QUIC Source Address Verification Against UDP Flood Misclassification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional UDP flood attack defense mechanisms struggle to differentiate between normal packets from legitimate clients and attack packets, leading to the misclassification and discard of legitimate traffic, thereby damaging normal services.
Innovation Solution
A method and apparatus that intercepts initial packets using the QUIC protocol, sends retry packets to the source address, and identifies the source address as an attack source if no response is received, allowing for the differentiation between normal and attack packets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a rate limiting mechanism is used to defend against UDP flood attacks, then the attack traffic can be reduced, but normal packets may be incorrectly discarded
Solution Approach 1:
The patent applies preliminary action by sending a retry packet before making a final decision on whether to discard the initial packet. The protecting device sends a retry packet to the source address and waits for a response packet. Only if no response is received within a timeout period does the device discard the initial packet as an attack packet. This preliminary verification step ensures that normal packets are not incorrectly discarded while still effectively blocking attack packets.
2Object-affected harmful factors
If all packets above a threshold rate are discarded, then the attack target is protected, but legitimate service requests are also blocked
Solution Approach 1:
The patent implements feedback by monitoring whether source addresses respond to retry packets. The protecting device maintains a record of which source addresses have responded to retry packets and uses this feedback information to make subsequent packet forwarding decisions. Source addresses that respond to retry packets are identified as normal clients and their packets are allowed through, while non-responding addresses are identified as attackers and their packets are blocked. This feedback mechanism enables dynamic adjustment of packet handling based on actual client behavior.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
This application discloses a method for identifying a source address of a packet and an apparatus, and pertains to the field of network security. A protecting device intercepts a packet whose destination address is an IP address of a protected device, where the protected device provides a service according to the QUIC protocol. The protecting device sends a retry packet to a source address of the packet in response to that the packet is an initial packet. The protecting device identifies the source address of the packet as an attack source address if the protecting device receives no response packet corresponding to the retry packet. The protecting device determines the source address of the intercepted initial packet to identify, an attack source address used by an attacker, and subsequently prevents only packets from the attack source address from being sent to the protected device. This can not only effectively defend against an attack, but also ensure normal service running.