Packet redirection in a communication network

Patent metadata

Field	Value
Publication number	US-9356952-B2
Application number	US-16171007-A
Country	US
Kind code	B2
Filing date	Jan 31, 2007
Priority date	Jan 31, 2006
Publication date	May 31, 2016
Grant date	May 31, 2016

Abstract

A method of controlling the re-direction of IP packets to an IP host having two or more different IP addresses comprises generating a first of said IP addresses as a one-way function of the second IP address. The method further comprises accepting a request to re-direct a packet destined to said first IP address to another IP address only if the other IP address is the second IP address.

First claim

The invention claimed is:

1. A method in a communication network of controlling the re-direction of IP packets to an IP host having two or more different IP addresses, the method comprising the steps of:
generating a first of said IP addresses, the first of said IP addresses being generated as a one-way function of a routing prefix and a second IP address, and the one-way function being a cryptographic hash function; and
at a peer host or network routing node, accepting a request to re-direct a packet, destined to said first IP address, to another IP address only if the other IP address is the second IP address.

2. The method as claimed in claim 1 further comprising the step of, at the peer host or network routing node, applying the one-way function to the another address contained in the re-direction request.

3. The method as claimed in claim 1 and further comprising the steps of
including the first IP address in a packet destined for the second IP address, and,
at a peer host or network routing node, accepting a request to re-route a packet destined to said second IP address to another IP address only if the other IP address is the first IP address included in the packet.

4. The method as claimed in claim 1 , wherein the first address is an IPv6 address.

5. The method as claimed in claim 1 , wherein the second address is an IPv4 address.

6. The method as claimed in claim 1 wherein the step of generating the first of said IP addresses comprises generating the first of said IP addresses according to:
addr6=prefix|hash(modifier|prefix|addr4)

where addr6 is an IPv6 address and addr4 is an IPv4 address.

7. The method as claimed in claim 1 , wherein the step of generating the first of said IP addresses comprises generating the first of said IP addresses (Ipad 1 ) according to:
Ipad 1 =prefix 1|hash(material|prefix 1 . . . prefix n |id1 . . . id n ),

where one of id1 . . . idn is the second address.

8. A method in a communication network of controlling the re-direction of IP packets to an IP host having two or more different IP addresses, the method comprising the steps of:
generating a first of said IP addresses as a one-way function of a second IP address; and
transmitting the one-way function to a peer host or to a network routing node.

9. A method in a communication network of controlling the re-direction of IP packets to an IP host having two or more different IP addresses, the method comprising the steps of:
receiving, at the peer host or network routing node, a request to re-route a packet destined to a first IP address to another IP address;
applying a one-way function to a routing prefix and the another IP address, the one-way function being a cryptographic hash function; and
accepting the re-routing request only if the result of applying the one-way function to the another IP address is the first IP address.

10. A communication network comprising:
an IP host having two or more different IP addresses, a first of said IP addresses having been generated as a one-way function of a routing prefix and a second IP address, the one-way function being a cryptographic hash function; and
receiver means for accepting, at a peer host or network routing node, a request to redirect a packet destined to said first IP address to another IP address only if the other IP address is the second IP address.

11. An apparatus for controlling the re-direction of IP packets to an IP host having two or more different IP addresses, the apparatus comprising:
a network routing node for receiving a request to re-route a packet destined to a first IP address to another IP address;
a processor and memory containing instructions that, when executed by the processor, cause the processor to apply a one-way function to a routing prefix and the another IP address, the one-way function being a cryptographic hash function; and
a receiver for accepting the re-routing request only if the result of applying the one-way function to the another IP address is the first IP address.

12. The apparatus as claimed in claim 11 , wherein the network routing node is further configured to receive
a request to re-route a packet destined to said second IP address to another IP address; and
wherein the instructions, when executed by the processor, further cause the processor to determine whether the another IP address is included in the packet.

Assignees

• Arkko Jari
• Ericsson Telefon Ab L M

Inventors

• Arkko Jari

Classifications

• H04L63/1466 Primary

  Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks · CPC title

• H04L61/6077

  Electricity · mapped topic

• H04L69/16

  Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP] · CPC title

• H04L29/12952

  Electricity · mapped topic

• H04L61/6004

  Electricity · mapped topic