New defense method of ddos attack based on side channel elastic secret computation

Abstract

The application relates to the technical field of network security, and discloses a novel DDoS attack defense method based on side channel elastic confidential calculation, which comprises the following steps: step 1, performing TEE-based distributed decentralized DDoS detection, generating a decision instruction, and executing the decision instruction; step 2, performing key management under DDoS attack, and optimizing the performance of TEE under high-load DDoS attack; and step 3, running MTD control logic in TEE, hiding the transformation rule of MTD, and completing the mutual coordination of MTD transformation and DDoS detection and mitigation process. By using the scheme, the reliability problem of the centralized architecture is solved, the safe operation of the system is ensured, and the elasticity and attack difficulty of the defense system are improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and specifically to a novel defense method against DDoS attacks based on side-channel elastic confidentiality computation. Background Technology

[0002] Distributed Denial-of-Service (DDoS) attacks have become a major threat in the field of cybersecurity. They overwhelm the resources of a target system with a large number of legitimate or illegitimate requests, preventing legitimate users from accessing services. With the development of network technology, DDoS attack methods have become increasingly complex and diverse, and traditional defense methods such as traffic scrubbing and rule-based detection have gradually revealed their limitations.

[0003] Traditional DDoS defense techniques involve deploying traffic scrubbing devices at the network boundary to detect and filter incoming traffic, removing malicious traffic. This method requires pre-setting filtering rules and may not be effective in identifying and filtering new or variant DDoS attacks. Furthermore, traffic scrubbing devices can become targets of attacks; once compromised, they will cease to function properly. Summary of the Invention

[0004] This invention provides a novel DDoS attack defense method based on side-channel elastic confidential computing, which solves the reliability problem of centralized architecture, ensures the secure operation of the system, and improves the resilience and attack resistance of the defense system.

[0005] Therefore, the present invention provides the following technical solution: A novel DDoS attack defense method based on side-channel resilient confidential computing, the method comprising: Step 1: Perform distributed decentralized DDoS detection based on TEE, generate decision instructions, and execute the decision instructions; Step 2: Perform key management under DDoS attacks and optimize TEE performance under high-load DDoS attacks; Step 3: Run the MTD control logic in the TEE to hide the transformation rules of MTD and complete the mutual coordination between MTD transformation and DDoS detection and mitigation process.

[0006] Optionally, step 1 includes: Step 11: Deploy nodes and initialize TEE. Deploy nodes with TEE functionality at multiple key locations in the network. When each node starts up, initialize the node's TEE environment and generate a unique node identifier and key pair. The node identifier is used to uniquely identify the node in the network, and the key pair is used for secure communication and authentication between nodes. When a node starts up, it calls the TEE-related initialization functions to create and initialize the TEE. Step 12: Nodes authenticate each other via TEE; the authentication process uses a challenge-response mechanism based on public-key cryptography. Step 13: Generate the decision instruction. When a node detects suspicious DDoS attack traffic, the node encapsulates the attack characteristic information into a message, encrypts the message using a shared key within the TEE, and then broadcasts the encrypted message to other nodes in the network. After receiving the message, other nodes decrypt the message within their respective TEEs and analyze and judge the attack characteristic information according to a preset decision algorithm. Each node generates its own decision suggestion based on the analysis results, encrypts the decision suggestion, and sends it to other nodes. Finally, all nodes summarize and negotiate the received decision suggestions within the TEEs, and generate the final decision instruction by majority voting. Step 14: Execute the decision instruction. After the decision instruction is generated within the TEE, the node executing the decision sends the decision instruction to the relevant network device. The network device restricts or blocks the attack traffic according to the decision instruction.

[0007] Optionally, in step 13, the preset decision algorithm adopts a machine learning-based algorithm to minimize the loss function with a penalty term, as follows:

[0008]

[0009] in: It is a weight vector used to measure the importance of each attack feature; b is the bias term; These are slack variables used to handle potential misclassification situations; C is the penalty parameter, which controls the degree of penalty for misclassification; It is an attack feature vector, which includes features such as source IP, target IP, and traffic rate. These are sample labels; 1 indicates normal traffic, and -1 indicates attack traffic. n is the number of samples.

[0010] Optionally, step 2 includes: Step 21: Implement private key protection. Based on the enhanced design of homomorphic encryption and zero-knowledge proof, integrate fully homomorphic encryption (FHE) and zero-knowledge proof (ZKP) technologies within the TEE to implement a dynamic protection mode of decryption during use and encryption during idle time. The private key is stored after being encrypted using Lattice-based FHE and is only temporarily decrypted by the trusted application (TA) within the TEE when a signature / decryption operation is required. It is immediately re-encrypted after the operation is completed. ZKP is introduced to verify the legitimacy of access requests and prevent side-channel attacks. Step 22: Dynamic key update is performed using a combination of Q-learning algorithm; key update is achieved through key stages such as environment modeling, state definition, action definition, reward function design, learning algorithm execution, and policy application. Step 23: Optimize the performance of TEE under high-load DDoS attacks by employing task scheduling optimization, data caching, and parallel processing.

