Network Traffic Filtering via Client Key Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for preventing denial of service (DoS) and distributed denial of service (DDoS) attacks in network structures are ineffective due to delays in recognizing malicious traffic patterns, which can lead to legitimate traffic being blocked, and can be easily circumvented by altering or forging source information in network headers.
Innovation Solution
A method involving a key generation appliance providing a client key to client devices, with a control appliance determining whether data packets contain this key to block or forward them, ensuring only legitimate traffic reaches the application server, using a deterministic approach to identify and block malicious packets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If pattern recognition methods are used to identify malicious traffic, then malicious traffic can be detected, but legitimate traffic may be incorrectly blocked due to delays in recognition
Solution Approach 1:
The system performs preliminary actions by embedding authentication keys in data packets before transmission and pre-establishing filtering rules at the control appliance. This allows immediate identification and blocking of malicious traffic without requiring time-consuming pattern analysis during traffic flow, thus resolving the contradiction between detection accuracy and response time
Solution Approach 2:
The patent replaces the mechanical pattern recognition system with a key-based authentication mechanism. Instead of analyzing traffic patterns in real-time, the system uses predetermined authentication keys that can be verified instantly, substituting complex mechanical analysis with simpler cryptographic verification to eliminate detection delays
2Object-affected harmful factors
If pattern recognition systems block traffic based on identified patterns, then malicious traffic is blocked, but legitimate traffic sharing similar patterns is also blocked
Solution Approach 1:
The system applies local quality by using unique authentication keys for different legitimate clients rather than applying uniform pattern-based filtering. Each legitimate client's traffic is identified by its specific authentication key, allowing the system to block malicious traffic while permitting legitimate traffic with similar patterns to pass through unchanged
Solution Approach 2:
The authentication key acts as an intermediary element that bridges the gap between traffic filtering and legitimacy verification. Instead of directly blocking based on patterns, the system uses authentication keys as intermediaries to verify legitimacy, thereby preventing false blocking of legitimate traffic while maintaining effective malicious traffic blocking
3Speed
If header information is used for pattern recognition, then traffic can be analyzed quickly, but the information can be easily altered or forged
Solution Approach 1:
The system uses authentication keys that are copied from a trusted key generation appliance to client devices and embedded in data packets. This creates a trustworthy copy mechanism where the authentication key serves as verified proof of legitimacy, maintaining both fast processing speed and high reliability since the keys originate from a trusted source and cannot be easily forged
Data Source
AI summary
A method (100) for preventing malicious network traffic is described, the method including: providing (110), by a key generation appliance, a client key to a client device; receiving (120), by a control appliance, a data packet intended for an application server from the client device; determining (130), by the control appliance, whether the data packet includes the client key; forwarding (140) the data packet, by the control appliance, to the application server in response to a determination that the data packet comprises the client key; and/or blocking (150) the data packet, by the control appliance, in response to a determination that the data packet does not include the client key. Further, an apparatus (360) and a system (300) are provided that are configured to perform the method (100).