Network Defense Against DoS Attacks via Handshake Completion
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for defending against Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks, which involve massive network traffic, are ineffective as they consume the target network's resources and fail to adequately counter attacks from numerous IP addresses.
Innovation Solution
A network connected device completes the TCP/IP handshake with attacking nodes and then drops all data packets from these nodes, allowing the attackers' resources to be consumed instead of the target's, thereby defeating the attack.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the target node sends a network reset to blocking attack traffic, then the attack is partially countered, but the target node's network resources are consumed and the attack is compounded
Solution Approach 1:
The patent converts the harmful attack traffic into a beneficial resource by allowing the TCP handshake to complete and then dropping only the data packets. The attacker's own traffic is used to establish the connection, which then serves as the mechanism for defense. The harmful SYN flood is transformed into a controlled process where the victim node learns the attacker's IP address and uses the connection establishment itself as part of the defense mechanism.
Solution Approach 2:
Instead of blocking the attack traffic immediately (conventional approach), the patent inverts the approach by allowing the connection to be established first and then dropping the data packets. This inversion changes the timing and sequence of operations, allowing the victim node to complete the TCP handshake and identify the attacker before actually blocking the harmful data transmission.
2Use of energy by moving object
If the target node blocks attack traffic immediately, then network resources are preserved, but the attack from multiple IP addresses cannot be effectively countered
Solution Approach 1:
The patent allows the attack traffic to serve a dual purpose: initially it appears as harmful flood traffic, but by completing the handshake it provides the victim node with the attacker's IP address information. This converted information is then used to identify and drop subsequent data packets from the same attacker, transforming the attack traffic into a source of defensive intelligence.
Solution Approach 2:
The patent performs preliminary action by completing the TCP handshake process before actually blocking the data packets. This preliminary connection establishment phase allows the victim node to gather necessary information about the attacker (IP address, connection state) before implementing the actual blocking action, enabling more effective defense against multiple IP addresses.
3Device complexity
If the target node uses conventional blocking methods, then simple implementation is achieved, but the method is virtually impossible to defeat attacks from hundreds of thousands of IP addresses
Solution Approach 1:
The patent converts the attack traffic into a beneficial resource by utilizing the TCP handshake completion process. Instead of requiring complex blocking mechanisms, the system uses the attacker's own traffic to establish connections that are then automatically used to identify and drop harmful data packets, simplifying the defense mechanism while maintaining effectiveness against large-scale attacks.
Solution Approach 2:
The defense mechanism serves itself by using the attack traffic itself as the means of defense. The TCP handshake process automatically provides the victim node with the information needed to identify attackers, and the connection establishment itself becomes part of the blocking mechanism, eliminating the need for external intervention or complex management systems.
Data Source
AI summary
Software, systems and methods for defeating DoS and DDoS attacks according to certain embodiments include detecting a DoS/DDoS attack, connecting to attacking node(s) by allowing a network handshake to complete between a network connected device and the attacking nodes. Then the network connected device under attack drops the traffic from the attacking node(s) rather that rejecting it. The acceptance and dropping is repeated until the attack is defeated.