Challenge-Response Traffic Control for DoS Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing many-to-one network services face challenges in protecting against Denial-of-Service (DoS) attacks and network overload, as they either concentrate processing load on intermediary nodes or require costly active hardware for packet merging.
Innovation Solution
A method and service node configuration that distributes challenges from the receiver to senders, requiring them to solve puzzles to validate requests, thereby controlling traffic flow and preventing overload without the need for active hardware reprogramming, using one-way hash functions to ensure validity and efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Concast merges packets at intermediary nodes to protect receiver from DoS attacks, then receiver resource exhaustion is prevented, but intermediary nodes experience resource exhaustion and new DoS threats arise
Solution Approach 1:
The patent extracts the harmful merging operation from intermediary nodes and relocates it to the receiver. Instead of merging packets at tree nodes, the system validates puzzle solutions at the receiver, preventing intermediary nodes from experiencing resource exhaustion while maintaining DoS protection.
Solution Approach 2:
The patent introduces puzzle validation as an intermediary mechanism between senders and the receiver. Rather than directly merging packets or allowing unfiltered traffic, the system uses puzzle solutions as a mediator to control traffic flow and prevent resource exhaustion at all nodes.
2Adaptability or versatility
If Concast uses flexible merge specifications for packet merging, then traffic control adaptability is improved, but implementation cost increases due to required active hardware
Solution Approach 1:
The patent replaces the mechanical system of active hardware reprogramming with a software-based puzzle validation approach. Instead of requiring reconfigurable hardware at intermediary nodes, the system uses cryptographic hash functions and puzzle solutions that can be implemented in software, eliminating the need for expensive active hardware while maintaining traffic control flexibility.
Solution Approach 2:
The patent uses disposable puzzle challenges with limited validity periods. Each puzzle is generated, solved, and discarded, replacing the need for expensive, long-lived active hardware. The puzzles are computationally inexpensive to generate and validate, providing flexible traffic control without high implementation costs.
3Use of energy by moving object
If Concast distributes processing to intermediary nodes, then receiver resource requirements are reduced, but network complexity and DoS threats at tree nodes increase
Solution Approach 1:
The patent inverts the traditional Concast approach by not distributing packet merging to intermediary nodes. Instead, it centralizes the validation function at the receiver while using puzzle challenges distributed through the network. This inversion reduces receiver resource requirements without increasing network complexity, as the puzzle validation logic is simple and standardized.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
A method of controlling traffic flow through a service node located within a packet network, which traffic flow originates at a plurality of sending nodes and is destined for a receiving node. The service node is one of a multiplicity of service nodes configured in a tree or other acyclic structure, e.g. of an overlay network. The method comprises receiving a challenge from said receiving node or a downstream service node, generating and caching a further challenge, and combining that further challenge with the received challenges to generate a modified challenge. The modified challenge is then sent to a sending node or to an upstream service node. Subsequently, a request is received, destined for said receiving node and originating at a sending node. A solution accompanying said request is validated using the cached further challenge, and the request forwarded towards said receiving node only if the solution is valid. Otherwise, the request is dropped.