[0011] Optionally, in step 21, the FHE encryption process is as follows:

[0012] Where Enc(pk,m) is the encryption function; pk=(g,h,p) is the public key parameter, which contains three parts: g, h and p; g and h are generators or other elements of a certain group; p is a large prime number used for modular arithmetic; 'a' is an encrypted form containing the plaintext message 'm'; b is an encryption form containing random noise s; s is random noise, μ is the linear mask of the private key m. In the DDoS scenario, m represents the TLS private key, and c is the ciphertext storage format. Attackers cannot directly extract m from c. The ZKP authentication protocol is as follows:

[0013] Among them, Prove is used to generate a proof of π; x represents an access request declaration; It is private evidence; π is the actual proof of its generation; Verify is used to verify the validity of the proof of π; vk is the verification key, used to verify the validity of the proof π.

[0014] Optionally, in step 23, the task scheduling optimization is to implement an intelligent task scheduling algorithm within the TEE, and to reasonably allocate the computing resources of the TEE according to the priority and resource requirements of the tasks; the data caching is to set up a data caching area within the TEE to cache commonly used attack feature libraries and decision rules. When performing DDoS detection, relevant data is first searched in the cache area. If the data exists in the cache, it is directly used for analysis; the parallel processing utilizes the multi-core processing capability of the TEE to decompose the DDoS detection and mitigation tasks into multiple sub-tasks and process them in parallel.

[0015] Optionally, step 3 includes: Step 31: Encapsulate the control logic of MTD in the trusted application of TEE; the control logic of MTD includes dynamic transformation rules of system attributes. In TEE, transformation instructions of system attributes are generated according to preset policies and time intervals; every once in a while, the control logic of MTD in TEE generates a new IP address and port combination and sends the transformation instructions to the network configuration module of the system to update the network attributes of the system. Step 32: A randomized transformation strategy is adopted to hide the transformation pattern of MTD. Random factors are introduced when generating IP address and port combinations, so that the result of each transformation is uncertain. Step 33: Complete the coordination between MTD transformation and DDoS detection and mitigation processes. When the DDoS detection module detects attack traffic, it feeds back the attack characteristic information to the MTD control module. The MTD control module adjusts the system attribute transformation strategy according to the attack characteristic information. If an attack targeting a specific port is detected, the MTD control module speeds up the switching frequency of that port or migrates the service to other ports to increase the difficulty of the attacker's attack.

[0016] Optionally, in step 33, a dynamic strategy collaborative optimization model is used to achieve mutual coordination between MTD transformation and DDoS detection and mitigation processes. The specific dynamic strategy collaborative optimization algorithm is as follows:

[0017] First, input the current policy P and the attack feature vector. ; Learning rate The control strategy adjusts the speed to balance response sensitivity and system stability; threshold The attack strength threshold that triggers strategy adjustments is set to avoid false responses. Secondly, feature extraction is performed to extract A from the traffic; Then, the strategy is adjusted if A exceeds the threshold. Then update the strategy:

[0018] In the formula, This represents the gradient of the loss function L with respect to the policy parameters P; Finally, a feedback loop is established to implement the optimized strategy. Feedback is sent to the MTD scheduler to form a dynamic optimization loop.

[0019] A novel DDoS attack defense device based on side-channel elastic confidential computing, the device comprising: The node deployment and TEE initialization unit performs distributed decentralized DDoS detection based on TEE, generates decision instructions, and executes the decision instructions. The Key Management and Security Service Unit performs key management under DDoS attacks and optimizes the performance of TEE under high-load DDoS attacks. The mobile target defense and confidential computing combined unit runs the MTD control logic in the TEE, hides the transformation rules of MTD, and completes the mutual coordination of MTD transformation and DDoS detection and mitigation processes.

[0020] A computer-readable storage medium having a computer program stored thereon, the computer program being executed by a processor to perform the steps of the novel DDoS attack defense method based on side-channel resilient confidential computing.

