Source Routing Authorization for Spoof-Resistant Network Paths
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authorization mechanisms in computer networks are vulnerable to spoofing and manipulation, particularly in InfiniBand networks, as they rely on configurable routing tables that can be easily altered by malicious entities, and do not effectively secure traffic based on the actual physical path of packets.
Innovation Solution
Implementing a source routing-based authorization mechanism that verifies the physical path of packets through an ordered list of network component ports, allowing or blocking packets based on predefined rules and actual routing paths rather than traditional packet fields.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional routing tables are used for authorization, then routing flexibility is improved, but security against spoofing and manipulation deteriorates
Solution Approach 1:
The patent applies preliminary action by pre-defining authorized routing paths in the network before packets are transmitted. Network devices are configured with specific routing paths that packets must follow, and authorization decisions are made based on whether the packet's actual path matches the pre-defined authorized path. This prevents spoofing because the authorization is established beforehand based on physical path characteristics rather than configurable routing tables that can be manipulated.
2Ease of operation
If configurable routing tables are used, then ease of routing management is improved, but vulnerability to manipulation worsens
Solution Approach 1:
The patent introduces an intermediary mechanism - the source routing path information embedded in packets and verified by network devices - that mediates between routing management and security. Instead of relying solely on configurable routing tables that can be manipulated, the system uses the packet's source routing path as an intermediary verification layer. Network devices check whether the packet's declared path matches the authorized path, creating a security barrier that is independent of routing table configurations.
3Reliability
If source routing paths are verified for authorization, then network security is improved, but processing complexity worsens
Solution Approach 1:
The patent applies self-service by having the source node itself responsible for defining and embedding the authorized routing path in the packet headers. The source node generates the source routing path information based on pre-configured authorization policies and includes it in the packet. Network devices along the path then simply verify whether the packet's path matches the embedded source routing path, rather than each device performing complex authorization decisions. This distributes the processing burden and simplifies individual device operations.
Data Source
AI summary
A system and method for restricting traffic in a computer network, the method may include extracting a routing path of a packet, and determining whether to allow or block the packet based on the routing path.