Avoiding collisions in internet protocol (IP) packet identification numbers

A pseudo-random generator may be used to generate identification values for formatted data packets. A method for transmitting data less susceptible to man-in-the-middle attacks may include receiving data for transmission over a network according to a protocol; formatting the data into one or more internet protocol (IP) packets by fragmenting the received data; and transmitting the one or more internet protocol (IP) packets. The step of formatting the data into one or more internet protocol (IP) packets may include generating a unique pseudo-random number while avoiding collisions with previously-used numbers; and inserting the pseudo-random number as an identifier in the one or more internet protocol (IP) packets corresponding to the received data.

FIELD OF THE DISCLOSURE

The instant disclosure relates to computer networks. More specifically, this disclosure relates to transferring data over computer networks.

BACKGROUND

Data transfer between devices on a network may involve fragmenting the data into individual chunks of data and formatting those individual chunks of data into data packets with certain header information to assist network equipment in delivering the chunk of data to a desired final destination. When data is fragmented into individual chunks of data, the formatted data packets for the chunks of data may include identifier information to allow a receiving device to match up the chunks of data and recreate the original complete data.

One conventional method for performing the process of fragmenting data and formatting data packets is shown inFIG. 1.FIG. 1is a flow chart illustrating a conventional method of formatting data packets. A method100begins at block102with initializing a running identification value with a pseudo-random algorithm based on a system clock value. At block104for each formatted data packet created from data for transmission over the network, the current running identification value is inserted into the formatted data packet. After using the current running identification value, the current running identification value is incremented, such as by adding the number one to the value. Block104may continue to be repeated, and the current running identification value incremented for each formatted data packet.

However, the method ofFIG. 1for sending data may leave the receiver open to certain attacks from malicious third parties. For example, because the current identification value is only incremented by one for each formatted data packet, the identification value for future formatted data packets is very predictable. A malicious third party could use the current identification value, extracted from a data packet intercepted on the Internet, to begin sending data packets to the receiver that confuse the receiver and may interrupt services on the receiver. In one particular attack, the receiver is vulnerable to a man-in-the-middle attack.

SUMMARY

A less predictable identification value may be used for formatted data packets to reduce or eliminate the possibility of a malicious third party from successfully tricking a receiver device into accepting packets from the malicious third party. For example, a pseudo-random number generator may be used to generate identification values for formatted data packets. In one embodiment, a pseudo-random number may be generated for an identification value of a first data packet of a series of data packets, and subsequent data packets of the series of data packets use new pseudo-random identification values created for the next series of data packets corresponding to different data.

According to one embodiment, a method may include receiving data for transmission over a network according to a protocol; generating a pseudo-random number; formatting the data into one or more internet protocol (IP) packets; and transmitting the one or more internet protocol (IP) packets. The step of formatting the data into one or more internet protocol (IP) packets may include inserting the pseudo-random number as an identifier in the one or more internet protocol (IP) packets.

According to another embodiment, a computer program product may include a non-transitory computer readable medium having code to perform the steps of receiving data for transmission over a network according to a protocol; generating a pseudo-random number, formatting the data into one or more internet protocol (IP) packets; and transmitting the one or more internet protocol (IP) packets. The step of formatting the data into one or more internet protocol (IP) packets may include inserting the pseudo-random number as an identifier in the one or more internet protocol (IP) packets.

According to yet another embodiment, an apparatus may include a memory and a processor coupled to the memory, wherein the processor is configured to perform the steps of receiving data for transmission over a network according to a protocol; generating a pseudo-random number; formatting the data into one or more internet protocol (IP) packets; and transmitting the one or more internet protocol (IP) packets. The step of formatting the data into one or more internet protocol (IP) packets may include inserting the pseudo-random number as an identifier in the one or more internet protocol (IP) packets.

