Network Guard Protocol Authentication for DDoS Defense
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to effectively distinguish between legitimate and zombie-generated traffic in Distributed Denial-of-Service (DDoS) attacks, as zombies can use legitimate IP addresses, making it difficult to filter out malicious packets.
Innovation Solution
A network guard device intercepts incoming traffic, challenges the source IP addresses to verify compliance with higher-level communication protocols like HTTP and DNS, and uses challenge/response methods to authenticate legitimate sources, blocking illegitimate traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional IP address filtering is used to block DDoS attack traffic, then network bandwidth consumption is reduced, but the system cannot distinguish between legitimate and zombie-generated traffic since zombies use legitimate IP addresses
Solution Approach 1:
The patent introduces an intermediary authentication mechanism between the IP filtering layer and the application layer. This intermediary system uses protocol compliance verification as a mediator to distinguish legitimate traffic from zombie traffic, even when both use legitimate IP addresses. The intermediary layer adds protocol analysis capabilities without completely redesigning the existing filtering infrastructure.
Solution Approach 2:
The patent segments the traffic filtering process into multiple independent layers: IP address filtering, protocol compliance verification, and application-layer authentication. Each layer handles specific aspects of traffic analysis, allowing the system to progressively filter traffic with increasing accuracy without overwhelming a single component with all filtering tasks.
2Reliability
If protocol compliance verification is implemented to authenticate traffic sources, then the ability to distinguish legitimate from malicious traffic is improved, but processing time and computational resources increase
Solution Approach 1:
The patent implements partial verification by checking only critical protocol elements rather than complete protocol compliance. The system performs selective verification of essential HTTP header fields and protocol structures, achieving sufficient authentication accuracy without the computational overhead of exhaustive protocol analysis. This partial action approach balances security requirements with processing efficiency.
3Object-affected harmful factors
If comprehensive protocol verification is performed on all incoming traffic, then zombie traffic identification is improved, but network throughput and service response time deteriorate
Solution Approach 1:
The patent performs preliminary protocol verification checks early in the traffic processing pipeline, before traffic reaches the application server. By conducting initial protocol compliance checks at the network edge or gateway, the system eliminates obviously malicious traffic in advance, preventing it from consuming application server resources. This preliminary action protects productivity by filtering harmful traffic before it impacts service throughput.
Data Source
AI summary
A method for authenticating communication traffic includes receiving a first message, sent over a network from a source address, requesting information from a server in accordance with a higher-level protocol. A challenge is sent to the source address in reply to the first message, in accordance with the higher-level protocol. A second message is received from the source address following the challenge, and the legitimacy of the source address is assessed by determining whether the second message contains a correct response to the challenge.