Security Table Entries for Source Prefix Validation in Network Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Attacks in communication networks where attackers forge source addresses to disrupt legitimate services, steal resources, or hide their identity, making it difficult to trace illegitimate network activities.
Innovation Solution
A method and apparatus for generating a security table entry in network devices that acquire link state information from a database to validate incoming packets based on source prefixes, creating a security table entry that identifies and intercepts packets with forged source addresses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network devices forward packets based on destination address only, then packet forwarding is simple and fast, but network security is compromised due to source address forgery attacks
Solution Approach 1:
The patent applies preliminary action by pre-calculating and storing security table entries that map source prefixes to incoming interfaces before packets arrive. When a packet needs security validation, the device simply looks up the source prefix in the pre-built security table to determine the expected incoming interface, avoiding complex real-time path calculations and enabling fast security verification without adding significant forwarding complexity
Solution Approach 2:
The patent introduces an intermediary security table that acts as a mediator between the simple destination-based forwarding and complex security validation requirements. The security table stores pre-computed mappings of source prefixes to incoming interfaces, serving as an intermediary data structure that enables fast security checks without requiring complex real-time analysis of network topology or packet paths
2Reliability
If network devices implement source address validation, then network security improves, but processing time and computational resources increase
Solution Approach 1:
The patent applies preliminary action by pre-calculating security table entries during link state updates or topology changes, so that when packets arrive, the validation process is reduced to a simple table lookup comparing the packet's source prefix against pre-stored mappings. This eliminates the need for complex real-time path calculations and significantly reduces packet processing time
Solution Approach 2:
The patent uses simple data structures (security table entries with source prefix and incoming interface mappings) that are inexpensive to store and access. These entries are regenerated when topology changes occur, accepting periodic reconstruction of the security table in exchange for maintaining fast, simple validation operations during normal packet processing
3Measurement precision
If security table entries are updated in real-time with network topology changes, then security accuracy improves, but system complexity and update overhead increase
Solution Approach 1:
The patent implements feedback by monitoring link state information and topology changes from the routing protocol, and using this feedback to trigger updates of the security table entries. When the routing protocol advertises new link state information indicating topology changes, the system automatically recalculates and updates the security table to reflect current network paths, ensuring security accuracy without requiring manual intervention or complex update mechanisms
Solution Approach 2:
The security table update mechanism is self-service, automatically triggered by link state information from the routing protocol without requiring external management or complex coordination. The system monitors routing updates and autonomously regenerates security table entries when topology changes are detected, reducing the need for manual configuration or complex update orchestration
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
The present application relates to the technical field of network communications, and provides a security table entry generation method and apparatus, a network device, and a storage medium. The method comprises: acquiring target link state information from a link state database, the target link state information comprising a first source prefix; and generating a security table entry for an ingress interface, the security table entry comprising the identifier of the ingress interface and the first source prefix. The present application can improve the network security.