Puzzle Proxy Server for DoS Attack Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network communication systems face increased network latency and operating overhead due to the requirement for servers to transmit cryptographic puzzles to clients immediately before establishing a network communication session, making them vulnerable to denial of service (DoS) attacks.
Innovation Solution
A DoS countermeasure framework where the server broadcasts cryptographic puzzles with a validity time, allowing clients to solve the puzzles before initiating communication, thereby reducing the need for immediate server-client interaction and mitigating DoS attacks through pre-generated puzzles stored in a puzzle proxy server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the server transmits cryptographic puzzles to clients immediately before establishing a network communication session, then the security against DoS attacks is improved, but the network latency and operating overhead increase
Solution Approach 1:
The patent applies preliminary action by having the server generate and broadcast cryptographic puzzles in advance, before any client requests arrive. The puzzles are made available to clients proactively, so when clients need to authenticate, the puzzles are already waiting for them. This eliminates the need for real-time puzzle transmission during session establishment, thereby reducing network latency while maintaining security.
Solution Approach 2:
The patent introduces a puzzle proxy server as an intermediary component. This proxy server stores and manages the cryptographic puzzles, acting as a mediator between the main server and clients. The proxy server handles puzzle distribution and validation, reducing the operational burden on the main server and improving overall system efficiency and response time.
2Reliability
If the server generates and verifies cryptographic puzzles for each client request, then the DoS attack mitigation is improved, but the computational resource consumption on the server increases
Solution Approach 1:
The patent applies self-service by designing the system so that clients independently solve the cryptographic puzzles using their own computational resources. The server only needs to generate the puzzles once and verify the solutions, rather than continuously generating and verifying puzzles for every interaction. This shifts the computational burden from the server to the client, reducing the server's energy consumption while maintaining DoS mitigation effectiveness.
Solution Approach 2:
The server performs puzzle generation in advance and stores them in the puzzle proxy server, rather than generating them on-demand for each client request. This preliminary generation reduces the real-time computational load on the server during client interactions, allowing the server to focus only on verifying solutions rather than creating puzzles from scratch each time.
3Reliability
If the puzzle complexity is increased to reduce request rates from attackers, then the DoS protection effectiveness is improved, but the computational cost for legitimate clients to solve puzzles increases
Solution Approach 1:
The patent applies parameter changes by making the puzzle difficulty adjustable and adaptive. The system can modify puzzle parameters such as the number of iterations or computational complexity based on observed attack patterns and legitimate traffic volumes. This allows the system to optimize the balance between protecting against DoS attacks and maintaining acceptable processing speeds for legitimate clients, dynamically adjusting the parameter set to match current system conditions.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In a method of network communication that mitigates denial of service attacks, a server broadcasts cryptographic puzzles with certain time intervals, where each puzzle is only valid for the given time interval. A client receives the puzzle, generates a solution for the puzzle, and sends a network request to the server along with the solution of the puzzle. The server verifies the puzzle solution. If the puzzle solution is valid and received within a designated validity time period, then the server processes the request of the client. The server generates the puzzle and transmits the puzzle to the client before the client generates a request for services from the server.