UDP Probe Port Hashing for Spoofed Packet Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Spoofing attacks using User Datagram Protocol (UDP) packets are prevalent due to the connectionless nature of the protocol, making it difficult to distinguish between legitimate and malicious packets, leading to computational burdens and inaccurate information.
Innovation Solution
A method involving a UDP scanner that generates probe packets with a lossy hash function, using ephemeral port numbers and random seeds to identify spoofed packets by comparing hash values with response packets, thereby reducing computational resources and improving accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional UDP packet scanning is performed without spoofing detection, then scanning coverage is maintained, but computational resources are wasted processing spoofed packets and accuracy decreases
Solution Approach 1:
The patent applies preliminary action by generating a lossy hash value from the probe packet's source address, destination address, and destination port before transmission. This pre-computed hash is then used to quickly verify response packets, allowing the system to identify and filter spoofed packets before full processing occurs, thus saving computational resources while maintaining accuracy
Solution Approach 2:
The patent introduces a lossy hash function as an intermediary mechanism between packet transmission and verification. This hash function creates a condensed representation (intermediary) of packet identifying information that can be efficiently compared against response packets, reducing the computational burden of direct packet comparison while maintaining sufficient accuracy for spoofing detection
2Productivity
If spoofed UDP packets are not filtered, then all packets are processed, but system performance degrades due to computational burden
Solution Approach 1:
The patent extracts the essential identifying information from UDP packets (source address, destination address, destination port) and processes only this extracted data through the lossy hash function. This extraction approach allows the system to filter out spoofed packets based on hash mismatches without performing full packet processing, thereby improving scanning efficiency while reducing computational load from processing entire packets
3Speed
If connectionless UDP protocol is used, then transmission speed is improved, but security against spoofing deteriorates
Solution Approach 1:
The patent implements feedback by comparing the lossy hash value computed from received response packets against the pre-computed hash value from the original probe packet. This feedback mechanism allows the system to verify packet authenticity and identify spoofed packets while maintaining the fast transmission characteristics of connectionless UDP protocol
Data Source
AI summary
The ephemeral port of a probe UDP packet is populated with a first value that is a function of the destination address and destination port of a target as well as a random seed. The first value may also be a function of the local address of the server generating the probe UDP packet. The destination port of a response UDP packet is compared to a second value that is a function of the source address, source port, and the random seed, and possibly the destination address. If the destination port matches the second value, the response packet is determined not to be spoofed. Probe packets may be generated by multiple probes and labeled with a local address and index assigned to the probe to enable response packets to be mapped back to a probe.