QUIC Retry Verification for UDP Flood Source Address Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional UDP flood attack defense mechanisms struggle to distinguish between normal packets from clients and attack packets, leading to the inadvertent discard of legitimate traffic and damage to normal services.
Innovation Solution
A method and apparatus that utilize the QUIC protocol to send retry packets to the source address of intercepted initial packets, identifying attack sources by lack of response, and employing blocklists and trustlists to manage and update source addresses based on verification failures or responses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If a rate limiting mechanism is used to defend against UDP flood attacks, then the attack traffic can be reduced, but normal service packets may be incorrectly discarded
Solution Approach 1:
The patent implements a feedback mechanism by sending retry packets to source addresses and evaluating whether response packets are received. Normal clients that receive retry packets will respond, while attackers using forged IP addresses will not. This feedback loop enables the system to dynamically adjust packet handling based on actual source legitimacy, resolving the contradiction between blocking attacks and maintaining service reliability.
Solution Approach 2:
The patent introduces an intermediary verification process using retry packets as a mediator between the protecting device and potential sources. Instead of directly accepting or rejecting packets based solely on rate limiting, the system uses retry packets to mediate the verification process, allowing normal clients to prove their legitimacy through response while automatically filtering out attackers who cannot respond.
2Object-affected harmful factors
If all packets above a certain rate threshold are discarded, then the system can defend against DDOS attacks, but normal service may be damaged
Solution Approach 1:
The system uses feedback from response packets to distinguish between legitimate and malicious traffic. Normal clients that receive retry packets within the threshold will respond, providing positive feedback that identifies them as legitimate. Attackers whose packets exceed the threshold will not respond, allowing the system to selectively block only the malicious traffic while maintaining normal service operation.
Solution Approach 2:
The patent changes the parameter used for packet filtering from a static rate threshold to a dynamic verification result. Instead of simply discarding all packets above a certain rate, the system modifies the approach by sending retry packets and using the presence or absence of responses as the filtering criterion. This parameter change enables selective blocking that preserves normal service while defending against attacks.
3Object-affected harmful factors
If the firewall discards packets based on transmission rate, then attack traffic can be blocked, but the ability to identify packet origin is lost
Solution Approach 1:
The patent restores source address identification accuracy by implementing a feedback mechanism. Instead of merely discarding packets based on rate, the system sends retry packets to potential sources and uses the presence or absence of responses as feedback to accurately identify whether a source address is legitimate or forged. This feedback loop recovers the ability to precisely measure and identify packet origins.
Solution Approach 2:
The retry packet serves as an intermediary that enables accurate source address identification. By introducing this intermediate verification step, the system can determine whether a source address is genuine (normal client responds) or forged (attacker does not respond), thereby restoring measurement precision that was lost in simple rate-based filtering.
Data Source
AI summary
This application discloses a method for identifying a source address of a packet and an apparatus, and pertains to the field of network security. A protecting device intercepts a packet whose destination address is an IP address of a protected device, where the protected device provides a service according to the QUIC protocol. The protecting device sends a retry packet to a source address of the packet in response to that the packet is an initial packet. The protecting device identifies the source address of the packet as an attack source address if the protecting device receives no response packet corresponding to the retry packet. The protecting device determines the source address of the intercepted initial packet to identify an attack source address used by an attacker, and subsequently prevents only packets from the attack source address from being sent to the protected device.