Identification Gateway Routing for Moving-Target Server Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing moving target defense technologies affect normal services when servers randomly change communication parameters, making it impossible for terminals to find the server entrance.
Innovation Solution
Implement an Identification Gateway (IDGW) between clients and servers to dynamically convert identifiers using a pool of first and second identifiers, ensuring that only specified clients can access the server, thereby maintaining service accessibility while enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If the server randomly changes communication parameters (IP address and port) to protect against attacks, then network security is improved, but terminals cannot find the server entrance, affecting normal services
Solution Approach 1:
The patent introduces a DNS (Domain Name System) as an intermediary between terminals and the server. The DNS resolves domain names to IP addresses dynamically, allowing the server to change its IP address without affecting terminal access. Terminals access the server through a stable domain name rather than a fixed IP address, enabling the server to randomly change communication parameters while maintaining service accessibility.
Solution Approach 2:
The patent implements dynamic communication parameters for the server, where the IP address and port can change randomly over time. This dynamic behavior confuses attackers who cannot predict the server's current address, thereby improving network security while the DNS mechanism ensures that legitimate terminals can still locate the server through domain name resolution.
2Ease of operation
If the server uses a fixed IP address and port to provide stable service access, then service accessibility is improved, but attackers can easily identify and attack the server, reducing network security
Solution Approach 1:
The patent makes the server's communication parameters dynamic rather than fixed. The server can randomly change its IP address and port, which prevents attackers from easily identifying and targeting the server. The DNS mechanism translates stable domain names to these dynamic IP addresses, maintaining service accessibility for legitimate users while improving security against attacks.
Solution Approach 2:
The DNS acts as a mediator that decouples the stable domain name from the dynamic IP address. This allows the server to change its network parameters without affecting terminal access, as terminals continue to use the stable domain name to locate the server, thereby maintaining service accessibility while improving security.
3Object-affected harmful factors
If moving target defense technology is applied to servers to randomly change parameters, then attacker identification cost increases, but terminals cannot locate the server entrance, affecting normal operations
Solution Approach 1:
The patent uses DNS as an intermediary to resolve the conflict between moving target defense and service efficiency. The DNS translates stable domain names to dynamically changing IP addresses, allowing the server to implement moving target defense by randomly changing parameters while terminals can still efficiently locate and access the server through domain name resolution, thus maintaining high service efficiency.
Solution Approach 2:
The patent implements dynamic communication parameters for the server that can change randomly, increasing the cost for attackers to identify and target the server. Simultaneously, the DNS mechanism ensures that legitimate terminals can efficiently locate the server through domain name resolution, maintaining service efficiency despite the dynamic parameter changes.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
The present invention provides a service request processing method and a device. The method comprises: sending a query request for querying a domain name of a server to a domain name server (DNS); receiving a query response returned according to the query request, wherein the query response carries a first identifier of an identification gateway (IDGW); sending a service request to the IDGW according to the first identifier, wherein the service request is for the IDGW to convert the first identifier into a second identifier of the server and to forward the service request to the server according to the second identifier; and receiving a service response message returned by the server in response to the service request. The present invention solves the problem in the art in which normal service is affected when a server randomly changes a parameter, thereby realizing active protection of a target server, and improving security of an entire server system.