uRPF Violation Handling via Network Controller Notification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Unicast reverse-path forwarding (uRPF) violations can lead to false positives, resulting in legitimate packets being dropped, especially in dynamic environments like virtual machines and applications.
Innovation Solution
Implementing a network controller that can either drop or forward packets violating uRPF checks, while notifying the controller to determine the legitimacy of the source IP address and adjust routing accordingly.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If uRPF feature is enabled to prevent malicious traffic, then network security is improved, but legitimate packets from dynamic sources may be dropped due to false positives
Solution Approach 1:
The system dynamically adjusts uRPF behavior based on source IP reputation and network conditions. Instead of static blocking, the system can temporarily allow packets from dynamic sources while learning their legitimacy, then permanently block only confirmed malicious sources. This dynamic approach resolves the contradiction by adapting security measures to current network state.
Solution Approach 2:
The system performs preliminary actions by implementing rate limiting and temporary allowances before final blocking decisions. When a uRPF violation is detected, the system first rates limits the offending source and monitors behavior over time, only permanently blocking after confirming malicious intent. This preliminary action period allows legitimate dynamic sources to establish themselves.
2Reliability
If uRPF feature is enabled to validate source addresses, then security validation is improved, but legitimate packets are dropped before the network device learns the source is legitimate
Solution Approach 1:
The system implements feedback mechanisms where network devices monitor packet behavior patterns and report back to control systems. This feedback loop allows the network to learn which sources are legitimate through observed behavior patterns, gradually adjusting blocking decisions. The feedback mechanism accelerates the learning process by continuously monitoring and adapting to actual traffic patterns.
Solution Approach 2:
The system performs preliminary learning actions by implementing observation periods and rate limiting before final blocking decisions. During this preliminary phase, the network device monitors packet behavior from potentially malicious sources, collecting data to distinguish between legitimate dynamic sources and actual attackers. This preliminary observation period significantly reduces the time needed to identify legitimate sources.
3Productivity
If uRPF feature is not enabled to allow dynamic sources, then packet delivery is improved, but attacks from illegitimate users can come through
Solution Approach 1:
The system changes parameters of packet handling based on source IP characteristics and network context. Instead of binary block/allow decisions, the system adjusts parameters such as rate limiting thresholds, monitoring periods, and blocking durations dynamically. This parameter-based approach allows the system to maintain high packet delivery for legitimate sources while progressively reducing allowance for malicious traffic based on observed behavior patterns.
Data Source
AI summary
A method for handling a unicast reverse-path forwarding (uRPF) violation can include, at a network device residing on a network: receiving an incoming packet from a source Internet Protocol (IP) address, the incoming packet having a destination IP address, the network device comprising an application-specific integrated circuit (ASIC) chip; performing an uRPF check on the incoming packet; and responsive to the incoming packet failing the uRPF check, notifying a network controller external to the network device. The network controller is operable to determine, based on a rule or by searching a routing information base (RIB), whether a flow from the source IP address to the designation IP address is legitimate and, in accordance with a result from the determination, drop the incoming packet or forward the incoming packet to the destination IP address.