Router Tag Verification for Unauthorized Packet Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Public IP networks lack mechanisms to prevent unwanted data packets from being routed to receivers, leading to issues like flooding, spamming, and Denial-of-Service threats due to insufficient security support in the current routing architecture.
Innovation Solution
Implementing a method and apparatus in routers that use tag derivation functions to control data packet transmission by matching ingress tags with forwarding table entries, discarding packets without matching entries, and creating egress tags for secure forwarding, while registering destination keys and distributing router keys to secure the routing process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional IP routing architecture is used, then network connectivity and routing flexibility are maintained, but security against unwanted data packets is insufficient
Solution Approach 1:
The patent segments the routing architecture by introducing separate key management and tag verification components. The routing function is divided into: (1) key distribution through DNS servers, (2) tag generation at source hosts, (3) tag verification at router ingress points, and (4) forwarding based on verified tags. This segmentation allows security functions to be added without fundamentally redesigning the entire routing architecture.
Solution Approach 2:
The patent introduces cryptographic tags as an intermediary mechanism between traditional IP addressing and routing decisions. These tags act as mediators that carry security information without replacing the existing IP header structure. The tags are verified by routers using cryptographic keys obtained through DNS queries, serving as an intermediary security layer that works alongside existing routing protocols.
2Reliability
If tag verification is performed at every router, then security against unauthorized packets is improved, but processing overhead and latency increase
Solution Approach 1:
The patent applies preliminary action by having source hosts generate cryptographic tags before packet transmission and by having routers pre-obtain verification keys through DNS queries before packet arrival. The tags are computed in advance using the source host's private key, and routers can verify these tags using publicly available keys from DNS, eliminating the need for complex real-time key exchange or authentication negotiations during packet forwarding.
Solution Approach 2:
The verification mechanism is self-service in that routers can autonomously obtain verification keys through standard DNS queries without requiring manual configuration or interaction with key management servers. The cryptographic tags are self-verified through mathematical validation using public keys, eliminating the need for trusted third-party authentication during the forwarding process.
3Reliability
If cryptographic tags are added to packets, then security and authorization control are enhanced, but packet size and network overhead increase
Solution Approach 1:
The patent applies local quality by adding cryptographic tags only where needed in the packet structure, specifically as additional fields in the IP header or as separate metadata structures. The tags are localized to the necessary security verification points rather than encrypting or modifying the entire packet payload. This allows security functionality to be added with minimal impact on overall packet size.
Solution Approach 2:
The cryptographic tags are designed as lightweight, disposable security elements that can be quickly generated, verified, and discarded. Each tag is a relatively small cryptographic structure (compared to full packet encryption) that serves its security purpose and is then discarded at the destination, avoiding the need for complex long-term key management or persistent security state.
4Adaptability or versatility
If DNS system is used for key distribution, then existing infrastructure is leveraged, but DNS security and key management complexity increase
Solution Approach 1:
The patent applies universality by making the DNS server perform multiple functions: it continues to provide traditional domain name resolution services while also serving as a key distribution point for cryptographic verification. The same DNS infrastructure that resolves hostnames now also distributes public keys and routing information, eliminating the need for separate key management servers and leveraging existing widely-deployed DNS infrastructure.
Solution Approach 2:
The patent merges key distribution functionality with existing DNS query and response mechanisms. Instead of creating a separate key management protocol or server system, the cryptographic keys and routing information are integrated into standard DNS response messages. This combining approach allows key distribution to occur through the same channels already used for address resolution, reducing infrastructure complexity.
Data Source
AI summary
Method and apparatus for controlling transmission of data packets in a packet-switched network. When a first end-host (A) sends an address query to a DNS system (300) for a second end-host, the DNS system responds by providing a sender key created from a destination key registered for the second end-host, if the first end-host is authorized to send packets to the second end-host. Thereby, the first end-host, if authorized, is able to get across data packets to the second end-host by attaching a sender tag (TAG) generated from the sender key, as ingress tag to each transmitted data packet. A router (302) in the network matches an ingress tag in a received packet with entries in a forwarding table and sends out the packet on an output port (X) according to a matching entry. Otherwise, the router discards the packet if no matching entry is found in the table.