Client Address Switching to Isolate Spoofed DDoS Traffic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network systems are vulnerable to Distributed Denial of Service (DDoS) attacks where malicious actors spoof the IP addresses of legitimate devices, making it difficult for servers to distinguish between legitimate and attacking clients.
Innovation Solution
A network device sends a message to the source address of an attack, instructing recipients to send subsequent packets to an unpublished second destination address, while ceasing responses to the original first destination address, and optionally dropping packets to the first address.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the server responds to packets from the original first destination address, then legitimate communication is maintained, but the server cannot distinguish between legitimate and attacking packets
Solution Approach 1:
The patent segments the destination address into two parts: the published first destination address for initial communication and the unpublished second destination address for continued communication. This segmentation allows the system to separate legitimate traffic handling from attack traffic filtering, enabling the server to maintain service availability while protecting against DDoS attacks by responding to packets only at the second destination address after the attack is detected
Solution Approach 2:
The patent introduces a mediator mechanism that intercepts packets at the first destination address and redirects them to the second destination address. This intermediary layer filters out attacking packets while allowing legitimate packets to pass through, solving the contradiction by providing a buffer between the attack source and the server
2Object-affected harmful factors
If the server sends a message to the source address instructing to use a second destination address, then attacking traffic is isolated, but legitimate clients may be temporarily disrupted
Solution Approach 1:
The patent prepares the second destination address in advance as an unpublished address before the attack occurs. When an attack is detected, the server can immediately instruct legitimate clients to switch to this pre-prepared address, minimizing disruption. The preliminary preparation of the alternative address enables rapid response without causing significant communication interruptions
Solution Approach 2:
The patent implements a feedback mechanism where the server sends messages to source addresses instructing them to use the second destination address. This feedback loop allows the server to dynamically adjust traffic routing based on attack detection, ensuring that legitimate clients are guided to the safe address while attacking traffic is automatically filtered at the first destination address
Data Source
AI summary
In a network system in which a server receives packets each including a source address, and in which the server ordinarily responds to each packet, Distributed Denial of Service attacks may be launched by malicious actors controlling a plurality of network devices. In such an attack, the attacking devices may spoof the IP address of a legitimate device, e.g., they may include, in each packet, the source address of the legitimate device. As such, systems and methods for increased security using client address manipulation are provided.