DETAILED DESCRIPTION

Data for transmission over a connection in packets, such as internet protocol (IP) packets, may have an identifier number for each of the packets to designate to a receiver where in a sequence of packets the current packet fits. This identifier number may be selected to be a pseudo-random number. For each of the packets transmitted, the triplet of a source address, a destination address, and the identifier value (e.g., the pseudo-random number) may be entered into a collision table. The collision table may be checked for each new packet being formed to ensure that the pseudo-random number is a unique pseudo-random number such that there are no collisions due to, for example, a pseudo-random number generator generating identical numbers in a short span of time. Multiple protocols may be used for transmitting data in packets. According to one embodiment, each protocol may use identifier values generated by the pseudo-random number generator independent of each other to reduce or eliminate the likelihood of wrapping values. The formatted data in IP packets with an identifier selected by a pseudo-random number generator may be formatted in IPv4 packets and/or IPv6 packets.

FIG. 2is a flow chart illustrating a method for transmitting data in internet protocol (IP) packets according to one embodiment of the disclosure. A method200may begin at block202with receiving data for transmission over a network according to a protocol. For example, data may be received for transmission across a network according to a transmission control protocol (TCP), user datagram protocol (UDP), internet gateway messaging protocol (IGMP), simple network management protocol (SNMP), or other protocol. The data received at block202may be too large for packaging in a single IP packet. Thus, the data of block202may be fragmented into multiple IP packets.

At block204, a pseudo-random number may be generated for use as an identifier of the data received at block202. At block206, the data may be formatted into one or more packets, such as internet protocol (IP) packets, using the generated pseudo-random identifier in the one or more packets. Each of the packets of the one or more packets corresponding to the data received at block202may include the generated pseudo-random number identifier of block204. At block208, the one or more packets may be transmitted to a receiving party over a network, such as an intranet or the Internet. The receiving party may recreate the data of block202by assembling the packets using the identifier values in the one or more packets.

The method200ofFIG. 2may be repeated for additional data received at a network interface for transmission in IP packets, whether IPv4 or IPv6 packets. A new pseudo-random number may be generated for the next sequence of fragmented data packets corresponding to the new received data. In one embodiment, the next received data for fragmentation may be formatted into IP packets with an incremented identifier value from the previously-generated pseudo-random number. A new pseudo-random number may then be generated after every received data block.

According to one embodiment, the IP packets are IPv6 packets. An initial value for the identifier of the IP packets may be selected through a pseudo-randomization algorithm without the use of a clock time. As new IP packets are formatted from data for transmission on the network, the identifier may be generated through the pseudo-randomization algorithm to get new IPv6 fragmentation identifiers for the fragmented outgoing datagrams of the IP packets. In one embodiment, transmission control protocol (TCP) packets may not be fragmented. Since there is no IP identifier in a non-fragmented packet for IPv6 and IP identifiers are not generated, adjustments to the pseudo-random number generation to avoid issues with segmentation offloading may be suppressed.

According to another embodiment, the IP packets are IPv4 packets. Pseudo-random numbers may be generated for identifier values in all IPv4 packets, including TCP, UDP, ICMP, and IGMP protocol data.

In one embodiment for fragmented datagrams, the next randomized identifier value may be selected from a data structure maintained for each combination of local and remote address, and that value used for both a fragmentation header in the IPv4 or IPv6 packet and to reset the data structure value. A route table is a controlling data structure for sending data. There may be one route table for each combination of local address and remote address. In our implementation, each route table maintains a set of “use this value next” values for setting the IP ID—one for UDP, one for IGMP, and so on. On a per-activity or per-thread basis, the route tables may be collected under a controlling data structure called a route table header. In another embodiment, the value may be stored in individual route tables.

A list of recently used identifier values may be maintained in a routing table for each protocol. On a per-activity or -thread basis, maintain a fragmented-datagram collision array shared by UDP, ICMP, and IGMP. The activity allocates and makes the array available during initialization. Each activity also maintains a simple counter of the number of fragmented output datagrams that have not yet timed out.