[0021] This invention provides a novel DDoS attack defense method based on side-channel elastic confidential computing. It employs a distributed decentralized architecture based on a TEE (Trusted Execution Environment), constructing a distributed decentralized DDoS detection and mitigation network where nodes authenticate each other via the TEE and decision instructions are generated within the TEE. This is the core architectural design of this application, solving the reliability problem of centralized architectures. This invention utilizes key management and security service continuity assurance within the TEE. It implements secure storage and updates of private keys for key security components and optimizes TEE performance within the TEE, ensuring the continuity of security services under DDoS attack scenarios, which is crucial for ensuring the secure operation of the system. This invention completes the implementation and transformation pattern hiding of MTD (Moving Target Defense) control logic within the TEE. By placing the MTD control logic within the TEE and employing a randomized transformation strategy to hide the transformation patterns, it works in conjunction with DDoS detection and mitigation, improving the resilience and attack resistance of the defense system. Compared with existing technologies, this invention has the following technical advantages: This approach enhances the reliability and resilience of the defense network. The proposed distributed decentralized architecture based on a TEE (Transmission over Environment) improves security by creating a highly isolated and trusted execution environment for sensitive data and critical computation processes within distributed nodes. This effectively resists external malicious attacks, preventing data theft or tampering during transmission and processing, thus elevating the overall security level of the distributed system. Simultaneously, the decentralized architecture eliminates the security risks associated with a single central node, preventing system paralysis due to central node failure or attacks, further enhancing the system's robustness and reliability. Regarding privacy protection, the TEE ensures data is encrypted locally and decrypted and computed only within a trusted environment, guaranteeing strict confidentiality of user data within the distributed network and fully meeting current stringent requirements for data privacy protection.

[0022] It ensures the security and service continuity of critical security components. The private keys of critical security components are securely stored and updated within the TEE. Combined with TEE performance optimization measures, it can guarantee the continuity of critical security services such as TLS termination service and API gateway authentication in resource-exhausted DDoS attack scenarios, and prevent security service interruptions caused by private key leakage.

[0023] This enhances the defense effectiveness against MTD by placing the control logic of MTD within a TEE and employing a randomized transformation strategy to hide the transformation patterns, making it difficult for attackers to discover and predict the transformation patterns of MTD, effectively increasing the difficulty of attacks. Simultaneously, the coordinated operation of MTD with DDoS detection and mitigation allows for timely adjustments to system attributes based on the attack situation, further improving the overall effectiveness of the defense system.

[0024] Adaptable to complex and ever-changing attack environments, this application combines multiple advanced technologies to cope with various complex and ever-changing DDoS attack types, including new and variant attacks. Whether it's a high-volume attack or a low-rate, covert attack, it can effectively detect and mitigate it, demonstrating strong adaptability and scalability. Attached Figure Description

[0025] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly described below. Obviously, the drawings described below are merely some embodiments of the present invention, and those skilled in the art can obtain other drawings based on these drawings without creative effort.

[0026] Figure 1 This is a flowchart of a novel DDoS attack defense method based on side-channel elastic confidentiality computation in a specific embodiment of the present invention; Figure 2This is a schematic diagram of a novel DDoS attack defense device based on side-channel elastic confidentiality computing in a specific embodiment of the present invention. Detailed Implementation

[0027] The specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.

[0028] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0029] like Figure 1 The diagram shown is a flowchart of a novel DDoS attack defense method based on side-channel elastic confidentiality computation in an embodiment of the present invention, including the following steps: Step 101 involves performing distributed, decentralized DDoS detection based on TEE and constructing a mitigation network—that is, a network built using this method to mitigate DDoS attacks. Specifically, this includes: 11. Node deployment and TEE initialization.

[0030] Nodes with TEE (Trusted Execution Environment) capabilities are deployed at multiple critical locations within the network (locations that ensure overall network security and implement security functions). These nodes can be devices such as servers and routers. Upon startup, each node initializes its TEE environment, generating a unique node identifier and key pair. The node identifier is used to uniquely identify the node within the network, and the key pair is used for secure communication and authentication between nodes. During startup, the node calls the relevant TEE initialization functions to create and initialize the environment. In a TEE-based system, a unique UUID (Universally Unique Identifier) ​​is generated for each node as its identifier, assigning a unique identity to each node in the system. This is the initial step of the entire system, providing the foundation for subsequent node authentication and distributed decision generation. Only after node deployment and TEE initialization are completed can nodes participate in subsequent operations in a secure and trusted manner.

[0031] 12. Nodes authenticate each other.

[0032] Nodes authenticate each other via TEE (Trusted Entities Exchange). The authentication process employs a challenge-response mechanism based on public-key cryptography. Node A sends an authentication request to Node B, containing a random number RA. Upon receiving the request, Node B uses its private key to sign RA and its own identifier, generating a signature SB. Node B then sends SB and its public key to Node A. Node A verifies the signature SB using Node B's public key. If the verification succeeds, Node A considers Node B legitimate. Similarly, Node B also authenticates Node A. This mutual authentication mechanism ensures that all nodes in the network are trustworthy.

[0033] After node deployment and TEE initialization, node mutual authentication is performed. Only mutually authenticated nodes can communicate and collaborate securely in the network, providing a trusted set of nodes for subsequent distributed decision generation.

[0034] 13. Distributed decision generation.

