Secure Packet Tagging for Network Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network access control (NAC) methods lack effective secure packet tagging for endpoint-to-gateway and endpoint-to-endpoint communications, failing to address packet fragmentation and providing inadequate protection against IP-spoofing attacks while being incompatible with typical IPS/IDS devices.
Innovation Solution
The method utilizes a secure hash computed using a shared secret key, packet payload, IP protocol, and destination IP address, truncated into the identification field of IP packets, ensuring authentication and integrity by matching the hash value at the receiver, and protecting against brute-force attacks by verifying sequences of packets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If secure packet tagging is implemented using IPsec protocols (ESP or AH), then high-level protection against IP-spoofing attacks is achieved, but the form of packets is modified which prevents compatibility with typical IPS/IDS devices, application-level routers, and load balancers
Solution Approach 1:
The patent extracts the essential security function (authentication and integrity protection) from the IPsec protocol suite and implements it independently using only the identification field in the IP header. This separation allows security functionality to be achieved without modifying packet structure, thus maintaining compatibility with existing network devices while providing protection against IP-spoofing attacks
Solution Approach 2:
The patent introduces an intermediary mechanism (secure hash computation using identification field) that bridges the gap between security requirements and device compatibility. This intermediary layer provides authentication without requiring packet format changes, allowing existing IPS/IDS devices and application-level routers to function normally while security is enforced
2Device complexity
If a 16-bit identification field is used for secure hash tagging, then easy implementation and minimal overhead are achieved, but the short tag length makes the system vulnerable to brute-force attacks by rogue senders
Solution Approach 1:
The patent applies preliminary action by having the receiver detect and block suspicious senders before brute-force attacks can succeed. The system proactively monitors for sequences of packets with incorrect tags and pre-empts potential security breaches by blocking the sender, thus protecting against the inherent vulnerability of short tag lengths
Solution Approach 2:
The patent implements feedback mechanisms where the receiver monitors the sequence of packets from each sender and provides feedback by blocking senders that exhibit brute-force behavior. This closed-loop system continuously adapts to threats by learning from packet patterns and adjusting security responses accordingly
3Reliability
If fragmented packets are supported with hash computation on concatenated fragments, then complete integrity protection is achieved, but the receiver must collect and reassemble fragments before validation which increases processing time
Solution Approach 1:
The patent applies preliminary action by having the sender compute and attach the secure hash to fragmented packets before transmission. The identification field is populated with the hash value in advance, allowing the receiver to begin validation preparation immediately upon receiving fragments without waiting for complete reassembly, thus reducing processing time while maintaining integrity protection
Data Source
AI summary
Disclosed are methods, devices, and media for enforcing network access control, the method including the steps of: extracting a packet signature from a packet (or packet fragment) received from a network; storing the packet signature and the packet in a buffer; computing a buffer signature using a per-endpoint secret key; determining whether the packet signature and the buffer signature are identical; and upon determining the packet signature and the buffer signature are identical, transmitting the packet to a protocol stack. Preferably, the step of extracting includes extracting the packet signature from a field (e.g. identification field) of a header of the packet. Preferably, the method further includes the step of: upon determining the packet signature and the buffer signature are not identical, discarding the packet. Methods for receiving a packet from a protocol stack, and transmitting the packet to a network are disclosed as well.