Proxy Server Challenge Mechanism for DDoS Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for mitigating Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks, including SSL DDoS attacks, are inefficient as they require significant server resources to challenge clients, which can overwhelm the server and fail to effectively distinguish between legitimate and malicious traffic, especially in botnet attacks where requests spread across multiple IP addresses.
Innovation Solution
Implementing a system where proxy servers monitor application servers, reroute traffic during attacks, and use client-challenge mechanisms such as HTTP redirects, SSL resumption, and HTTP cookies to validate legitimate clients, while discarding or rate-limiting malicious traffic, thereby reducing the burden on the server and allowing secure communication without decrypting encrypted traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the server directly services all client requests without discrimination, then the server maintains simplicity and readily available network services, but the server becomes vulnerable to DoS and DDoS attacks and cannot distinguish between legitimate and malicious traffic
Solution Approach 1:
The patent introduces a proxy server as an intermediary between clients and the application server. The proxy server receives and processes client requests, performing challenge-response validation to distinguish legitimate clients from attackers. It then forwards only validated requests to the application server, thereby protecting the server from DoS and DDoS attacks while maintaining service availability.
2Reliability
If the server implements client challenge mechanisms to distinguish legitimate clients, then the server can filter malicious traffic, but the server consumes significant resources that may be overwhelmed by botnet attacks
Solution Approach 1:
The proxy server acts as a resource buffer, absorbing the computational burden of challenge-response validation. By implementing the client challenge mechanism at the proxy layer rather than at the application server, the system can filter malicious traffic effectively while preventing resource exhaustion of the primary server.
Solution Approach 2:
The system segments the validation function from the service function. The proxy server handles the resource-intensive client validation challenges, while the application server focuses on servicing legitimate requests. This segmentation allows challenge processing to occur without overwhelming the application server's resources.
3Productivity
If the server ignores requests from single IP addresses during DoS attacks, then the server can overcome simple DoS attacks, but the server cannot detect or respond to DDoS attacks where requests are spread across multiple IP addresses
Solution Approach 1:
The proxy server intermediates between clients and the application server, implementing comprehensive client validation through challenge-response mechanisms. This validation occurs at the proxy layer, allowing the system to identify and block malicious requests from any IP address while permitting legitimate traffic to pass through to the application server.
Solution Approach 2:
The patent replaces the simple IP-based filtering mechanism with a challenge-response validation system. Instead of relying on IP address analysis alone, the system uses cryptographic challenges that require legitimate clients to prove their authenticity, thereby detecting and blocking DDoS attacks even when requests are distributed across multiple IP addresses.
4Reliability
If the server requires clients to perform preliminary challenge operations, then the server can separate legitimate clients from malicious clients, but the challenge process itself may overwhelm the server during large-scale DDoS attacks
Solution Approach 1:
The proxy server serves as a dedicated challenge processing intermediary, isolating the complexity of challenge-response validation from the application server. The proxy handles all cryptographic challenges and validation logic, while the application server simply receives and processes the filtered, validated requests. This architecture maintains reliability in client separation while managing system complexity through functional decomposition.
Data Source
AI summary
Methods and systems for detecting and responding to Denial of Service (“DoS”) attacks comprise: detecting a DoS attack or potential DoS attack against a first server system comprising one or more servers; receiving, at a second server system comprising one or more servers, network traffic directed to the first server system; subjecting requesting clients to one or more challenge mechanisms, the challenge mechanisms including one or more of challenging requesting clients to follow through HTTP redirect responses, challenging requesting clients to request Secure Sockets Layer (SSL) session resumption, or challenging requesting clients to store and transmit HTTP cookies; identifying one or more non-suspect clients; and forwarding, by the second server system, traffic corresponding to the one or more non-suspect clients to the first server system. Once a client has been validated, clients may communicate directly with application servers in a secure manner by transparently passing through intermediary proxy servers.