Proxy Gateway Routing for DDoS-Resilient IP Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing DDOS attack mitigation systems are costly and often ineffective in identifying and blocking malicious attacks in a timely manner, leading to service disruptions and resource overloads.
Innovation Solution
A proxy gateway system that uses IP subnet addressing, cryptographic hashing, and redirect nodes to encrypt and route IP packets, validating client devices and mapping them to internal IP addresses, thereby hiding resource servers from direct access and distributing traffic across multiple nodes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing DDOS mitigation systems are used, then service protection is provided, but the systems are costly and often ineffective in identifying and blocking malicious attacks in a timely manner
Solution Approach 1:
The patent introduces a proxy gateway as an intermediary component between clients and resource servers. The proxy gateway receives client requests, performs authentication and cryptographic hash verification, and forwards legitimate requests to the resource server while blocking malicious traffic. This intermediary architecture isolates the resource server from direct exposure to DDOS attacks, providing effective protection without requiring complex mitigation systems at the server itself.
Solution Approach 2:
The system segments the network architecture into distinct functional components: client devices, proxy gateway, redirect nodes, and resource servers. Each component performs a specific function in the traffic flow and security verification process. This segmentation allows the complex security functions to be distributed and managed independently, reducing overall system complexity while maintaining reliable protection.
2Object-affected harmful factors
If traffic is routed through multiple nodes with cryptographic verification, then malicious traffic is filtered effectively, but processing time and system complexity increase
Solution Approach 1:
The proxy gateway performs authentication and cryptographic hash verification in advance, before forwarding requests to the resource server. By pre- validating client credentials and establishing secure connections, the system filters malicious traffic early in the request flow, preventing it from reaching the resource server. This preliminary action reduces the need for time-consuming verification at later stages.
Solution Approach 2:
The system replaces traditional mechanical firewall and intrusion detection mechanisms with cryptographic hash verification and digital authentication. Instead of relying on complex rule-based filtering systems that require extensive processing, the patent uses mathematical cryptographic functions that can be computed efficiently. The cryptographic hash of the client's public key is verified against stored values, providing fast and reliable malicious traffic identification.
3Reliability
If resource servers are hidden behind IP subnets and redirect nodes, then direct access to servers is prevented, but network routing complexity increases
Solution Approach 1:
Redirect nodes serve as intermediaries that simplify the network routing architecture. Instead of requiring complex direct routing to hidden resource servers, the proxy gateway communicates with redirect nodes using standard IP subnet addressing. The redirect nodes then forward traffic to the appropriate resource servers using pre-established mappings. This intermediary layer abstracts the complexity of server hiding mechanisms from the network routing infrastructure.
Solution Approach 2:
The proxy gateway performs multiple functions using a unified approach: it handles client authentication, generates cryptographic hashes, routes traffic to redirect nodes, and manages communication with resource servers. By consolidating these diverse functions into a single multi-functional component, the system reduces overall network routing complexity while maintaining reliable server protection through IP subnet hiding.
Data Source
AI summary
A system and method to protect resource servers from DDOS attacks is disclosed. A proxy gateway hides resource server using IP subnet addressing and receives authenticated IP packets. A cryptographic hash is generated, and destination IP packets address/ports are encrypted using a secret, algorithm, client IP address, resource server IP address, and port. The cryptographic hash and destination server are mapped into existing IP packet addresses, ports, or payload bits. The IP packets are routed to a redirect node in the public IP subnet of the proxy gateway. At the redirected node, the cryptographic hash is validated, and the resource server IP address and the port are extracted from mapping. Redirect node maps the clients public IP/port to an internal IP address and port associated with resource server and tunnels the IP packets from the redirect node to the resource server using the internal IP address and port.