Guard System Token Handshake for NAT DDoS Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for mitigating Distributed Denial of Service (DDoS) attacks are ineffective when malicious packets are relayed through Network Address Translation (NAT) devices or proxy servers, as they block legitimate traffic alongside malicious traffic due to shared source IP addresses.
Innovation Solution
Implementing a guard system that requires incoming messages to contain an encoded token, such as a cookie, and performs handshaking to authenticate clients, allowing legitimate traffic while blocking malicious traffic by throttling or blocking messages without impacting other clients behind the NAT or proxy server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If conventional methods block traffic from suspect IP addresses to mitigate DDoS attacks, then malicious traffic is filtered, but legitimate traffic from the same IP address is also blocked
Solution Approach 1:
The patent segments the identification of legitimate traffic from the identification of malicious traffic by introducing encoded tokens (cookies) that are distributed to individual clients. This allows the system to distinguish between multiple clients behind the same NAT device, segmenting the traffic control at the client level rather than the IP address level.
Solution Approach 2:
The patent introduces an intermediary encoded token (cookie) that acts as a mediator between the guard system and clients behind NAT devices. The cookie serves as proof of legitimate communication, allowing the guard system to verify client identity without blocking traffic from the shared IP address.
2Reliability
If the guard system requires encoded tokens for authentication, then legitimate clients can be identified, but the system complexity increases
Solution Approach 1:
The patent uses encoded tokens (cookies) that are copied and distributed to multiple clients behind NAT devices. Each client receives a copy of the token, which they include in subsequent communications. This copying mechanism provides simple authentication without requiring complex verification infrastructure.
3Object-affected harmful factors
If traffic from NAT devices is blocked to prevent DDoS attacks, then malicious packets are stopped, but all clients behind that NAT device lose connectivity
Solution Approach 1:
The patent segments the traffic control mechanism from the IP address level to the individual client level by using encoded tokens. This allows the guard system to selectively block or allow traffic from specific clients behind NAT devices without affecting other clients, thereby maintaining ease of operation for legitimate users while preventing attacks.
Solution Approach 2:
The encoded token serves as an intermediary that enables the guard system to identify and differentiate individual clients behind NAT devices. This intermediary mechanism allows selective traffic management, preventing complete blocking of connectivity for all clients behind a single NAT device.
Data Source
AI summary
A method for authenticating communication traffic includes receiving an initial incoming message, sent over a network from a source address to a destination address. In reply to the initial incoming message, an outgoing message containing an encoded token is sent to the client. Upon receiving a number of further incoming messages from the source address containing the encoded token, delivery of one or more of the further incoming messages to the destination address is inhibited when the number exceeds a predetermined threshold.