Edge Device Transport Layer Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for mitigating Distributed Denial of Service (DDoS) attacks in high-volume, low-latency applications like multiplayer video games and video conferencing are inadequate, as they often require custom coding or are not suitable for securing transport layer network traffic.
Innovation Solution
Implementing edge devices to authenticate and filter network packets at the transport layer, using secure tokens and cryptographic signatures to verify packet authenticity, thereby reducing the risk of DDoS attacks and eliminating the need for custom anti-attack solutions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If custom encryption protocols are coded into the application tier, then security against DDoS attacks is improved, but development time and error risk increase
Solution Approach 1:
The patent extracts the security function from the application tier and places it at the network edge. Edge devices perform packet authentication and filtering independently of the application code, eliminating the need to embed encryption protocols in application development while maintaining security.
Solution Approach 2:
The patent introduces edge devices as intermediaries between clients and application servers. These edge devices handle authentication and DDoS mitigation, acting as a mediator that protects the application tier without requiring custom security coding in the application itself.
2Reliability
If Web Application Firewalls and HTTPS are used, then web traffic security is improved, but suitability for transport layer network traffic decreases
Solution Approach 1:
The patent creates a universal security mechanism at the edge that works across multiple protocols and application types. The edge device performs transport layer authentication that is protocol-agnostic, making it suitable for UDP, TCP, and other transport layer protocols beyond just web traffic.
Solution Approach 2:
The patent segments the security function into a separate layer at the network edge, distinct from application-specific security mechanisms. This segmentation allows the same edge-based authentication mechanism to serve multiple different applications and protocols without being tied to web-specific implementations.
3Reliability
If security mechanisms are implemented at the application tier, then attack protection is improved, but system complexity increases
Solution Approach 1:
The patent extracts complex security mechanisms from the application tier and relocates them to edge devices. This extraction simplifies the application server architecture while concentrating security functionality at the network perimeter where it can operate independently of application complexity.
4Reliability
If packet authentication is performed at the edge, then network attack risk is reduced, but processing latency may increase
Solution Approach 1:
The patent performs authentication preliminarily at the edge before packets reach the application server. By pre-authenticating packets at the network edge, the system eliminates the need for repeated authentication at the application tier, reducing overall processing latency while maintaining security.
Data Source
AI summary
Technologies are disclosed herein for transport layer network data authentication. A token packet is attached to network data sent from a client software application to an application server at the transport layer. The token packet can be generated based on a temporary token key obtained from a token service. The token packet can include a signature of the network packet payload. The network packet with the attached token packet can be received at an edge device in the network where the application server resides before reaching the application server. The edge device can verify the authenticity of the network packet by verifying the signature contained in the token packet. If the verification is successful, the edge device can forward the network packet to the application server. If the verification fails, the edge device can block further transmission of the network packet.