Game Network Demultiplexer with Token Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Online multiplayer games face inefficiencies in IP address usage and vulnerability to Denial of Service (DOS) attacks due to UDP-based communication protocols, which lead to inefficient use of public IP addresses and exposure of internet-facing servers.
Innovation Solution
A demultiplexer system that routes ingress packets to a targeted application server using a virtual IP address, a private IP address, and a token, which includes a secret key for authentication, thereby preventing DOS attacks and conserving IP addresses by using a single virtual IP address for multiple servers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If each server is assigned a unique public IP address, then server identification and routing are simplified, but public IP address space is exhausted inefficiently
Solution Approach 1:
The patent introduces a demultiplexer as an intermediary component between clients and servers. The demultiplexer receives packets destined for multiple servers sharing a common VIP, authenticates them using tokens, and forwards them to the appropriate server. This mediator enables multiple servers to share a single public IP address while maintaining simplified client-side routing logic.
Solution Approach 2:
The patent implements multi-functionality by allowing a single VIP to serve multiple servers simultaneously. The demultiplexer handles authentication, routing, and packet forwarding functions, enabling one IP address to perform the work of many server identifiers.
2Device complexity
If internet-facing servers are exposed directly, then network configuration is simplified, but servers become vulnerable to DOS attacks
Solution Approach 1:
The demultiplexer serves as a protective intermediary positioned between the internet and the servers. It authenticates incoming packets using tokens generated during the server selection process, ensuring that only legitimate traffic is forwarded to servers. This shields servers from direct exposure to DOS attacks while maintaining relatively simple network configuration.
Solution Approach 2:
The patent performs preliminary authentication actions before packets reach the servers. Tokens are generated and validated in advance by the demultiplexer, and only authenticated packets are allowed to proceed to the server tier. This preliminary security check prevents DOS attacks from reaching the servers.
3Reliability
If authentication is performed on client devices, then server security is improved, but client device processing requirements increase
Solution Approach 1:
The patent inverts the traditional authentication paradigm by moving the authentication function from the client device to the server-side demultiplexer. Instead of clients performing complex authentication calculations, the demultiplexer generates and validates tokens, significantly reducing client processing requirements while maintaining strong server security.
Solution Approach 2:
The demultiplexer acts as an authentication intermediary that handles all security-related computations. It generates tokens based on server identifiers and validates them against stored credentials, eliminating the need for clients to perform cryptographic operations while ensuring secure server access.
Data Source
AI summary
A processing application stored on a processing server receives a request to join an application server from a client device. The processing application identifies a targeted application server from a set of application servers, a private internet protocol (IP) address for the targeted application server, and a port number associated with the targeted application server. The processing application generates a token based at least in part on the private IP address for the targeted application server. The processing application maps the private IP address to a virtual IP (VIP) address. The processing application transmits the VIP address, the private IP address, the port number, and the token to the client device.