Packet Filtering System for DOS-Resistant Secure Communications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems face challenges in providing denial of service (DOS) resistance for Secure Real-Time Transport Protocol (sRTP) and Secure Real-Time Transport Control Protocol (sRTCP) due to high processing power requirements for decryption and authentication, leading to inefficient resource utilization and potential disruptions during attacks.
Innovation Solution
Implementing a method that evaluates packet sequence numbers and timestamps to differentiate valid from invalid packets, allowing only likely valid packets to be decrypted, thereby reducing processing power needed during DOS attacks and optimizing resource usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If sufficient computing power is added to a session border controller to filter out hostile attack packets via processing intensive authentication, decryption, and validation operations, then the system can successfully protect against DOS attacks, but the cost of adding computing power increases significantly
Solution Approach 1:
The system performs preliminary actions by evaluating packet metadata (sequence numbers, timestamps, source/destination addresses) before decryption to identify and drop malicious packets. This preliminary filtering prevents unnecessary decryption operations on attack packets, reducing computing power consumption while maintaining DOS attack resistance.
Solution Approach 2:
The packet processing is segmented into multiple stages: initial metadata evaluation, selective decryption, and final validation. By dividing the processing pipeline, the system applies intensive decryption only to packets that pass initial filters, thereby reducing overall computing power requirements while maintaining security.
2Reliability
If decryption and authentication operations are performed on all received packets, then security is maintained, but processing power requirements become excessively high during DOS attacks
Solution Approach 1:
Instead of performing full decryption and authentication on all packets, the system applies partial validation by first evaluating metadata fields. Only packets that satisfy metadata criteria proceed to full decryption and authentication, reducing processor power consumption while maintaining security for legitimate packets.
Solution Approach 2:
Metadata evaluation acts as an intermediary layer between packet reception and full decryption/authentication. This intermediate filtering stage identifies and eliminates malicious packets before they reach the computationally intensive security processing, reducing overall power requirements.
3Reliability
If the system processes all packets at line rate with full decryption, then DOS resistance is achieved, but processing power is wasted during normal operation when attacks are not occurring
Solution Approach 1:
The system dynamically adjusts its processing intensity based on traffic characteristics. During normal operation, lightweight metadata evaluation suffices. During DOS attacks, the system intensifies processing for packets that evade initial filters. This dynamic adaptation eliminates the need for continuous full-line-rate decryption, reducing energy waste while maintaining DOS resistance capability.
Data Source
AI summary
Methods and apparatus for supporting secure packet communications, e.g., sRTP/sRTCP, which are resistant to denial of service attacks are described. A received packet is identified to correspond to a particular stream being received, the stream having a current expected set of packet sequence numbers, e.g., a current window including a next expected packet sequence number and at least one packet sequence number in the expected packet window on each side of the expected packet sequence number. Unencrypted information from the received packet, e.g., a received packet sequence number, is used to determine at least one of: to drop the received packet, or to assign the packet to one of a plurality of policing levels. If the packet passes policing at its assigned policing level, the packet may undergo authentication and decryption to determine if it is a valid packet.