SRv6 Packet Processing Bypassing Hash Checks for Security

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current SRv6-TE policies face performance losses due to hash checking in segment routing headers, and are vulnerable to source address spoofing attacks that allow hackers to perform free traffic forwarding.

Innovation Solution

A method and apparatus for processing SRv6 packets by replacing the source address in the outer header with a pre-formulated segment identifier (SID) and checking if the routing information for this SID is present in a forwarding table, thereby ensuring only authorized SIDs can forward packets.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If hash checking is performed on SRH using key information assigned to network devices, then packet security can be verified, but forwarding performance deteriorates significantly

Engineering Contradiction:

Improvepacket security verificationVSAvoidforwarding performance

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent extracts the hash verification function from the network device forwarding path and relocates it to the ingress network device only. The ingress device computes hash values of SRH and compares them with carried hash values, while downstream network devices simply forward packets without verification overhead, thus resolving the performance bottleneck while maintaining security

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent performs hash computation and verification in advance at the ingress network device before packets enter the forwarding path. By pre-computing hash values and verifying them upfront, the system eliminates the need for repeated verification at each network device, thereby improving overall forwarding performance while ensuring packet integrity

Inventive Principle:

Principle #10Preliminary action

2Adaptability or versatility

If BSID is used for traffic engineering in SRv6-TE policy, then network path resources become accessible, but the system becomes vulnerable to source address spoofing attacks

Engineering Contradiction:

Improvenetwork path resource accessibilityVSAvoidsource address spoofing vulnerability

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The patent applies preliminary anti-action by pre-computing hash values of SRH at the ingress network device and carrying them in the packet. This pre-established verification mechanism prevents source address spoofing attacks before they can affect the network, while still allowing BSID-based traffic engineering functionality to operate normally

Inventive Principle:

Principle #9Preliminary anti-action

Solution Approach 2:

The patent introduces hash values as an intermediary verification mechanism between the source address and the trusted address database. Instead of directly trusting or rejecting packets based on source addresses alone, the system uses hash verification as a mediator to authenticate packets, thereby preventing spoofing attacks while maintaining BSID traffic engineering capabilities

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS20250202936A1Srv6 packet processing method, apparatus, communication device and storage medium

Publication Date: 2025.06.19 CHINA MOBILE COMM GRP CO LTD

AI summary

Disclosed are an SRv6 message processing method and apparatus, a communication device, and a storage medium. The method comprises: a user side equipment setting a source address in an outer layer message header in a first SRv6 message as a first segment identifier (SID) on the basis of a pre-obtained first SID used for representing an address, and generating a second SRv6 message, where the first SID is pre-planned by a network service provider; and sending the second SRv6 message to a network device.