Temporary Password Authentication for DOS Attack Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current defenses against Denial-of-Service (DOS) attacks, such as segregating clients based on network parameters and authentication layers, are ineffective in configurations using HTTP Forward Proxy or Reverse Proxy, and resource-intensive authentication methods are not practical for preventing DOS attacks.
Innovation Solution
Implementing a system that uses a temporary password generated via a Hash-based Message Authentication Code (HMAC) process, where communication devices and servers exchange a shared secret to create and validate a temporary password, allowing legitimate requests while ignoring or delaying malicious requests lacking this password.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authentication layer is used to prevent unauthorized access, then security against DOS attacks is improved, but server resource consumption increases
Solution Approach 1:
The authentication process is segmented into two stages: a fast temporary password verification stage that filters most DOS attacks, and a full authentication stage for legitimate users. This segmentation allows the system to spend minimal resources on most requests while maintaining security for authenticated users.
Solution Approach 2:
Instead of performing complete authentication for every request, the system performs only partial verification by checking for the presence of a temporary password. This partial action is sufficient to filter out DOS attacks while avoiding the resource cost of full authentication.
2Reliability
If network parameter filtering is used to segregate good clients from bad ones, then DOS attack prevention is improved, but effectiveness decreases in proxy configurations
Solution Approach 1:
The temporary password acts as an intermediary mechanism that works independently of network configuration. Instead of relying on network parameters that may be obscured by proxies, the system uses an application-layer secret that remains effective regardless of proxy configurations.
3Reliability
If heuristics are used to segregate good clients from bad ones, then DOS attack prevention is improved, but bad actors can simulate similar techniques to overcome defenses
Solution Approach 1:
The system uses a cryptographic hash (MD5) of the temporary password for verification. This copying approach with cryptographic hashing makes it computationally infeasible for attackers to simulate valid temporary passwords, as they would need to reverse the hash function which is designed to be one-way.
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
This approach efficiently filters out DOS messages by reducing the need for extensive authentication processing, conserving server resources and effectively preventing DOS attacks in various network configurations.
Implementation Method 1
a temporary password generated via a Hash-based Message Authentication Code (HMAC) process
Data Source
AI summary
A first message is received from a first communication device. The first message comprises an authentication token. For example, the authentication token may be a username/password. A determination is made if the first message also comprises a valid temporary password. The temporary password is used to prevent a Denial-of-Service (DOS) attack. In response to the first message comprising the valid temporary password, a determination is made if the authentication token is valid. In response to the authentication token being valid, the first message is responded to in a normal manner. If the first message does not contain the temporary password, the first message is handled based on a DOS message handling process.