Automatic tunnels routing loop attack defense

Patent metadata

Field	Value
Publication number	US-9954876-B2
Application number	US-201514965859-A
Country	US
Kind code	B2
Filing date	Dec 10, 2015
Priority date	Dec 10, 2015
Publication date	Apr 24, 2018
Grant date	Apr 24, 2018

Abstract

The present disclosure relates to systems, methods, and non-transitory computer readable storage medium for detecting a tunnel routing loop attack on a computer network. A method of the presently claimed invention receives a packet of data over an automatic tunnel. When the received packet includes an Internet protocol version 6 (IPv6) packet headers in the received packet may be extracted from the received packet. When an extracted header is a tunnel routing loop attack (TRLA) header, address information included in the TRLA header may be matched to a destination address that the IPv6 packet is about to be tunneled through. When the address information included in the TRLA header matches the destination address that the IPv6 packet is about to be tunneled through the IPv6 packet is dropped because the match indicates that that a loop is about to be formed.

First claim

What is claimed is:

1. A method for detecting a tunnel routing loop attack on a computer network, the method comprising:
receiving an internet protocol version 6 (IPv6) packet at a first network device over a network interface;
adding address information to the IPv6 packet that identifies a second network device in a tunnel routing attack (TRLA) header;
encapsulating the IPv6 packet in an IPv4 packet;
forwarding the IPv4 packet to a second network device through an automatic tunnel to the second network device;
receiving a second version of the IPv6 packet at the first network device;
identifying that the IPv6 packet includes the TRLA header;
identifying that the first network device that has previously forwarded the IPv6 packet from the address information in the TRLA header, wherein the identification that the first network device has previously forwarded the IPv6 packet indicates that the IPv6 packet is associated with the tunnel routing loop attack; and
dropping the second version of the IPv6 packet after identifying that the first network device previously forwarded the IPv6 packet to the second network device based on the indication that the previously forwarded IPv6 packet is associated with the tunnel routing loop attack.

2. The method of claim 1 , wherein the first network device added the TRLA header after initially receiving the IPv6 packet.

3. The method of claim 1 , wherein the IPv6 packet is passed through one or more other network devices, and the one or more other network devices modifies the TRLA header to identify addresses of the one or more other network devices.

4. The method of claim 1 , wherein the TRLA header is added after a hop-by-hop header in the IPv6 packet.

5. The method of claim 1 , wherein the second network device receives the IPv4 packet, extracts the IPv6 packet from the IPv4 packet, and sends the IPv6 packet to another network device.

6. The method of claim 1 , wherein the IPv6 packet and the second version of the IPv6 packet include different information in at least one header of the IPv6 packet.

7. The method of claim 6 , wherein the IPv6 packet and the second version of the IPv6 packet include the same payload data.

8. A non-transitory computer-readable storage medium embodied thereon a program executable by a processor for performing a method of detecting a tunnel routing loop attack on a computer network, the method comprising:
receiving an internet protocol version 6 (IPv6) packet at a first network device over a network interface;
adding address information to the IPv6 packet that identifies a second network device in a tunnel routing attack (TRLA) header;
encapsulating the IPv6 packet in an IPv4 packet;
forwarding the IPv4 packet to a second network device through an automatic tunnel to the second network device;
receiving a second version of the IPv6 packet at the first network device;
identifying that the IPv6 packet includes the TRLA header;
identifying that the first network device that has previously forwarded the IPv6 packet from the address information in the TRLA header, wherein the identification that the first network device has previously forwarded the IPv6 packet indicates that the IPv6 packet is associated with the tunnel routing loop attack; and
dropping the second version of the IPv6 packet after identifying that the first network device previously forwarded the IPv6 packet to the second network device based on the indication that the previously forwarded IPv6 packet is associated with the tunnel routing loop attack.

9. The non-transitory computer-readable storage medium of claim 8 , wherein the first network device added the TRLA header after initially receiving the IPv6 packet.

10. The non-transitory computer-readable storage medium of claim 8 , wherein the IPv6 packet is passed through one or more other network devices, and the one or more other network devices modifies the TRLA header to identify addresses of the one or more other network devices.

11. The non-transitory computer-readable storage medium of claim 8 , wherein the TRLA header is added after a hop-by-hop header in the IPv6 packet.

12. The non-transitory computer-readable storage medium of claim 8 , wherein the second network device receives the IPv4 packet, extracts the IPv6 packet from the IPv4 packet, and sends the IPv6 packet to another network device.

13. The non-transitory computer-readable storage medium of claim 8 , wherein the IPv6 packet and the second version of the IPv6 packet include different information in at least one header of the IPv6 packet.

14. The non-transitory computer-readable storage medium of claim 13 , wherein the IPV6 packet and the second version of the IPv6 packet include the same payload data.

15. A system for detecting a tunnel routing loop attack on a computer network, the system comprising:
a first network device; and
a second network device, wherein the first network device of the one or more other network devices:
receives an internet protocol version 6 (IPv6) packet at a first network device over a network interface;
adds address information to the IPv6 packet that identifies the second network device in a tunnel routing attack (TRLA) header;
encapsulates the IPv6 packet in an IPv4 packet;
forwards the IPv4 packet to the second network device through an automatic tunnel to the second network device;
receives a second version of the IPv6 packet at the first network device;
identifies that the IPv6 packet includes the TRLA header;
identifies that the first network device that has previously forwarded the IPv6 packet from the address information in the TRLA header, wherein the identification that the first network device has previously forwarded the IPv6 packet indicates that the IPv6 packet is associated with the tunnel routing loop attack; and
drops the second version of the IPv6 packet after identifying that the first network device previously forwarded the IPv6 packet based on the indication that the previously forwarded IPv6 packet is associated with the tunnel routing loop attack.

16. The system of claim 15 , wherein the first network device added the TRLA header after initially receiving the IPv6 packet.

17. The system of claim 15 , wherein the IPv6 packet is passed through one or more other network devices, and the one or more other network devices modifies the TRLA header to identify addresses of the one or more other network devices.

18. The system of claim 15 , wherein the TRLA header is added after a hop-by-hop header in the IPv6 packet.

19. The system of claim 15 , wherein the second network device receives the IPv4 packet, extracts the IPv6 packet from the IPv4 packet, and sends the IPv6 packet to another network device.

20. The system of claim 15 , wherein the IPv6 packet and the second version of the IPv6 packet include different information in at least one header of the IPv6 packet.

Assignees

• Sonicwall Us Holdings Inc

Inventors

• Ling Hui
• Chen Zhong

Classifications

• H04L45/18

  Loop-free operations · CPC title

• H04L12/4633

  Interconnection of networks using encapsulation techniques, e.g. tunneling · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04L45/741

  Routing in networks with a plurality of addressing schemes, e.g. with both IPv4 and IPv6 · CPC title