Dynamic Cipher Suite Switching for DDoS Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computing systems face challenges in distinguishing between legitimate and illegitimate requests, particularly in distributed denial-of-service (DDoS) attacks from IoT devices with limited resources, which can overload host services and prevent them from responding to legitimate requests.
Innovation Solution
The host service changes the cipher suite available to clients from a less computationally intensive one (like ECC) to a more intensive one (like RSA) during suspected attacks, as IoT devices with limited resources take longer to connect using RSA, allowing the service to identify and block illegitimate traffic while allowing more resource-capable devices to continue connecting.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If the host service uses a less computationally intensive cipher suite (like ECC) to allow connections, then connection speed is improved, but the service cannot effectively distinguish legitimate requests from DDoS attack traffic
Solution Approach 1:
The host service dynamically changes the cipher suite parameter based on detected attack patterns. When a DDoS attack is detected, the service switches from a less intensive cipher suite (ECC) to a more intensive one (RSA), thereby changing the computational requirements parameter to differentiate between legitimate and illegitimate traffic sources.
2Measurement precision
If the host service uses a more computationally intensive cipher suite (like RSA) to identify attacking devices, then the ability to distinguish legitimate from illegitimate traffic is improved, but connection establishment time increases for all clients
Solution Approach 1:
The cipher suite selection is made dynamic rather than static. The host service adjusts the cipher suite requirements in real-time based on the detected state of the system. During normal operation, less intensive cipher suites are used for speed. When attacks are detected, the service dynamically switches to more intensive cipher suites to identify and block attacking devices, then switches back when the attack subsides.
Solution Approach 2:
The computational intensity parameter of the cipher suite is changed based on the operational context. The service monitors traffic patterns and adjusts the cipher suite parameter to match the current threat level, thereby optimizing the balance between connection speed and attack detection capability.
3Reliability
If the host service blocks traffic from devices with limited resources, then DDoS attacks are mitigated, but legitimate IoT devices may be incorrectly blocked
Solution Approach 1:
The host service implements a feedback mechanism where it monitors connection performance and traffic patterns. When using a more intensive cipher suite, the service observes which devices can successfully connect and which cannot. This feedback information is used to identify potential attackers (devices that cannot keep up with the intensive cipher suite) versus legitimate devices with adequate resources, allowing the service to block only the former.
Data Source
AI summary
A technology is provided for mitigating an attack against a host service. Receive a connection from a client using a first cipher suite to authenticate the client. Identify that a distributed denial-of-service (DDoS) attack is occurring from a plurality of clients. Change the first cipher suite to a second cipher suite wherein the second cipher suite is more computationally intensive than the first cipher suite. Disconnect with the client and causing the client to reconnect using the second cipher suite.