[0035] When a node detects suspicious DDoS attack traffic, it encapsulates attack characteristics (such as source IP address, target IP address, and traffic rate) into a message, encrypts the message using a shared key within its TEE (Transaction Execution Environment), and then broadcasts the encrypted message to other nodes in the network. Upon receiving the message, other nodes decrypt it within their respective TEEs and analyze and judge the attack characteristics according to a pre-defined decision algorithm. The decision algorithm in this application employs a machine learning-based algorithm, as detailed below:

[0036]

[0037] in: It is a weight vector used to measure the importance of each attack feature; b is the bias term; These are slack variables used to handle potential misclassification situations; C is the penalty parameter, which controls the degree of penalty for misclassification; It is an attack feature vector, which includes features such as source IP, target IP, and traffic rate; These are sample labels (1 indicates normal traffic, -1 indicates attack traffic). n is the number of samples; st represents the condition that the following conditions are met.

[0038] By training this model, it can be made to accurately distinguish between normal traffic and attack traffic.

[0039] Each node generates its own decision recommendations based on the analysis results (such as whether to impose traffic restrictions, and the amount of traffic to be restricted), and sends these recommendations to other nodes after encryption. Finally, all nodes within the TEE summarize and negotiate the received decision recommendations, and generate the final decision instruction through majority voting.

[0040] Only trusted nodes can participate in the distributed decision-making process. When a node detects suspicious traffic, it triggers the decision-making process. Each node independently analyzes and judges based on encrypted attack characteristic information, providing a basis for the generation of subsequent decision instructions.

[0041] 14. Execution of decision-making instructions.

[0042] After the final decision instruction is generated within the TEE, the node executing the decision sends it to the relevant network devices (such as firewalls and routers). The network devices then restrict or block the attack traffic according to the decision instruction. For example, if the decision instruction is to restrict traffic from a specific source IP address, the firewall will set corresponding access control rules based on the instruction to restrict traffic from that source IP address from entering the target network.

[0043] Step 102: Perform key management and security service continuity assurance under attack.

[0044] 21. Private key protection mechanism.

[0045] This application implements an enhanced design based on homomorphic encryption and zero-knowledge proofs. Fully homomorphic encryption (FHE) and zero-knowledge proof (ZKP) technologies are integrated within the TEE to achieve a dynamic protection mode of "decryption when needed, encryption when idle." The private key is stored after encryption using Lattice-based FHE and is only temporarily decrypted by the trusted application (TA) within the TEE when a signature / decryption operation is required. It is immediately re-encrypted after the operation is completed. ZKP is introduced to verify the legitimacy of access requests and prevent side-channel attacks.

[0046] The FHE encryption process is as follows:

[0047] Where pk=(g,h,p) are the public key parameters, s is random noise, and μ is the linear mask of the private key m. In a DDoS scenario, m represents the TLS private key, and c is the encrypted storage format, from which an attacker cannot directly extract m.

[0048] The ZKP authentication protocol is as follows:

[0049] Where x represents an access request statement (such as "the requester is a legitimate gateway"). π represents private evidence (such as the TA's session key) and proof. In DDoS defense, ZKP ensures that only legitimate devices can trigger private key operations, preventing forged requests from exhausting TEE resources.

[0050] 22. Key update strategy.

[0051] To further enhance private key security, a dynamic key update strategy combining Q-learning algorithm is adopted. Key updates are achieved through several key stages, including environment modeling, state and action definition, reward function design, learning algorithm execution, and policy application, as detailed below: 2.1 Environmental modeling.

[0052] In DDoS defense scenarios, the key usage environment within the TEE is considered as the "environment" in reinforcement learning. This environment includes all factors related to key usage, such as key decryption operation records, requests from communication peers, and network traffic characteristics. The environment generates corresponding feedback based on the key update strategy (i.e., the agent's actions) and the current key usage state, including results such as whether the attack was successfully intercepted or whether service interruption occurred.

[0053] 2.2 State Definition.

[0054] The state space S is used to describe different scenarios of key usage, and specifically includes the following key features: Decryption failure rate distribution: This statistically analyzes the frequency distribution of decryption failures over a recent period. The failure rate can be divided into different intervals, each corresponding to a specific characteristic. For example, a failure rate of 0-10% represents one characteristic, while 10-20% represents another.

[0055] Request frequency: Records the number of key usage requests from the communication peer per unit of time. A high request frequency may be a normal business peak, or it may be a DDoS attack. By incorporating it into the state definition, a more comprehensive understanding of the key usage environment can be obtained.

[0056] Time factor: Consider different times of day and different dates of the week. Network traffic and attack patterns can vary over time; for example, the likelihood of attacks may increase during peak business hours or specific holidays.

[0057] These features are combined to form a state vector s∈S, which is used to accurately describe the current state of the key usage environment.

[0058] 2.3 Action definition.

[0059] Action space A contains all the key update policy actions that the agent can take: Immediate Update: When a serious anomaly is detected, such as a sudden and significant increase in the decryption failure rate, the private key update process is immediately triggered to generate a new private and public key pair and update the relevant storage and communication information.

[0060] Delayed update: If the anomaly is relatively minor, or if it is during peak business hours, you can choose to delay the key update for a period of time in order to avoid excessive impact on normal services.

