IP Resource Validation via Access Control for DDoS Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing DDoS attack mitigation systems face challenges in verifying the validity of IP resources, leading to potential disruptions and misallocation of network resources, especially when mitigation services are hosted in the cloud or within access provider infrastructures, and existing validation methods do not account for dynamic IP allocations or encrypted traffic.
Innovation Solution
A method involving an access control server that verifies the validity of IP resources by receiving a list from a client node, selecting resources for validation, and confirming their association with the client domain, using relay nodes or validation servers to ensure accurate IP resource management, even in dynamic allocation scenarios.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If DDoS mitigation services are hosted in the cloud, then service flexibility and scalability are improved, but the ability to verify IP resource validity and identify legitimate traffic deteriorates
Solution Approach 1:
The patent introduces an access control server as an intermediary component that mediates between the cloud-based DDoS mitigation service and the network infrastructure. This server verifies IP resource validity by checking against maintained lists of legitimate IP addresses and prefixes, enabling cloud-hosted services to achieve reliable validation without being physically present in the network path.
Solution Approach 2:
The system performs preliminary validation of IP resources by maintaining and checking against pre-established lists of legitimate IP addresses and prefixes before traffic reaches the mitigation service. This advance verification ensures that when mitigation actions are taken, they apply only to genuinely suspicious traffic rather than legitimate traffic misidentified as attack traffic.
2Reliability
If tunnels are set up to force invocation of DPS service, then DDoS attack detection capability is improved, but user latency and service complexity increase
Solution Approach 1:
The patent extracts the IP resource validation function from the main DDoS mitigation service flow and implements it as a separate, lightweight access control server. This extracted component performs quick validity checks using pre-maintained lists, allowing the main mitigation service to focus on analysis and response without the overhead of comprehensive validation, thereby reducing latency.
Solution Approach 2:
Instead of performing complete traffic analysis on all packets, the system applies partial validation by checking only essential IP resource legitimacy against maintained lists. This selective approach provides sufficient protection against misidentified legitimate traffic while avoiding the computational overhead that would cause significant latency.
3Reliability
If encrypted traffic is used, then traffic privacy and security are improved, but the ability to distinguish legitimate from suspicious traffic deteriorates
Solution Approach 1:
The system performs preliminary validation of IP resources (source addresses, destination addresses, prefixes) before encrypted traffic processing. By verifying that IP resources belong to legitimate domains through pre-maintained lists, the system establishes a trust foundation that allows encrypted traffic to be handled securely without needing to decrypt and analyze the content for legitimacy determination.
Data Source
AI summary
A method for verifying validity of an IP resource associated with a client domain, implemented in an access control server. The method includes: receiving a list of at least one IP resource associated with the client domain, transmitted from a client node of the client domain to the access control server; selecting at least one IP resource to be validated from the list; and verifying the validity of the at least one selected IP resource.