Server-Based Multicast Service Announcement Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computer networks, particularly IoT networks, face vulnerabilities due to fake multicast service announcements that cannot be effectively filtered out by existing technologies, leading to potential security risks and network instability.
Innovation Solution
A server authenticates devices and determines the authenticity of service announcements by comparing them to pre-configured filter criteria or analyzing traffic patterns, redistributing only authentic announcements within the network, using a combination of AAA components and service analytics to prevent fake service announcements from being redistributed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If mDNS protocol is used for service announcements in IoT networks, then service discovery capability is improved, but network security deteriorates due to fake service announcements
Solution Approach 1:
The patent introduces a server as an intermediary component between devices and the mDNS protocol. This server receives service announcements from devices, authenticates them against a database of authorized services, and only redistributes authentic announcements throughout the network. This intermediary approach allows the network to maintain service discovery capabilities while filtering out fake or unauthorized service announcements, thereby resolving the security vulnerability introduced by unfiltered mDNS traffic.
2Reliability
If service announcements are authenticated and filtered, then network security is improved, but device complexity increases due to additional authentication mechanisms
Solution Approach 1:
The patent implements self-service authentication where devices automatically provide identifying information (such as device identifiers or certificates) when announcing services. The server automatically authenticates these announcements against stored authorized service information without requiring manual configuration or complex authentication protocols on the client devices. This approach maintains security through automated verification while keeping device complexity low, as devices simply need to include their identifying information in the service announcement.
3Reliability
If fake service announcements are restricted, then service integrity is improved, but network stability deteriorates due to potential legitimate service disruptions
Solution Approach 1:
The patent employs preliminary action by pre-storing authorized service information in a database before any service announcements are processed. When devices send service announcements, the server compares these announcements against the pre-existing database of authorized services. This preliminary preparation allows the system to quickly and accurately identify authentic services, reducing the risk of blocking legitimate services while filtering out fake ones, thus maintaining network stability while ensuring service integrity.
Data Source
AI summary
In one embodiment, a server receives an authentication request from a device in a computer network, and authenticates the device. Then, upon receiving a service announcement from the authenticated device, the server determines authenticity of the service announcement from the authenticated device, and redistributes the service announcement into the computer network only when the service announcement from the authenticated device is an authentic service announcement.