[0061] Do not update: When the key usage environment is normal and there is no obvious security threat, keep the current key unchanged.

[0062] 2.4 Reward function design.

[0063] This application uses a reward function to measure the benefit an agent receives after taking a certain action. In the key update strategy, the reward function needs to comprehensively consider both security gains and performance losses. Security Benefits: If a key update action successfully intercepts a DDoS attack and improves system security, a positive reward is given. For example, if attack traffic is effectively blocked after a key update, a reward of +10 is given.

[0064] Performance impact: Key update operations may have some impact on system performance, such as brief communication interruptions and increased computational resource consumption. If a service interruption is caused by an erroneous update, a negative reward (e.g., -5) will be given. If the update operation does not significantly impact system performance, or has a minor but positive effect on security, a reward of 0 will be given.

[0065] Specifically as follows:

[0066] 2.5 Learning algorithm execution.

[0067] This application employs the Q-learning reinforcement learning algorithm, which learns the optimal policy by continuously updating the Q-value. The Q-value represents the expected cumulative reward for taking action a in state s. Specifically, it includes: Q-value initialization: Initialize the Q-value for all state-action pairs (s, a), which can usually be set to 0.

[0068] Iterative Update: At each time step, the agent observes the current state s and selects action a based on the current Q-value and the exploration policy. After executing action a, it observes the next state s′ and the obtained reward r, and then updates the Q-value according to the Q-learning update rule, as follows:

[0069] in, The learning rate controls the update speed of the Q value, and its value is usually between 0 and 1. This is a discount factor used to weigh the importance of current rewards against future rewards, and its value ranges from 0 to 1.

[0070] Repeated iteration: By continuously interacting with the environment and repeating the above iterative update process, the Q value will gradually converge to the optimal value, and the agent can learn the optimal key update strategy to be adopted in different states.

[0071] 2.6 Strategy Application.

[0072] Once the Q-learning algorithm converges, the optimal Q-function is obtained. In actual key update decisions, the agent selects the state that makes the key update possible based on the currently observed state s. The action 'a' with the highest value is executed as the optimal policy. For example, when in a specific key usage state, the agent queries the optimal Q-function to decide whether to update the key immediately, delay the update, or not update it at all.

[0073] 2.7 Emergency handling of abnormal situations.

[0074] In addition to policy learning based on Q-learning, an anomaly detection mechanism also needs to be implemented. This is achieved by calculating the average decryption failure rate. and standard deviation Determine the anomaly detection threshold When the real-time decryption failure rate exceeds this threshold, it is considered a serious anomaly, and an emergency key update process is immediately triggered, regardless of the currently learned strategy. This is to ensure rapid response and system security in the event of a sudden, high-intensity DDoS attack.

[0075] Through the above process, the key update policy can dynamically adjust key update decisions based on the actual situation of DDoS attacks and system performance requirements, ensuring security while minimizing the impact on normal services.

[0076] 23. TEE performance optimization.

[0077] To optimize the performance of TEE under high-load DDoS attacks, the following methods are used, including task scheduling optimization, data caching, and parallel processing: Task scheduling optimization: Implement an intelligent task scheduling algorithm within the TEE to rationally allocate TEE computing resources based on task priority and resource requirements. For example, assign higher priority to urgent DDoS detection tasks and allocate computing resources to them first.

[0078] This application implements a scheduler that allocates tasks to appropriate processing units based on their priority and resource requirements. Priority can be determined based on the task's urgency, resource requirements, and expected execution time.

[0079] Let the task set be Each task There is a priority and resource requirements .

[0080] Scheduler It can be represented as:

[0081] That is, among all tasks, the task with the highest priority-to-resource-demand ratio is selected for resource allocation.

[0082] :Task The priority is indicated by the value; a higher value means the task is more urgent.

[0083] :Task Resource requirements are typically expressed in terms of CPU cycles or memory usage.

[0084] In DDoS attacks, ensure that high-priority DDoS detection tasks receive resources promptly and respond quickly to attacks.

[0085] Data caching: A data caching area is set up within the TEE to cache commonly used attack signature databases and decision rules. When performing DDoS detection, relevant data is first searched in the cache area. If the data exists in the cache, it is directly used for analysis, reducing the number of times data is read from external storage devices and improving detection efficiency.

[0086] In this application, the cache hit rate is defined as h, and the cache access time is defined as h. External storage access time is .

[0087] Average data access time for:

[0088] Cache hit rate: This indicates the probability that the requested data will be found in the cache.

[0089] Cache access time is typically much shorter than external storage access time.

[0090] External storage access time.

[0091] In DDoS attacks, improving cache hit rate reduces data access time, thereby speeding up DDoS detection.

[0092] Parallel processing: Leveraging the multi-core processing capabilities of the TEE, DDoS detection and mitigation tasks are broken down into multiple sub-tasks and processed in parallel. For example, traffic detection tasks from different source IP addresses can be distributed to different cores for processing, improving overall processing speed.

