Means of mitigating denial of service attacks on IP fragmentation in high performance IPSEC gateways

• US 8,688,979 B2
• Filed: 03/04/2011
• Issued: 04/01/2014
• Est. Priority Date: 12/27/2002
• Status: Expired due to Fees

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: Raytheon BBN Technologies Corp. (Rtx Corporation), Verizon Corporate Services Group Incorporated (Verizon Communications Inc.)
• Inventors: Partridge, Craig, Milliken, Walter Clark, Mankins, David Patrick
• Primary Examiner(s): Vaughan, Michael R
• Application Number:
  US13/040,905
• Publication Number:
  US 20110161664A1
• Time in Patent Office: 1,124 Days
• Field of Search: None
• US Class Current: 713/160
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/164 at the network layer

Abstract

Embodiments of the invention reduce the probability of success of a DOS attack on a node receiving packets by decreasing the probability of random collisions of packets sent by a malicious user with those sent by honest users. The probability of random collisions may be reduced in one class of embodiments of the invention by supplementing the identification field of the IP header of each transmitted packet with at least one bit from another field of the header. The probability of random collisions may be reduced in another class of embodiments of the invention by ensuring that packets sent from a transmitting IPsec node to a receiving IPsec node are not fragmented.

Claims

1. A method, comprising:

supplementing, in a computing device having a processor and a memory, an identification field of a header of an IP datagram with at least one bit from another field of the IP header, whereby probability of random collisions is reduced, thereby reducing a security threat in connection with a transmission of the IP datagram; and

after supplementing the identification field of the header with the at least one bit, inserting remaining bits of identification information into at least one other field of the header.

2. The method of claim 1, further comprising transmitting the IP datagram.

3. The method of claim 1, wherein the at least one other field of the header includes at least one of a source address field and a destination address field of the header.

4. The method of claim 3, further comprising:

inserting source address information for the IP datagram into the source address field of the header for the IP datagram; and

inserting destination address information for the IP datagram into the destination address field of the header for the IP datagram.

5. The method of claim 1, further comprising inserting at least one of the remaining bits into a protocol field of the header.

6. The method of claim 1, further comprising inserting at least one of the remaining bits into a fragment offset field of the header.

7. The method of claim 1, wherein supplementing the identification field includes inserting 16 bits of the identification information into an identification field of the header.

8. A system, comprising:

a computing device including a processor and a memory, the memory including instructions executable by the processor for;

supplementing an identification field of a header of an IP datagram with at least one bit from another field of the IP header, whereby probability of random collisions is reduced, thereby reducing a security threat in connection with a transmission of the IP datagram; and

the instructions further executable by the processor for, after supplementing the identification field of the header with the at least one bit, inserting remaining bits of identification information into at least one other field of the header.

9. The system of claim 8, the instructions further executable by the processor for transmitting the IP datagram.

10. The system of claim 8, wherein the at least one other field of the header includes at least one of a source address field and a destination address field of the header.

11. The system of claim 10, the instructions further executable by the processor for:

inserting source address information for the IP datagram into the source address field of the header for the IP datagram; and

inserting destination address information for the IP datagram into the destination address field of the header for the IP datagram.

12. The system of claim 8, the instructions further executable by the processor for inserting at least one of the remaining bits into a protocol field of the header.

13. The system of claim 8, the instructions further executable by the processor for inserting at least one of the remaining bits into a fragment offset field of the header.

14. The system of claim 8, wherein supplementing the identification field includes inserting 16 bits of the identification information into an identification field of the header.

15. A method, comprising:

assembling, in a computing device having a processor and a memory, a plurality of received IP datagrams that each has an IP header based on identification information contained in an identification field and at least one other field of the header of each of the received IP datagrams, wherein the identification information for each received IP datagram does not include source address information, destination address information or protocol information for that received IP datagram; and

wherein the at least one other field comprises at least one field selected from the group consisting of the sub-net subfield of at least one of the source address field and the destination address field of the header of each received IP datagram, the protocol field of the header for each received IP datagram, and the fragment offset field of the header for each received IP datagram.

16. A system, comprising:

a computing device including a processor and a memory, the memory including instructions executable by the processor for;

assembling a plurality of received IP datagrams that each has an IP header based on identification information contained in an identification field and at least one other field of the header of each of the received IP datagrams, wherein the identification information for each received IP datagram does not include source address information, destination address information or protocol information for that received IP datagram; and

wherein the at least one other field comprises at least one field selected from the group consisting of the sub-net subfield of at least one of the source address field and the destination address field of the header of each received IP datagram, the protocol field of the header for each received IP datagram, and the fragment offset field of the header for each received IP datagram.