Blockchain SDP Access Control Against DDoS and Misauthorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The SDP controller in Software Defined Perimeter systems is vulnerable to Distributed Denial of Service (DDoS) attacks and can implement incorrect authorization, disrupting normal system operations.
Innovation Solution
Implement blockchain-based access control by verifying host information and connection policies through a blockchain system node, recording them into a ledger, and using signature information to authenticate and authorize connections, thereby preventing DDoS attacks and incorrect authorization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a centralized SDP controller is used to manage access control, then authorization management is simplified and centralized, but the system becomes vulnerable to DDoS attacks and single points of failure
Solution Approach 1:
The patent segments the centralized SDP controller into multiple distributed SDP controller nodes that form a blockchain network. Each node independently validates and stores access control policies in the blockchain ledger, eliminating the single point of failure while maintaining centralized authorization management through consensus mechanisms.
Solution Approach 2:
The patent introduces blockchain technology as an intermediary layer between initiating hosts and accepting hosts. The blockchain ledger acts as a trusted mediator that stores and validates access control policies, replacing the vulnerable centralized controller while simplifying authorization management through cryptographic verification.
2Adaptability or versatility
If the SDP controller is exposed in the network to perform authentication and policy distribution, then access control functionality is enabled, but the controller becomes susceptible to network attacks such as DDoS
Solution Approach 1:
The patent divides the exposed SDP controller into multiple distributed nodes across the blockchain network. Each node independently provides authentication and policy distribution services, so that attacking any single node does not compromise the entire system's access control functionality.
Solution Approach 2:
The patent creates replicated copies of the SDP controller functionality across multiple blockchain nodes. Each node maintains a copy of the access control policies in the blockchain ledger, providing redundant service capability that prevents DDoS attacks from disabling access control functionality.
3Reliability
If multi-factor authentication is implemented to prevent credential theft, then security is improved, but user experience becomes less friendly
Solution Approach 1:
The patent implements self-service authentication where initiating hosts automatically obtain access tokens from the blockchain network without manual multi-factor verification. The blockchain's cryptographic signature mechanisms provide strong authentication while maintaining ease of use through automated token-based access control.
Solution Approach 2:
The patent changes the authentication parameter from multi-factor verification to cryptographic signature verification. The blockchain network verifies digital signatures instead of requiring multiple authentication factors, providing equivalent or superior security while significantly improving user experience.
Data Source
AI summary
Provided in embodiments of the present disclosure are a blockchain-based method and system for SDP access control. An SDP connection accepting host transmits information of the SDP connection accepting host and a supported connection policy to a blockchain system node, performs blockchain node verification and consensus, and records in a blockchain ledger; an SDP connection initiating host submits an identity authentication request to the blockchain system node; the blockchain system node verifies information of the identity authentication request, and searches for a list of SDP connection accepting hosts accessible to the SDP connection initiating host, and returns to the SDP connection initiating host; the SDP connection initiating host initiates a connection request, the connection request comprising a signature of the blockchain system node with respect to the SDP connection accepting hosts; the SDP connection accepting host verifies the connection request initiated by the SDP connection initiating host and provides an access service upon successful verification. The embodiments of the present disclosure prevent an SDP controller from coming under a DDoS attack and prevent the SDP controller from implementing an incorrect authorization.