[0093] In this application, the task is defined as being decomposed into k subtasks, each subtask being in the core... The execution time is .

[0094] Overall processing time as follows:

[0095] k: Number of subtasks.

[0096] Subtasks in the core Execution time.

[0097] In DDoS attacks, parallel processing can shorten the overall detection time and increase system throughput.

[0098] This application combines these three technologies to significantly optimize the performance of TEE under high-load DDoS attacks, improve detection efficiency and system response speed.

[0099] Step 103 combines mobile target defense with classified computing.

[0100] 31. Implementation of MTD control logic in TEE.

[0101] The control logic of MTD is encapsulated within the trusted application of TEE. The MTD control logic includes dynamic rules for changing system attributes, such as dynamic IP address changes and dynamic port switching. Within the TEE, system attribute change instructions are generated according to preset policies and time intervals. Every so often, the MTD control program within the TEE generates a new IP address and port combination and sends the change instructions to the system's network configuration module to update the system's network attributes.

[0102] This application defines the time interval as t, and the system attribute set as follows: IP and PORT represent IP address and port number, and the transformation strategy is P.

[0103] The MTD control procedure is as follows:

[0104] It is a new set of system attributes.

[0105] t: Time interval, controlling the frequency of the transformation.

[0106] S: The current set of system attributes.

[0107] P: Transformation strategy, which determines how to generate new system properties.

[0108] By frequently changing system attributes, attackers can increase the difficulty of targeting their targets, thereby mitigating the impact of DDoS attacks.

[0109] 32. The pattern of change is hidden.

[0110] 33. Because the control logic of MTD runs within TEE, attackers cannot directly access the code and data within the TEE, thus making it impossible to obtain the transformation patterns of MTD. Furthermore, to further conceal these patterns, a randomized transformation strategy can be employed. By introducing random factors when generating IP address and port combinations, the result of each transformation becomes uncertain. Even with prolonged observation and analysis, attackers will find it difficult to predict the next system attribute transformation.

[0111] In this application, a random function R is defined, the current system property is S, and the new system property is as follows:

[0112] Input: Current attribute S, random function R, minimum entropy value .

[0113] deal with: Generate pseudo-random numbers: ; In the formula, timestamp: timestamp; nonce: a random number (a one-time numerical value); k: Pseudo-random number.

[0114] Attribute mapping: Maps k to a new attribute .

[0115] Entropy verification: ensure To prevent pattern leakage.

[0116] Output: High-entropy random properties .

[0117] R: A random function that ensures unpredictable changes and prevents attackers from establishing stable attack paths.

[0118] Minimum entropy threshold ensures that the attribute distribution is sufficiently random, reducing the risk of being subject to statistical analysis.

[0119] 33. Synergy with DDoS detection and mitigation.

[0120] MTD transitions work in tandem with the DDoS detection and mitigation process. When the DDoS detection module detects attack traffic, it feeds back attack signature information to the MTD control module. Based on this attack signature information, the MTD control module adjusts the system attribute transition strategy. If an attack targeting a specific port is detected, the MTD control module can increase the port transition frequency or migrate services to other ports, increasing the difficulty for attackers.

[0121] This application employs a dynamic strategy collaborative optimization model, as detailed below:

[0122] Input: Current policy P, attack feature vector (e.g., flow rate, packet length distribution).

[0123] Learning rate The control strategy adjusts the speed to balance response sensitivity and system stability.

[0124] threshold This triggers an attack strength threshold for policy adjustments, preventing false responses.

[0125] Feature extraction: Extracting A (e.g., from traffic) = Traffic burstiness, =Source IP entropy).

[0126] Strategy adjustment: If A exceeds the threshold (like > If so, update the strategy:

[0127] Feedback loop: The optimized strategy Feedback is sent to the MTD scheduler to form a dynamic optimization loop.

[0128] In summary, the novel DDoS attack defense method based on side-channel elastic confidentiality computation of the present invention solves the following technical problems compared with the prior art: The reliability and resilience of defense networks: Most existing DDoS defense networks adopt a centralized architecture, making central nodes vulnerable to attacks. Once compromised, the entire defense system will be paralyzed. This application aims to construct a distributed, decentralized DDoS detection and mitigation network. Nodes authenticate each other through a Trusted Execution Environment (TEE), and decision instructions are generated within the TEE. This ensures that even if some nodes are compromised, the entire defense network will not be compromised or become ineffective, thus improving the reliability and resilience of the defense network.

[0129] Private key security issues for critical security components: In DDoS attack scenarios, especially resource exhaustion attacks, the private key security of critical security components such as TLS termination and API gateway authentication faces serious threats. Once the private key is leaked, attackers can forge legitimate identities to launch attacks, leading to the interruption of security services. This application investigates how to ensure the private key security of these critical security components in resource exhaustion DDoS attack scenarios.

