Dynamic Proxy Host Switching to Mask Server IP Under Attack
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems are vulnerable to cyberattacks that target computer information systems and servers, leading to service interruptions and exposure of real IP addresses.
Innovation Solution
An automatic proxy system with a controller and multiple proxy hosts that dynamically designates a proxy host as the external IP address of a main server, updates DNS mappings, and performs network address translation to protect the server's real IP address, switching to another proxy host upon attack detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the main server's real IP address is exposed to users, then users can access the server directly, but the server becomes vulnerable to cyberattacks
Solution Approach 1:
The patent introduces a proxy server as an intermediary between users and the main server. The proxy server's IP address is exposed to users instead of the main server's real IP address. Users access the main server through the proxy server, which forwards requests and responses while masking the server's true identity. This resolves the contradiction by enabling user access while protecting the server from direct attacks.
Solution Approach 2:
The patent segments the network architecture into multiple components: user devices, proxy servers, and the main server. By dividing the system into separate entities with distinct IP addresses, the main server's IP is isolated from direct user exposure. The proxy server acts as a buffer layer that handles user communications without revealing the server's real address, thus preventing cyberattacks while maintaining accessibility.
2Object-affected harmful factors
If a single proxy host is used to mask the server IP, then the server is protected from attacks, but service availability is reduced if the proxy host is attacked
Solution Approach 1:
The patent assigns different functional qualities to different proxy hosts in the group. One proxy host is designated as the active proxy serving user requests, while others remain in standby or monitoring roles. This local differentiation allows the system to maintain protection functionality while ensuring service continuity through role distribution among proxy hosts with specialized functions.
Solution Approach 2:
The patent implements preliminary action by pre-configuring a group of proxy hosts before attacks occur. Multiple proxy hosts are prepared in advance with their IP addresses registered in DNS. When an attack is detected on the active proxy, the system can quickly switch to a pre-prepared standby proxy host, minimizing service interruption. This advance preparation ensures both server protection and service reliability.
3Ease of operation
If the DNS records the mapping between domain name and proxy host IP, then users can access through the proxy, but the mapping needs frequent updates when switching proxies
Solution Approach 1:
The patent implements periodic action through a health check mechanism that continuously monitors proxy host status. The system periodically checks whether the current proxy host is under attack or malfunctioning, and automatically triggers DNS record updates only when necessary. This periodic monitoring reduces unnecessary DNS updates while ensuring timely responses to attack conditions, balancing user accessibility with update efficiency.
Solution Approach 2:
The patent employs feedback mechanisms where the system continuously monitors proxy host health status and uses this information to determine when DNS updates are needed. When attack detection feedback indicates the current proxy is compromised, the system automatically updates DNS records to point to a healthy proxy. This feedback-driven approach minimizes unnecessary DNS updates while ensuring user access is maintained through active proxies only.
Data Source
AI summary
The present disclosure provides an automatic proxy method includes steps as follows. A controller selects one proxy host as a first designated proxy host from a plurality of proxy hosts and uses the Internet protocol address of the first designated proxy host as an external Internet protocol address of a main server; then, the controller communicates with a domain name system, so that the domain name system can update a record of a mapping between a domain name of the main server and the Internet protocol address of the first designated proxy host.