Blockchain-Based SDP Access Control Against DDoS and Misauthorization

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

The SDP controller is vulnerable to Distributed Denial of Service (DDoS) attacks and incorrect authorization, disrupting normal system operations.

Innovation Solution

Implement blockchain-based access control methods involving SDP connection accepting and initiating hosts, utilizing blockchain system nodes for verification and consensus on host information and connection policies, and incorporating cryptographic techniques like KDF and token authentication to secure and authenticate connections.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If a centralized SDP controller is used to manage access control, then authorization management is simplified and centralized, but the system becomes vulnerable to DDoS attacks and single points of failure

Engineering Contradiction:

Improvecentralized authorization managementVSAvoidsystem availability under attack

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The centralized SDP controller is segmented into multiple distributed SDP controllers forming a blockchain network. Each controller runs independent nodes that collectively perform authentication and authorization, eliminating the single point of failure while maintaining distributed decision-making capabilities through consensus mechanisms

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

A blockchain ledger is introduced as an intermediary between SDP controllers and hosts. The ledger immutably records authentication results and authorization policies, serving as a trusted mediator that prevents tampering and ensures consistency across distributed controllers without requiring a central authority

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If the SDP controller is exposed in the network to provide access control services, then service functionality is improved, but the controller becomes vulnerable to network attacks such as DDoS

Engineering Contradiction:

Improveaccess control service capabilityVSAvoidnetwork attack vulnerability

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The network architecture is segmented into multiple SDP controller nodes distributed across different locations. Attack traffic targeting one node does not compromise the entire system, as other nodes continue to provide access control services. This segmentation reduces the impact surface for DDoS attacks while maintaining full service functionality

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system converts the potential harm of distributed attack traffic into a benefit by implementing a consensus mechanism that requires multiple nodes to validate authentication requests. This transforms the distributed nature of DDoS attacks into a distributed verification process, where legitimate requests are validated by consensus while attack traffic fails to achieve quorum

Inventive Principle:

Principle #22Blessing in disguise (Convert harm into benefit)

3Reliability

If multi-factor authentication is implemented to prevent credential theft, then security is improved, but user friendliness deteriorates

Engineering Contradiction:

Improvecredential securityVSAvoiduser authentication experience

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The system implements self-service authentication where hosts automatically perform cryptographic verification of credentials against the blockchain ledger without requiring user intervention for multiple factors. The blockchain immutably stores authentication proofs, enabling automated security verification that transparently protects credentials while maintaining simple user interaction

Inventive Principle:

Principle #25Self-service

Data Source

PatentEP4261716B1Blockchain-based method and system for SDP access control

Publication Date: 2025.08.27 CHINA MOBILE COMM GRP CO LTD

Figure 1~2
Figure 3~4
Figure 5~6

AI summary

Provided in embodiments of the present disclosure are a blockchain-based method and system for SDP access control. An SDP connection accepting host transmits information of the SDP connection accepting host and a supported connection policy to a blockchain system node, performs blockchain node verification and consensus, and records in a blockchain ledger; an SDP connection initiating host submits an identity authentication request to the blockchain system node; the blockchain system node verifies information of the identity authentication request, and searches for a list of SDP connection accepting hosts accessible to the SDP connection initiating host, and returns to the SDP connection initiating host; the SDP connection initiating host initiates a connection request, the connection request comprising a signature of the blockchain system node with respect to the SDP connection accepting hosts; the SDP connection accepting host verifies the connection request initiated by the SDP connection initiating host and provides an access service upon successful verification. The embodiments of the present disclosure prevent an SDP controller from coming under a DDoS attack and prevent the SDP controller from implementing an incorrect authorization.