[0130] TEE performance optimization issue: Under high-load DDoS attacks, TEE needs to handle a large number of detection and mitigation tasks, which may affect its performance and lead to a decrease in detection and mitigation efficiency. This application aims to optimize TEE performance so that it can withstand high load pressure and ensure efficient operation during DDoS attacks.

[0131] The predictability issue of MTD (Moving Target Defense) transformation patterns: Existing MTD technology control logic is exposed in a normal execution environment, making it easy for attackers to discover and predict its transformation patterns. This application places the MTD control logic within a TEE (Tracking Equipment), preventing attackers from discovering and predicting the MTD transformation patterns, thus building a more difficult-to-break defense system.

[0132] Accordingly, embodiments of the present invention also provide a novel DDoS attack defense device based on side-channel elastic confidentiality computing, such as... Figure 2 The image shown is a schematic diagram of one possible structure of the device. This novel DDoS attack defense device based on side-channel elastic confidentiality computing includes the following modules: The node deployment and TEE initialization unit 201 performs distributed decentralized DDoS detection based on TEE, generates decision instructions, and executes the decision instructions. The Key Management and Security Service Unit 202 performs key management under DDoS attacks and optimizes the performance of the TEE under high-load DDoS attacks. The Mobile Target Defense and Confidential Computing Unit 203 runs the MTD control logic in the TEE, hides the transformation rules of MTD, and completes the mutual coordination between MTD transformation and DDoS detection and mitigation processes.

[0133] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, because according to the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to the present invention.

[0134] The present invention also provides a storage medium, which is a computer-readable storage medium storing a computer program thereon, the computer program being executable when it runs. Figure 1 The method shown may include some or all of the steps. The storage medium may include read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk, etc. The storage medium may also include non-volatile memory or non-transitory memory, etc.

[0135] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer program are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data provider to another website, computer, server, or data provider via wired or wireless means.

[0136] The embodiments of the present invention have been described in detail above. Specific implementation methods have been used to illustrate the present invention. The descriptions of the embodiments above are only for the purpose of helping to understand the methods and systems of the present invention, and are merely some, not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention, and the content of this specification should not be construed as a limitation of the present invention. Therefore, any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A novel DDoS attack defense method based on side-channel elastic confidential computing, characterized in that, The method includes: Step 1: Perform distributed decentralized DDoS detection based on TEE, generate decision instructions, and execute the decision instructions; Step 2: Perform key management under DDoS attacks and optimize TEE performance under high-load DDoS attacks; Step 3: Run the MTD control logic in the TEE to hide the transformation rules of MTD and complete the mutual coordination between MTD transformation and DDoS detection and mitigation process.

2. The novel DDoS attack defense method based on side-channel elastic confidential computing according to claim 1, characterized in that, Step 1 includes: Step 11: Deploy nodes and initialize TEE. Deploy nodes with TEE functionality at multiple key locations in the network. When each node starts up, initialize the node's TEE environment and generate a unique node identifier and key pair. The node identifier is used to uniquely identify the node in the network, and the key pair is used for secure communication and authentication between nodes. When a node starts up, it calls the TEE-related initialization functions to create and initialize the TEE. Step 12: Nodes authenticate each other via TEE; the authentication process uses a challenge-response mechanism based on public-key cryptography. Step 13: Generate the decision instruction. When a node detects suspicious DDoS attack traffic, the node encapsulates the attack characteristic information into a message, encrypts the message using a shared key within the TEE, and then broadcasts the encrypted message to other nodes in the network. After receiving the message, other nodes decrypt the message within their respective TEEs and analyze and judge the attack characteristic information according to a preset decision algorithm. Each node generates its own decision suggestion based on the analysis results, encrypts the decision suggestion, and sends it to other nodes. Finally, all nodes summarize and negotiate the received decision suggestions within the TEEs, and generate the final decision instruction by majority voting. Step 14: Execute the decision instruction. After the decision instruction is generated within the TEE, the node executing the decision sends the decision instruction to the relevant network device. The network device restricts or blocks the attack traffic according to the decision instruction.

3. The novel DDoS attack defense method based on side-channel elastic confidential computing according to claim 2, characterized in that, In step 13, the preset decision algorithm uses a machine learning-based algorithm to minimize the loss function with a penalty term, as follows: in: It is a weight vector used to measure the importance of each attack feature; b is the bias term; These are slack variables used to handle potential misclassification situations; C is the penalty parameter, which controls the degree of penalty for misclassification; It is an attack feature vector, which includes features such as source IP, target IP, and traffic rate. These are sample labels; 1 indicates normal traffic, and -1 indicates attack traffic. n is the number of samples.