A collision array or table may be maintained for recently used identifiers, possibly on a per-activity basis, in which the array or table may include a source address and a destination address for each used identifier. Further, each entry in the array or table may include a protocol identifier (e.g., UDP, ICMP, or IGMP), a time stamp, and pointers to implement a linked list, which may be chained off an indexed entry into the collision array. When an output datagram, such as UDP, ICMP, or IGMP, is fragmented, a computer system formatting the data in IP packets may allocate or reuse, based on a predetermined timeout value, a structure for attachment to the collision array. The predetermined timeout value may be, for example, approximately thirty seconds.

The collision array or table may be used to reduce the likelihood that an IP packet identifier value is reused within a certain period of time due to the pseudo-random number generator generating the same value within a short period of time. The collision array or table may be checked each time an IP packet is formatted to determine whether a collision has occurred. In one embodiment, TCP packets may not be fragmented. Thus, checking the collision table or array may be skipped for TCP packets. For data formatted according to the TCP protocol, a sending system may generate randomized numbers as needed, taking potential segmentation offloading into account to avoid overlap.

Segmentation offloading is offloading of segmentation in a layer four protocol, such as TCP, in software to network interface card (NIC) firmware. When segmentation is active but segmentation offloading is not active, the TCP layer may break a message into segments and pass them down to the IP layer, which then may also fragment the segments before sending them to the NIC, which sends them across the network. When segmentation offloading is active, TCP sends a message down to the IP layer. Even for a large message, IP sends the message as a single unit to the NIC, which then does the segmentation and sends the segments across the network. When the NIC performs segmentation, the NIC may break the message into multiple packets and assign each a unique IP Identifier to delineate them. When segmentation offloading is active for an out-going TCP datagram, the randomization code may be adjusted to allow a jump beyond the incremental values the segmentation offloading will use.

One example of formatting data packets with the use of a collision table or array is shown inFIG. 3.FIG. 3is a flow chart illustrating a method for transmitting data in internet protocol (IP) packets according to another embodiment of the disclosure. A method300may begin at block302with receiving data for transmission according to a protocol. At block304, a next randomized identifier value may be determined based, at least in part, on a last used identifier for the protocol of the data. That is, each protocol being used to transmit data may have a separate next identifier value. In one embodiment, the next randomized identifier value may be the next value generated by the same pseudo-random generator algorithm used to generate the last used identifier. In another embodiment, the next randomized identifier value may be calculated from the last used identifier value by adding, multiplying, subtracting, or dividing the last used identifier value according to a pre-determined algorithm. At block306it is determined whether the protocol for data received at block302is TCP. If yes, then the method300proceeds to block308to format the data of block302into packets using the next randomized identifier value of block304. If the protocol is not TCP, then the method300proceeds to block310.

At block310it is determined whether a collision array counter is zero. If yes, then the collision array is empty and the method300proceeds to block308to format the data into packets using the next randomized identifier value of block304. If the collision array counter of block310is not zero, indicating there are entries in the array, then the method300proceeds to block312. At block312, the collision array is checked for a match to the data received at block302. For example, the check may include comparing at least one of a Upper Layer Protocol (ULP), a source address, a destination address, and the determined randomized identifier value of block304with entries in the collision array. It is determined at block314whether any entry in the collision array matches the current data being formatted for transmission. If there is a match, a timeout value of the match may also be checked to determine whether the matching entry has expired. If there is no match to an unexpired entry, then the method300may proceed to block308to format the data in packets using the determined next randomized identifier value of block304. If there is a match, then the method300may proceed to block316to increment the identifier value. Incrementing may include adding a predetermined value, such as one, to the identifier value of block304, or performing other predetermined mathematical operations on the identifier value of block304. The step at block316may be repeated until there is no match at block314, after which the method300proceeds to block308to format the data in packets using the incremented identifier value of block316.

