Data Packet Authentication for DDoS Traffic Filtering

The patent segments the traffic filtering process into two independent stages: first, network devices perform rapid filtering based on authenticated identifiers embedded in data packets to separate potential attack traffic; second, a traffic cleaning system performs deep protocol parsing only on packets that pass the first stage. This segmentation allows legal traffic to be quickly identified and forwarded while directing only suspicious traffic to resource-intensive cleaning processes.

The patent implements preliminary action by pre-allocating authenticated identifiers and corresponding keys to legitimate terminals before they send data packets. Network devices use these pre-configured credentials to quickly verify packet authenticity without requiring deep protocol parsing during actual traffic processing. This preliminary credential distribution enables rapid distinction between legal and illegal traffic at the network layer.

The patent divides traffic processing into two hierarchical levels: a first-level rapid filtering mechanism using authenticated identifiers that operates at network layer speed, and a second-level deep protocol parsing mechanism that processes only packets passing the first level. This segmentation ensures that the majority of legal traffic is processed quickly without undergoing resource-intensive deep parsing, thereby minimizing processing delay while maintaining identification accuracy.

The patent applies local quality by making the verification process adaptive: packets with valid authenticated identifiers receive expedited processing with minimal verification, while packets failing the initial check undergo comprehensive deep protocol parsing. This localized quality adjustment optimizes processing speed for legitimate traffic while maintaining security scrutiny for suspicious packets.

The patent reduces device complexity during operation by performing the complex key generation and credential binding operations in advance. Authentication servers pre-generate keys for each legitimate terminal and bind them to authenticated identifiers before traffic flow begins. Network devices only need to perform simple verification of pre-configured credentials during traffic processing, avoiding the need for complex real-time cryptographic operations at each network device.

The patent introduces an authentication server as an intermediary that handles complex key management and credential distribution. This intermediary centralizes the complexity of cryptographic operations, allowing network devices to focus on simple verification tasks. The authentication server mediates between terminal devices and network devices, managing the distributed key system and enabling rapid verification without burdening network devices with complex cryptographic processing.