Pre-generated Key Pool for DoS Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure socket layer (SSL) protocols are vulnerable to denial of service (DoS) attacks, particularly during the key exchange process, where attackers can overwhelm servers by requesting multiple session setups without establishing a valid session, leading to resource depletion and service interruption.
Innovation Solution
Implementing a method where a server checks if a client is on a whitelist before generating a public key, sending a pre-generated key instead if the client is unknown, and forcing renegotiation of the secure session once the client's validity is confirmed, using methods like DHE or ECDHE for secure key exchange.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the server generates a public key for each session request using key-agreement protocol, then secure session establishment is achieved, but server computational resources are depleted leading to DoS vulnerability
Solution Approach 1:
The server performs preliminary actions by pre-generating and storing multiple public keys in a pool before DoS attacks occur. During session requests, the server simply retrieves pre-generated keys rather than computing new ones, eliminating the computational burden while maintaining secure session establishment capability
Solution Approach 2:
The server creates copies of public keys from a pre-generated pool and provides them to multiple clients simultaneously. Instead of generating unique computational resources for each request, the server replicates existing public key materials, allowing multiple secure sessions to be established without proportional increases in computational effort
2Adaptability or versatility
If the server processes multiple session requests simultaneously, then service availability is maintained, but resource exhaustion occurs enabling DoS attacks
Solution Approach 1:
The server prepares multiple public keys in advance and stores them in a readily accessible pool. When multiple session requests arrive simultaneously, the server can immediately serve them from the pre-prepared pool without performing computationally expensive key generation operations, thus maintaining service availability while avoiding resource exhaustion
Solution Approach 2:
The pre-generated public key pool serves itself automatically without requiring active computational resources from the server during session establishment. The static key materials can be served to multiple clients concurrently without additional processing overhead, allowing the system to handle multiple requests without proportional resource consumption
Data Source
AI summary
Provided are methods and systems for mitigating a DoS attack. A method for mitigating a DoS attack may commence with receiving, from a client, a request to initiate a secure session between the client and a server. The method may continue with determining whether the client is on a whitelist. Based on a determination that client is absent from the whitelist, a pre-generated key may be sent to the client. The method may include determining validity of the established secure session. The determination may be performed based on further actions associated with the client. Based on the determination that the secure session is valid, a renegotiation of the secure session may be forced. The method may further include generating a new key using a method for securely exchanging cryptographic keys over a public channel. The new key is then sent to the client.