Blockchain SDP Access Control for DDoS-Resilient Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The SDP controller in Software Defined Perimeter systems is vulnerable to Distributed Denial of Service (DDoS) attacks and incorrect authorization, leading to system instability and impaired data access.
Innovation Solution
Implement blockchain-based access control methods and devices that verify and record host information and connection policies into a blockchain ledger, ensuring secure authentication and authorization through timestamp signatures, Key Derivation Functions (KDF), and token verification to prevent DDoS attacks and incorrect authorization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a centralized SDP controller is used to manage access control, then authorization management is simplified and centralized, but the system becomes vulnerable to DDoS attacks and single points of failure
Solution Approach 1:
The centralized SDP controller is segmented into distributed SDP controllers across multiple blockchain nodes. Access control decisions are distributed across the network rather than concentrated in a single controller, eliminating the single point of failure while maintaining coordinated authorization management through the blockchain ledger.
Solution Approach 2:
The blockchain ledger serves as an intermediary that coordinates between distributed SDP controllers and initiating hosts. It stores verified host information and connection policies, enabling distributed controllers to make consistent access decisions without direct communication, thus distributing control while maintaining system coherence.
2Ease of operation
If the SDP controller is exposed in the network to provide access control services, then service accessibility is improved, but the controller becomes vulnerable to network attacks
Solution Approach 1:
The single exposed SDP controller is segmented into multiple distributed SDP controllers across the blockchain network. Each controller handles a portion of the access control workload, distributing the attack surface across multiple nodes rather than concentrating it in one exposed controller, thereby maintaining service accessibility while reducing vulnerability to DDoS attacks.
Solution Approach 2:
The blockchain network creates a secure, verified environment for SDP controller operations. Host information and connection policies are cryptographically verified and stored on the immutable blockchain ledger, creating a trusted environment that protects against unauthorized modifications and attacks, even as controllers remain accessible on the network.
3Reliability
If multi-factor authentication is implemented to prevent unauthorized access, then security is improved, but user friendliness deteriorates
Solution Approach 1:
Authentication and verification actions are performed preliminarily during host registration and connection policy establishment. The SDP controller verifies host information and connection parameters in advance, storing validated data on the blockchain ledger. This preliminary verification ensures accurate authorization while keeping actual user operations simple, as users only need to provide basic connection information that has already been cryptographically verified.
Data Source
AI summary
In a blockchain-based SDP access control method and apparatus, an SDP connection initiation host submits identity authentication request information to a blockchain system node, receives an authentication result feedback after verification; sends, to the blockchain system node, a query request for an SDP connection accepting host list that can be accessed, the query request including an authentication result of the blockchain system node for the SDP connection initiation host; after verifying the query request, the blockchain system node queries the SDP connection accepting host list that can be accessed by the SDP connection initiation host, and records the SDP connection accepting host list to a blockchain ledger; the SDP connection initiation host initiates a connection request to the SDP connection accepting host, queries the SDP connection accepting host list that can be accessed by the SDP connection initiation host; and if so, then access service is provided.