Blockchain SDP Access Control for DDoS-Resilient Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The SDP controller in Software Defined Perimeter systems is vulnerable to Distributed Denial of Service (DDoS) attacks and incorrect authorization, leading to system instability and impaired data access.
Innovation Solution
Implement blockchain-based access control methods where SDP connection hosts transmit verified information to a blockchain system node, which records and verifies host information and connection policies, ensuring secure authentication and authorization through blockchain-ledger-based verification and consensus.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a centralized SDP controller is used to manage access control, then authorization management is simplified, but the system becomes vulnerable to DDoS attacks and single-point failures
Solution Approach 1:
The patent segments the centralized SDP controller into distributed SDP controllers across multiple nodes in a blockchain network. Each node maintains the access control functionality independently, eliminating the single-point-of-failure vulnerability while preserving authorization management capabilities through consensus mechanisms.
Solution Approach 2:
The patent introduces a blockchain ledger as an intermediary that mediates between initiating hosts and accepting hosts. The ledger stores and verifies access control policies, enabling distributed controllers to coordinate authorization decisions without relying on a single central controller, thus improving both reliability and operational simplicity.
2Adaptability or versatility
If the SDP controller is exposed in the network to provide access control services, then service accessibility is improved, but the controller becomes vulnerable to network attacks
Solution Approach 1:
The patent divides the exposed SDP controller into multiple distributed nodes, each providing access control services. This segmentation allows the system to maintain service accessibility through multiple entry points while reducing the attack surface of any single node, as attackers can only compromise one node at a time rather than a central point.
Solution Approach 2:
The patent implements blockchain-based consensus mechanisms and cryptographic verification as preventive measures before attacks can succeed. Access control policies are pre-validated and stored on the immutable ledger, providing a cushion against unauthorized access attempts and malicious attacks on the distributed controllers.
3Reliability
If multi-factor authentication is implemented to enhance security, then authentication strength is improved, but user convenience deteriorates
Solution Approach 1:
The patent implements automated authentication mechanisms where the SDP system itself manages the complex multi-factor authentication process. The initiating host automatically presents credentials and receives verification from the blockchain ledger without requiring manual user intervention for each factor, thereby maintaining high security while improving user convenience through automation.
Solution Approach 2:
The patent employs real-time feedback mechanisms where the blockchain ledger immediately verifies authentication requests and returns authorization decisions. This rapid feedback loop allows the system to implement robust multi-factor authentication without significant user wait time, balancing security requirements with operational convenience.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
A blockchain-based SDP access control method and apparatus. An SDP connection initiation host submits identity authentication request information to a blockchain system node, and an authentication result after verification is fed back to the SDP connection initiation host; the SDP connection initiation host sends, to the blockchain system node, a query request for an SDP connection accepting host list that can be accessed, wherein the query request comprises an authentication result of the blockchain system node for the SDP connection initiation host; after verifying the query request, the blockchain system node queries the SDP connection accepting host list that can be accessed by the SDP connection initiation host, and records the SDP connection accepting host list to a blockchain ledger; the SDP connection initiation host initiates a connection request to the SDP connection accepting host, queries the SDP connection accepting host list that can be accessed by the SDP connection initiation host; and if an SDP connection accepting host to be accessed exists, then access service is provided, thereby avoiding DDoS attacks on an SDP controller, and preventing the SDP controller from implementing incorrect authorization.