Tunnel Routing Loop Attack Defense in IPv6-IPv4 Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
IPv6-in-IPv4 automatic tunnels are vulnerable to routing loop attacks, which can lead to network slowdowns or crashes, and existing mitigation measures either impose network topology limitations or incur significant router overhead.
Innovation Solution
A system and method that detect tunnel routing loop attacks by adding a tunnel routing attack (TRLA) header to IPv6 packets, encapsulating them in IPv4 packets, and dropping packets that indicate a loop by matching address information in the TRLA header with the destination address, thereby preventing loop formation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If automatic tunnels are used to allow IPv6 packets to be sent over IPv4 networks, then interoperability between IPv6 and IPv4 is improved, but the network becomes vulnerable to routing loop attacks
Solution Approach 1:
The patent applies preliminary action by inserting a TRLA header into IPv6 packets before they are encapsulated and sent through automatic tunnels. This header contains the tunnel destination address, enabling routers to detect routing loops in advance by comparing the TRLA header's destination address with the actual tunnel destination. The preventive measure is implemented before the attack can propagate, rather than reacting after the loop is formed.
2Reliability
If conventional loop detection methods are used that rely on Hop Limit field decrementing to zero, then routing loops are eventually terminated, but network bandwidth is consumed and DoS attacks are facilitated
Solution Approach 1:
The patent implements feedback by having routers check the TRLA header's destination address against the actual tunnel destination address at each routing decision point. This continuous feedback mechanism allows routers to immediately identify and drop packets that would create or continue routing loops, preventing bandwidth consumption. The feedback loop operates at each router along the path, enabling early detection and termination before significant network resources are wasted.
3Reliability
If existing mitigation measures are implemented to prevent routing loop attacks, then network security is improved, but network topology limitations are imposed or significant router overhead is incurred
Solution Approach 1:
The patent applies the taking out principle by extracting the tunnel destination address information into a separate TRLA header that can be independently processed and compared. This extraction allows routers to perform simple address matching operations rather than complex state maintenance or topology analysis. The TRLA header contains only the essential destination address information needed for loop detection, reducing the processing overhead at each router while maintaining security.
Data Source
AI summary
The present disclosure relates to systems, methods, and non-transitory computer readable storage medium for detecting a tunnel routing loop attack on a computer network. A method of the presently claimed invention receives a packet of data over an automatic tunnel. When the received packet includes an Internet protocol version 6 (IPv6) packet headers in the received packet may be extracted from the received packet. When an extracted header is a tunnel routing loop attack (TRLA) header, address information included in the TRLA header may be matched to a destination address that the IPv6 packet is about to be tunneled through. When the address information included in the TRLA header matches the destination address that the IPv6 packet is about to be tunneled through the IPv6 packet is dropped because the match indicates that that a loop is about to be formed.