DOTS Client Identifier Allocation via Mediator Server
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing DDoS mitigation systems face challenges in identifying and managing DDoS attacks effectively, particularly due to identifier collisions and the difficulty in distinguishing legitimate from suspicious traffic, especially with the increase in encrypted traffic.
Innovation Solution
A method for allocating a unique identifier to a client node within a client domain, ensuring its uniqueness and avoiding conflicts, by managing the allocation and recording of these identifiers both locally and on associated traffic management servers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a DOTS client allocates identifiers autonomously, then the allocation process is simple and fast, but identifier collisions may occur between clients from the same domain
Solution Approach 1:
A centralized identifier management server is introduced as an intermediary between DOTS clients and the identifier allocation system. The server receives allocation requests from clients, manages the pool of available identifiers, and assigns unique identifiers to each client. This mediator ensures uniqueness by maintaining a centralized registry of allocated identifiers while allowing clients to obtain identifiers efficiently without autonomous collision-prone allocation.
2Reliability
If the identifier management server records all allocated identifiers, then identifier uniqueness is ensured, but the system complexity and memory requirements increase
Solution Approach 1:
The identifier management server segments the identifier allocation function into distinct operational modules: request reception, availability checking, identifier assignment, and record updating. Each module handles a specific aspect of identifier management independently, reducing overall system complexity. The server maintains simplified data structures for tracking allocated identifiers rather than managing comprehensive detailed records for each client.
3Ease of manufacture
If DOTS clients operate independently without coordinated identifier management, then the system is easier to deploy, but conflicts and security vulnerabilities arise
Solution Approach 1:
The system performs preliminary identifier allocation and registration before DOTS clients begin operating independently. The centralized server pre-assigns unique identifiers to clients and records them in advance, ensuring that when clients operate autonomously, their identifiers are already verified to be unique and secure. This preliminary coordination prevents conflicts before they can cause security vulnerabilities during independent operation.
Data Source
AI summary
A method for allocating an identifier to a first client node of a client domain, the first client node managing traffic associated with the client domain to protect it against a computing attack. The method includes: receiving a request for allocating a client node identifier from the first client node, the request including information identifying the client node; obtaining a list of client node identifiers already allocated to the client nodes active at least in the client domain; allocating to the first client node a client node identifier not belonging to the list obtained; recording in a local memory an association between the allocated identifier and the information; sending a response to the first client node, including the allocated identifier; and sending a request for recording the identifier allocated to the first client node in the domain to a traffic management server associated with the domain.