Server Request Delay via Redirect Chains for DoS Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network services face challenges in detecting and mitigating attacks such as DoS and brute-force login attacks on Internet resources, which are difficult to address due to their complexity and the ability of attackers to overwhelm servers with large volumes of traffic or repeated requests.
Innovation Solution
Implementing a method where a server delays processing of requests by causing client devices to perform a series of redirects before fulfilling the initial request, thereby reducing the likelihood of successful attacks by abandoning requests after multiple redirects and preventing overwhelming of the server resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the server processes requests normally without delays, then the service response time is fast and user experience is good, but the server becomes vulnerable to DoS attacks and brute-force attacks
Solution Approach 1:
The server performs preliminary actions by redirecting requests through multiple locations before processing the actual request. This preliminary redirection sequence delays the attack traffic while allowing legitimate requests to eventually be fulfilled, thus protecting against DoS and brute-force attacks without completely blocking service
Solution Approach 2:
The invention introduces intermediary redirect locations as mediators between the client and the target resource. These intermediary locations act as buffer zones that slow down attack traffic while maintaining the ability to serve legitimate users, resolving the contradiction between security and service availability
2Reliability
If the server implements multiple redirect operations to delay requests, then attack mitigation effectiveness increases, but the complexity of the request handling process increases
Solution Approach 1:
The request handling process is segmented into multiple independent redirect operations rather than a single complex processing step. Each redirect location performs a simple, standardized operation, dividing the complex attack mitigation task into manageable segments that are easier to implement and maintain
3Productivity
If the server processes all incoming requests immediately, then productivity and service speed are maintained, but the server resources become overwhelmed during attacks
Solution Approach 1:
The server applies periodic delay actions through multiple redirect operations interspersed between request reception and fulfillment. This periodic interruption of request processing slows down attack traffic patterns while allowing legitimate requests to eventually complete, preventing resource exhaustion while maintaining service continuity
Data Source
AI summary
A method and apparatus for delaying responses to requests in a server are described. Upon receipt, from a client device, of a first request for a resource at a first location, a response that includes a redirection instruction to a second location is transmitted, where the response includes a first number of redirects that the client device is to complete prior to the first request being fulfilled. Upon receipt of a following request including a number of redirects, determining whether the number of redirects has been performed. When the number of redirects has not been performed the transmission of the redirection instruction is repeated with a number of redirects smaller than the first number of redirects until the receipt of a request indicating that the number of redirects has been performed. When the number of redirects has been performed the request is fulfilled.