Dynamic Web Service Obfuscation for DoS Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for protecting Web services interfaces against denial of service (DoS) and distributed denial of service (DDoS) attacks are ineffective, as they either cause significant performance impact or are vulnerable to spoofing and falsification of IP addresses, leading to increased load on Application Servers.
Innovation Solution
A method and system that dynamically generates an obfuscated Web Service Method Name using a random sequence generator and the date and time of previous invocations, combined with a Client Instance Key and Dynamic Auth Key, to authenticate clients and prevent unauthorized access, thereby intercepting and filtering out unauthorized requests early in the request processing cycle.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional methods are used to protect Web services interfaces against DoS attacks, then security is improved, but performance is significantly impacted
Solution Approach 1:
The patent introduces a Web Server as an intermediary layer between clients and Application Servers. This Web Server handles authentication and request filtering, preventing unauthorized requests from reaching the Application Server. The intermediary absorbs the security processing load, protecting the Application Server's performance while maintaining security.
Solution Approach 2:
The system performs authentication and authorization checks before requests are processed by the Application Server. The Web Server validates requests in advance using tokens and security credentials, filtering out malicious requests early in the request cycle. This preliminary action prevents security processing from impacting Application Server performance during actual service execution.
2Reliability
If IP address-based protection methods are used, then unauthorized access is blocked, but spoofing and falsification of IP addresses occur, leading to increased load on Application Servers
Solution Approach 1:
The patent changes the authentication parameter from static IP addresses to dynamic tokens. Instead of relying on immutable IP addresses that can be spoofed, the system uses time-varying tokens that are difficult to replicate. This parameter change makes authentication more secure against spoofing while maintaining access control effectiveness.
Solution Approach 2:
The system transitions from static IP-based authentication to dynamic token-based authentication. Tokens are generated and validated in real-time, changing with each authentication event. This dynamic approach prevents attackers from using static IP spoofing techniques, as each legitimate request requires a fresh, valid token that cannot be predicted or replicated.
3Reliability
If authentication mechanisms are implemented, then unauthorized requests are filtered, but the complexity of the system increases
Solution Approach 1:
The patent divides the authentication functionality into separate components: token generation, token validation, and request filtering. The Web Server handles authentication logic separately from the Application Server's core business logic. This segmentation isolates complexity to the Web Server layer, making the overall system more manageable and maintainable while providing robust authentication.
Data Source
AI summary
The present application relates to the handling of what are generally referred to as denial of service (DoS) attacks. More specifically, the present application relates to a method and system for protecting one or more on-line Web service application servers from DoS and/or distributed DoS (DDoS) attacks.