacks and scaling down for routine protection needs, making the protection infrastructure economically sustainable while maintaining reliability.
3Ease of operation
If heuristics from previous attacks are used to distinguish legitimate packets from attack packets, then ease of operation is improved, but measurement precision decreases leading to false positives and negatives
Solution Approach 1:
The patent applies preliminary action by pre-configuring protection parameter values that are embedded in packet fields before transmission. These pre-established parameters serve as authoritative filtering criteria, eliminating the need for complex heuristic analysis during packet processing while maintaining high accuracy in distinguishing legitimate from malicious traffic.
Data Source
Figure 1
Figure 2~3
AI summary
The invention relates to a method for protecting a stream (F1) of packets in a network (N1) composed of packet router nodes (R1-R4), and stream transmitter and receiver nodes (C1-C3), the receiver node (C3) being connected to a router node (R3) handling the routing of a packet to the receiver node according to an expected value of a protection parameter included in at least one field of a packet of the stream, the method being implemented by a device associated with the receiver node (C3) and comprising: transmitting to the router node (R3) connected to the receiver node (C3) a message comprising the expected value of the protection parameter. The invention further relates to a method for filtering a stream (F2) of packets, the method being implemented by the router node (R3) connected to the receiver node (C3) and comprising: receiving from a device associated with the receiver node (C3) a message comprising the expected value of the protection parameter; and filtering the packets not comprising the expected value of the protection parameter.