Multi-path Network Routing via Pseudo-random Intermediate Nodes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network systems are vulnerable to denial-of-service (DoS) attacks, which can be launched by attackers who possess knowledge of the client's communication parameters, allowing them to target specific nodes and disrupt connectivity, leading to service degradation or unavailability.
Innovation Solution
Implementing a multi-path network system that uses pseudo-random functions to route packets through multiple intermediate nodes, ensuring that neither the client nor the attacker can predict the path, thereby making it difficult for attackers to mount effective DoS attacks by spreading packets across nodes without maintaining application or network-level state.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a network uses a single intermediate node for routing traffic, then the routing is simple and direct, but the system becomes vulnerable to targeted DoS attacks where attackers can discover and attack specific nodes
Solution Approach 1:
The patent divides the network routing into multiple segments by introducing multiple intermediate nodes between clients and destinations. Instead of a single routing path, traffic is segmented across several nodes (e.g., client → node A → node B → destination), making it harder for attackers to compromise the entire path by attacking a single node.
Solution Approach 2:
The patent adds a dimensional layer of indirection to the routing structure by introducing intermediate nodes that act as proxies. This creates an additional dimension in the network path (client → intermediate node → actual destination), hiding the true destination from clients and making targeted attacks more difficult.
2Reliability
If a network uses multiple intermediate nodes with pseudo-random routing, then the system becomes resistant to targeted DoS attacks, but the routing complexity and computational overhead increase
Solution Approach 1:
The patent implements dynamic routing where intermediate nodes are selected pseudo-randomly for each communication session or packet. This dynamic selection changes the routing path over time, preventing attackers from establishing persistent attack paths while maintaining relatively simple node operations through randomized selection algorithms.
Solution Approach 2:
The patent introduces intermediate nodes as mediators between clients and destinations. These intermediary nodes handle the complexity of routing decisions and path selection, shielding the actual destination from direct client knowledge and reducing the computational burden on end systems while maintaining attack resistance.
3Object-affected harmful factors
If attackers possess real-time knowledge of client connectivity information, then they can mount effective targeted attacks, but this requires attackers to have access to trusted system information
Solution Approach 1:
The patent extracts and removes sensitive connectivity information from the client-side system, placing it exclusively on the destination side. Clients no longer possess knowledge of intermediate node identities or routing paths, thereby removing the attack surface that would allow attackers with client access to mount targeted attacks on specific intermediate nodes.
Solution Approach 2:
The patent preemptively protects against information leakage by designing the routing system so that sensitive connectivity information is never exposed to clients in the first place. By preventing the initial acquisition of routing information, the system proactively neutralizes the threat of targeted attacks before they can be planned or executed.
Data Source
AI summary
Systems and methods for inhibiting attacks with a network are provided. In some embodiments, methods for inhibiting attacks by forwarding packets through a plurality of intermediate nodes when being transmitted from a source node to a destination node are provided, the methods comprising: receiving a packet at one of the plurality of intermediate nodes; determining at the selected intermediate node whether the packet has been sent to the correct one of the plurality of intermediate nodes based on a pseudo random function; and forwarding the packet to the destination node, based on the determining. In some embodiments an intermediate node is selected based on a pseudo random function. In some embodiments, systems and methods for establishing access to a multi-path network are provided.