Dynamic Multicast Addressing for DoS Resilience
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing multicast networks are vulnerable to Denial-of-Service (DoS) attacks, particularly distributed DoS attacks, due to their reliance on static multicast addresses that can be exploited by malicious actors, leading to network disruptions and resource wastage in overlay and mesh networks.
Innovation Solution
Implementing dynamic and agile multicast addresses with a randomness field, periodically updated using cryptographic key management protocols, to prevent malicious actors from predicting valid addresses and propagate attacks, while filtering out invalid data and dropping malicious packets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If static multicast addresses are used for network communication, then network routing and data delivery are simplified, but the network becomes vulnerable to DoS attacks where malicious actors can predict and target valid addresses
Solution Approach 1:
The patent implements dynamic multicast address generation where addresses change over time based on cryptographic key updates. The multicast address space is divided into multiple subspaces, and the system periodically transitions between them using key management protocols, making addresses unpredictable to attackers while maintaining functional routing capabilities
Solution Approach 2:
The system employs periodic key updates and multicast address space transitions at defined intervals. This periodic reconfiguration of address spaces ensures that even if attackers compromise current addresses, they become invalid after the next key update cycle, providing time-based security against DoS attacks
2Reliability
If multicast addresses are frequently updated to prevent prediction, then resistance to DoS attacks improves, but network complexity and computational overhead increase
Solution Approach 1:
The multicast address space is segmented into multiple subspaces that can be independently managed and transitioned between. This segmentation allows the system to update only the active subspace while maintaining others as backups, reducing the complexity of managing entire address spaces and enabling more frequent, manageable updates
Solution Approach 2:
Multiple key pairs and address spaces are pre-generated and stored in the system before attacks occur. When key updates are needed, the system can immediately switch to pre-prepared keys and address spaces without requiring complex real-time generation, reducing computational overhead during critical security transitions
3Productivity
If routers forward all received multicast traffic, then data delivery to legitimate recipients is ensured, but malicious attack traffic is propagated and exacerbates DoS attacks
Solution Approach 1:
The system introduces cryptographic key verification as an intermediary layer between traffic reception and forwarding. Routers verify that incoming multicast traffic uses valid, current keys before forwarding, acting as a mediator that blocks malicious traffic while allowing legitimate data to pass through unchanged, thus protecting the network without impacting productivity
Data Source
AI summary
In general, some embodiments described herein relate to using agile or dynamic addresses for multicasting that may be difficult or impossible for a malicious actor to predict. Such agile addresses may prevent a malicious actor from attacking a single static multicast address and may prevent the architecture of the multicast network from propagating the attack. Data sent to invalid (e.g., expired, revoked, and/or otherwise depreciated addresses) can be filtered out and dropped from the network. For example, a first group key associated with a first time period can be calculated based on a first shared secret and a second group key associated with a second time period can be calculated based on a second shared secret. At any given time at least one group key can be an accepted group key. When a multicast address includes a currently accepted group key, the data can be sent to a group.