Discriminating DDoS Defense Through Important-Packet Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing DDoS defense mechanisms struggle to reliably distinguish between legitimate and malicious network traffic, leading to ineffective and costly scrubbing centers that often drop important messages while allowing attack packets to reach the target server.
Innovation Solution
Implement a discrimination criterion based on the behavior of senders, using a middleware called LGI to verify messages as -messages, and deploy scrubber++ centers to ensure important messages are delivered while dropping non-compliant packets, or utilize a router-based DAD mechanism to filter traffic at the network level.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If traditional scrubbing centers are used to block DDoS attacks, then attack packets are filtered, but important legitimate messages are also dropped and response time increases
Solution Approach 1:
Instead of trying to identify and block malicious packets (the traditional approach), the patent inverts the logic by marking legitimate important packets with a special flag and allowing them through automatically. The scrubbing center blocks only packets lacking the flag, which reverses the traditional filtration approach and solves the problem of dropping legitimate messages while blocking attacks.
Solution Approach 2:
The patent extracts the identification of important packets from the scrubbing center itself and places it in the sending router. The router marks important packets with a flag before they reach the scrubbing center, allowing the scrubbing center to simply filter based on the flag rather than performing complex analysis, thereby improving reliability and reducing processing burden.
2Object-affected harmful factors
If aggressive packet dropping policies are implemented, then attack traffic is blocked, but legitimate traffic is also blocked causing service disruption
Solution Approach 1:
The patent inverts the traditional approach by not blocking all packets and marking only the important ones for delivery. The default behavior becomes allowing traffic through, with blocking applied only to unmarked packets. This reversal ensures service continuity for legitimate traffic while maintaining attack blocking capability.
Solution Approach 2:
The patent introduces a flag field as an intermediary mechanism between the sending router and the scrubbing center. This flag serves as a mediator that carries information about packet importance without requiring complex interaction or decision-making at the scrubbing center, thereby maintaining service continuity while enabling selective blocking.
3Measurement precision
If complex discrimination criteria are used to identify important packets, then packet filtering accuracy improves, but system complexity and processing overhead increase
Solution Approach 1:
The patent extracts the complex discrimination logic from the scrubbing center and relocates it to the sending router. The router, which already has context about the connection and traffic patterns, performs the discrimination and sets the flag accordingly. This reduces the complexity at the scrubbing center while maintaining high accuracy in packet identification.
Solution Approach 2:
Instead of copying complex analysis capabilities to multiple scrubbing centers, the patent uses a simple flag copy that conveys the essential information about packet importance. This lightweight copying approach maintains discrimination accuracy while dramatically reducing system complexity and processing overhead at each node.
4Reliability
If existing scrubbing centers are deployed to protect servers, then DDoS protection is provided, but operational costs increase significantly
Solution Approach 1:
The patent replaces expensive complex analysis operations with a simple, inexpensive flag field that costs minimal processing resources. The flag is set at the router level using simple marking operations and then passed through the network, eliminating the need for resource-intensive deep packet inspection at scrubbing centers, thereby reducing operational costs while maintaining protection capability.
Solution Approach 2:
The sending router performs the discrimination and marking function as part of its normal operation, using its existing context about the connection and traffic patterns. This self-service approach eliminates the need for separate expensive scrubbing centers to perform complex analysis, reducing operational costs while maintaining effective DDoS protection.
Data Source
AI summary
Embodiments defend a node in a network, e.g., a server or website, against distributed denial of service (DDoS) attacks through use of a criterion of discrimination between messages that the defended network node considers important to receive, and all other messages addressed to the defended network node. The use of this new criterion upends the conventional approach to defense against DDoS attacks. Whereas the conventional defense methods attempt to identify attack packets in order to drop them, embodiments identify packets that comply with an indication of packets defined as important by the defending server, as determined by a verification performed using the criterion of discrimination, thus making sure the compliant packets are delivered to their destination, while providing functionality for all other packets (those not identified as compliant) to be dropped.