4. The novel DDoS attack defense method based on side-channel elastic confidential computing according to claim 1, characterized in that, Step 2 includes: Step 21: Implement private key protection. Based on the enhanced design of homomorphic encryption and zero-knowledge proof, integrate fully homomorphic encryption (FHE) and zero-knowledge proof (ZKP) technologies within the TEE to implement a dynamic protection mode of decryption during use and encryption during idle time. The private key is stored after being encrypted using Lattice-based FHE and is only temporarily decrypted by the trusted application (TA) within the TEE when a signature / decryption operation is required. It is immediately re-encrypted after the operation is completed. ZKP is introduced to verify the legitimacy of access requests and prevent side-channel attacks. Step 22: Dynamic key update is performed using a combination of Q-learning algorithm; key update is achieved through key stages such as environment modeling, state definition, action definition, reward function design, learning algorithm execution, and policy application. Step 23: Optimize the performance of TEE under high-load DDoS attacks by employing task scheduling optimization, data caching, and parallel processing.

5. The novel DDoS attack defense method based on side-channel elastic confidential computing according to claim 4, characterized in that, In step 21, the FHE encryption process is as follows: Where Enc(pk,m) is the encryption function; pk=(g,h,p) is the public key parameter, which contains three parts: g, h and p; g and h are generators or other elements of a certain group; p is a large prime number used for modular arithmetic; 'a' is an encrypted form containing the plaintext message 'm'; b is an encryption form containing random noise s; s is random noise, μ is the linear mask of the private key m. In the DDoS scenario, m represents the TLS private key, and c is the ciphertext storage format. Attackers cannot directly extract m from c. The ZKP verification protocol is as follows: Among them, Prove is used to generate a proof of π; x represents an access request declaration; It is private evidence; π is the actual proof of its generation; Verify is used to verify the validity of the proof of π; vk is the verification key, used to verify the validity of the proof π.

6. The novel DDoS attack defense method based on side-channel elastic confidential computing according to claim 4, characterized in that, In step 23, the task scheduling optimization is to implement an intelligent task scheduling algorithm within the TEE, and to reasonably allocate the computing resources of the TEE according to the priority and resource requirements of the tasks; the data caching is to set up a data caching area within the TEE to cache commonly used attack signature libraries and decision rules. When performing DDoS detection, relevant data is first searched in the cache area. If the data exists in the cache, it is directly used for analysis; the parallel processing utilizes the multi-core processing capability of the TEE to decompose the DDoS detection and mitigation tasks into multiple sub-tasks and process them in parallel.

7. The novel DDoS attack defense method based on side-channel elastic confidential computing according to claim 1, characterized in that, Step 3 includes: Step 31: Encapsulate the control logic of MTD in the trusted application of TEE; the control logic of MTD includes dynamic transformation rules of system attributes. In TEE, transformation instructions of system attributes are generated according to preset policies and time intervals; every once in a while, the control logic of MTD in TEE generates a new IP address and port combination and sends the transformation instructions to the network configuration module of the system to update the network attributes of the system. Step 32: A randomized transformation strategy is adopted to hide the transformation pattern of MTD. Random factors are introduced when generating IP address and port combinations, so that the result of each transformation is uncertain. Step 33: Complete the coordination between MTD transformation and DDoS detection and mitigation processes. When the DDoS detection module detects attack traffic, it feeds back the attack characteristic information to the MTD control module. The MTD control module adjusts the system attribute transformation strategy according to the attack characteristic information. If an attack targeting a specific port is detected, the MTD control module speeds up the switching frequency of that port or migrates the service to other ports to increase the difficulty of the attacker's attack.

8. The novel DDoS attack defense method based on side-channel elastic confidential computing according to claim 7, characterized in that, In step 33, a dynamic strategy collaborative optimization model is used to achieve mutual coordination between MTD transformation and DDoS detection and mitigation processes. The specific dynamic strategy collaborative optimization algorithm is as follows: First, input the current policy P and the attack feature vector. ; Learning rate The control strategy adjusts the speed to balance response sensitivity and system stability; threshold The attack strength threshold that triggers strategy adjustments is used to avoid false responses. Secondly, feature extraction is performed to extract A from the traffic; Then, the strategy is adjusted if A exceeds the threshold. Then update the strategy: In the formula, This represents the gradient of the loss function L with respect to the policy parameters P; Finally, a feedback loop is established to implement the optimized strategy. Feedback is sent to the MTD scheduler to form a dynamic optimization loop.

9. A novel DDoS attack defense device based on side-channel elastic confidential computing, characterized in that, The device includes: The node deployment and TEE initialization unit performs distributed decentralized DDoS detection based on TEE, generates decision instructions, and executes the decision instructions. The Key Management and Security Service Unit performs key management under DDoS attacks and optimizes the performance of TEE under high-load DDoS attacks. The mobile target defense and confidential computing combined unit runs the MTD control logic in the TEE, hides the transformation rules of MTD, and completes the mutual coordination of MTD transformation and DDoS detection and mitigation processes.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is run by the processor, it executes the steps of the novel DDoS attack defense method based on side-channel elastic confidential computing as described in any one of claims 1 to 8.

Images