SDN-Based DDoS Defense via Dynamic IP Assignment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional DDoS defense systems are flawed as they allow attackers to bypass protection by revealing the protected host's IP address, leading to black hole routing that discards legitimate user access traffic along with attack traffic, rendering services inaccessible to intended users.
Innovation Solution
Implementing a Software Defined Network (SDN) with separate control and data planes to dynamically assign multiple public network addresses for protected hosts, ensuring legitimate traffic is routed through a different address than the targeted by attackers, thereby preventing black hole routing from affecting legitimate user access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If black hole routing is used to filter DDoS attack traffic, then attack traffic is blocked, but legitimate user traffic is also discarded
Solution Approach 1:
The system segments traffic into attack traffic and legitimate traffic using SDN-based flow classification, allowing differential routing where attack traffic is blocked and legitimate traffic is forwarded to the protected host
Solution Approach 2:
The SDN controller acts as an intermediary between the routing device and the protected host, dynamically assigning alternative public network addresses and generating forwarding paths to redirect legitimate traffic around the black hole routing
2Device complexity
If a single public network address is assigned to a protected host, then traffic management is simple, but the host becomes vulnerable to DDoS attacks
Solution Approach 1:
The system dynamically assigns multiple public network addresses to the protected host based on attack detection, switching between addresses to evade DDoS attacks while maintaining simple address management through automated SDN control
Solution Approach 2:
The system changes the network address parameter dynamically by assigning alternative public network addresses when attacks are detected, allowing the protected host to escape attack traffic while maintaining service availability
3Object-affected harmful factors
If dynamic multiple public network addresses are assigned, then DDoS attack resilience is improved, but network address management complexity increases
Solution Approach 1:
The system provides self-service through automated SDN controller management that dynamically assigns and manages multiple public network addresses without requiring manual intervention, reducing the perceived complexity for network administrators
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Network traffic processing includes: determining whether one or more packets of network traffic associated with a first public network address have been dropped, the first public network address being associated with a target host; in response to the determination that the one or more packets associated with the first public network address have been dropped, assigning a second public network address to the network traffic and generating a forwarding path corresponding to the second public network address, wherein the second public network address is configured to receive the network traffic, and wherein the forwarding path is configured to forward the network traffic received at the second public network address to the target host; and notifying a filtering device to transmit the network traffic to the second public network address and cause the network traffic to be forwarded to the target host according to the forwarding path.