FIG. 4illustrates one embodiment of a system400for an information system. The system400may include a server402, a data storage device406, a network408, and a user interface device410. In a further embodiment, the system400may include a storage controller404, or storage server configured to manage data communications between the data storage device406and the server402or other components in communication with the network408. In an alternative embodiment, the storage controller404may be coupled to the network408.

In one embodiment, the user interface device410is referred to broadly and is intended to encompass a suitable processor-based device such as a desktop computer, a laptop computer, a personal digital assistant (PDA) or tablet computer, a smartphone, or other mobile communication device having access to the network408. In a further embodiment, the user interface device410may access the Internet or other wide area or local area network to access a web application or web service hosted by the server402and may provide a user interface, such as to adjust settings or view the collision array or table.

The network408may facilitate communications of data between the server402and the user interface device410. The network408may include any type of communications network including, but not limited to, a direct PC-to-PC connection, a local area network (LAN), a wide area network (WAN), a modem-to-modem connection, the Internet, a combination of the above, or any other communications network now known or later developed within the networking arts which permits two or more computers to communicate.

FIG. 5illustrates a computer system500adapted according to certain embodiments of the server402and/or the user interface device410. The central processing unit (“CPU”)502is coupled to the system bus504. The CPU502may be a general purpose CPU or microprocessor, graphics processing unit (“GPU”), and/or microcontroller. The present embodiments are not restricted by the architecture of the CPU502so long as the CPU502, whether directly or indirectly, supports the operations as described herein. The CPU502may execute the various logical instructions according to the present embodiments.

The computer system500may also include random access memory (RAM)508, which may be synchronous RAM (SRAM), dynamic RAM (DRAM), synchronous dynamic RAM (SDRAM), or the like. The computer system500may utilize RAM508to store the various data structures used by a software application. The computer system500may also include read only memory (ROM)506which may be PROM, EPROM, EEPROM, optical storage, or the like. The ROM may store configuration information for booting the computer system500. The RAM508and the ROM506hold user and system data, and both the RAM508and the ROM506may be randomly accessed.

The computer system500may also include an input/output (I/O) adapter510, a communications adapter514, a user interface adapter516, and a display adapter522. The I/O adapter510and/or the user interface adapter516may, in certain embodiments, enable a user to interact with the computer system500. In a further embodiment, the display adapter522may display a graphical user interface (GUI) associated with a software or web-based application on a display device524, such as a monitor or touch screen.

The I/O adapter510may couple one or more storage devices512, such as one or more of a hard drive, a solid state storage device, a flash drive, a compact disc (CD) drive, a floppy disk drive, and a tape drive, to the computer system500. According to one embodiment, the data storage512may be a separate server coupled to the computer system500through a network connection to the I/O adapter510. The communications adapter514may be adapted to couple the computer system500to the network408, which may be one or more of a LAN, WAN, and/or the Internet. The user interface adapter516couples user input devices, such as a keyboard520, a pointing device518, and/or a touch screen (not shown) to the computer system500. The keyboard520may be an on-screen keyboard displayed on a touch panel. The display adapter522may be driven by the CPU502to control the display on the display device524. Any of the devices502-522may be physical and/or logical.

The applications of the present disclosure are not limited to the architecture of computer system500. Rather the computer system500is provided as an example of one type of computing device that may be adapted to perform the functions of the server402and/or the user interface device410. For example, any suitable processor-based device may be utilized including, without limitation, personal data assistants (PDAs), tablet computers, smartphones, computer game consoles, and multi-processor servers. Moreover, the systems and methods of the present disclosure may be implemented on application specific integrated circuits (ASIC), very large scale integrated (VLSI) circuits, or other circuitry. In fact, persons of ordinary skill in the art may utilize any number of suitable structures capable of executing logical operations according to the described embodiments. For example, the computer system500may be virtualized for access by multiple users and/or applications.