Network Traffic Management Device JavaScript Challenge for DoS Mitigation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current network attack prevention solutions, particularly at Layer 4 of the OSI layer, are not application-aware and fail to precisely detect denial of service (DoS) and distributed denial of service (DDoS) attacks, requiring server resources and being ineffective against large-scale attacks.

Innovation Solution

A network traffic management device intercepts client requests, returns them with client-side JavaScript code to be executed, and only forwards legitimate requests after the client has processed the challenge, thereby identifying and mitigating potential attacks by placing additional burdens on attacking client devices.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If network firewalls are used to intercept and filter traffic to distinguish legitimate requests from malicious packets, then attack prevention capability is improved, but device complexity and processing overhead increase significantly

Engineering Contradiction:

Improveattack prevention capabilityVSAvoidfirewall complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent applies preliminary action by returning JavaScript code to client devices before processing requests, requiring clients to execute the code and return results. This pre-processing step filters malicious traffic before it reaches the server, reducing the burden on firewalls and simplifying their filtering tasks while maintaining strong attack prevention capability

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces JavaScript code execution as an intermediary mechanism between the client and server. The JavaScript code acts as a mediator that performs initial validation and filtering on the client side, reducing the complexity burden on network firewalls while maintaining reliable attack detection

Inventive Principle:

Principle #24Intermediary (Mediator)

2Productivity

If server resources are consumed to process all incoming requests, then request handling capability is improved, but vulnerability to DoS attacks increases as resources are exhausted

Engineering Contradiction:

Improverequest handling capabilityVSAvoidserver availability under attack

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent applies preliminary action by requiring client devices to execute JavaScript code and return results before requests are forwarded to the server. This pre-validation process filters out malicious requests early in the pipeline, ensuring that server resources are only consumed by legitimate requests, thereby maintaining both high request handling capability and server availability under attack

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent extracts the request validation function from the server and moves it to the client side through JavaScript execution. By taking out the filtering burden from the server, legitimate requests are processed efficiently while malicious requests are identified and blocked before consuming server resources, maintaining server availability during attacks

Inventive Principle:

Principle #2Taking out (Extraction)

3Reliability

If current Layer 4 firewall solutions are used to protect against DoS attacks, then basic traffic filtering is improved, but effectiveness against large-scale application-layer attacks deteriorates

Engineering Contradiction:

Improvetraffic filtering capabilityVSAvoidattack detection accuracy

Core Design Contradiction:

ReliabilityVSMeasurement precision

Solution Approach 1:

The patent applies preliminary action by implementing JavaScript code execution at the network edge before requests reach application-layer firewalls. This pre-processing step performs initial attack detection and filtering, allowing Layer 4 firewalls to focus on basic traffic filtering while the JavaScript mechanism handles application-layer attack detection, achieving both broad filtering capability and precise attack detection

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent segments the attack detection and filtering process into multiple layers: JavaScript code execution handles application-layer validation at the client edge, while Layer 4 firewalls handle network-layer traffic filtering. This segmentation allows each component to specialize in its strength, improving both filtering capability and detection accuracy

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS11108815B1Methods and system for returning requests with javascript for clients before passing a request to a server

Publication Date: 2021.08.31 F5 NETWORKS INC

AI summary

Identifying potential network attacks on servers and protecting the servers from those potential attacks until the associated client requests can be confirmed as either legitimate or an actual attack is disclosed. Client requests for server resources are received by a network traffic management device (NTMD). The NTMD initially responds to the client requests on behalf of the associated servers. The initial responses include client side language scripts for execution by the clients. Executing the scripts causes the clients to resend their initial requests identified as a potential attack by the NTMD along with information indicating the client's legitimacy, such as the result of a computational JavaScript challenge. The NTMD receives the resent initial request, determines it was sent from a legitimate requestor and is therefore not an attack, and forwards it to the associated server.