Computational Puzzle Mechanism for Server Load Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computational puzzle mechanisms are inefficient in preventing overload situations, particularly during denial-of-service attacks, as they create unnecessary bandwidth and computation overhead, and fail to effectively differentiate between legitimate and malicious clients.
Innovation Solution
The proposed method uses a shared key between client and serving devices to create tunable puzzles, where the difficulty is independent of auxiliary information bits, allowing legitimate clients to solve puzzles efficiently while preventing malicious clients by encoding semantic information in the solution, thereby controlling access and minimizing server load.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If standard hash function puzzles are used to prevent overload attacks, then server protection against DoS attacks is improved, but computational overhead and bandwidth consumption increase significantly
Solution Approach 1:
The patent applies preliminary action by pre-distributing puzzle components (hash values) to clients before the actual puzzle-solving phase. The server pre-computes and stores multiple hash values in a database, so when a client connects, the puzzle is already prepared and only requires simple lookup and verification, eliminating the need for real-time complex computation on either side.
Solution Approach 2:
The patent uses copying by creating multiple copies of puzzle data (hash values) and storing them in a database. Instead of computing puzzles dynamically, the system creates static copies of puzzle instances that can be repeatedly used and verified without additional computational cost, reducing the energy overhead for each new connection.
2Reliability
If puzzle difficulty is increased by using longer hash values to prevent guessing by malicious clients, then security against malicious access is improved, but the time required to solve puzzles increases
Solution Approach 1:
The server pre-computes hash values of various lengths and stores them in advance. When a client connects, the appropriate pre-computed hash value is selected and provided to the client, eliminating the need for the client to perform time-consuming hash computations in real-time. This maintains security while dramatically reducing solving time.
Solution Approach 2:
The patent changes the parameter of hash value length dynamically based on security requirements. The system can select from pre-computed hash values of different lengths (e.g., 64-bit, 128-bit, 256-bit) depending on the desired security level, allowing flexible adjustment of security strength without proportionally increasing computation time, since all lengths are pre-computed.
3Reliability
If puzzles are sent to all clients including malicious ones to verify legitimacy, then client authentication is improved, but server load increases during overload situations
Solution Approach 1:
The server prepares and stores multiple puzzle instances (hash values) in advance in a database. When a client connects, the server quickly retrieves a pre-prepared puzzle rather than creating one on-the-fly. This preliminary preparation allows the server to handle authentication requests with minimal processing load, even during overload situations, while still providing authentication to all clients.
4Reliability
If cryptographic hash functions with large input/output sizes are used, then puzzle security is improved, but the feasibility of solving puzzles by clients decreases
Solution Approach 1:
The server pre-computes hash values of the required large size (e.g., 256-bit) and stores them in the database. Clients receive these pre-computed values and can verify them using simple hash computations on provided input data, without needing to perform the computationally intensive task of generating such large hash values from scratch. This maintains high security while making puzzle solving feasible for clients.
Data Source
AI summary
The disclosure relates to a method (20) for a serving device (3) of establishing a computational puzzle for use in communication between a client device (2) and the serving device (3). The method (20) comprises establishing (21), in the serving device (3), the computational puzzle (p) based on a key shared by the client device (2) and the serving device (3) and on a solution (s′, s″) to the computational puzzle (p). Further method (30) in a serving device is provided, methods (60, 70) for client devices (2), serving devices (3), client devices (2), computer programs and computer program products.