Socket Per User Server Connectivity System for DoS Attack Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional video games are vulnerable to denial-of-service (DoS) attacks, which disrupt network functionality and negatively impact player enjoyment by allowing malicious players to gain unfair advantages, and current matchmaking techniques fail to adequately address these issues.
Innovation Solution
Implementing a socket per user server connectivity system that authenticates users and prioritizes legitimate network traffic by creating authenticated sockets for each user, de-prioritizing and disconnecting non-authenticated sockets with suspicious or malicious traffic to ensure legitimate traffic is processed, while maintaining minimal connectivity with malicious users to avoid detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional matchmaking techniques are used, then users can connect to multiplayer sessions, but the system becomes vulnerable to DoS attacks and network functionality is disrupted
Solution Approach 1:
The patent segments network traffic handling by creating separate authenticated and non-authenticated socket queues. Authenticated user traffic is placed in a dedicated queue with higher priority, while non-authenticated traffic (potentially malicious) is placed in a separate queue. This segmentation isolates harmful factors from the core network functionality, preventing DoS attacks from disrupting authenticated user connections.
2Productivity
If all network traffic is processed equally, then all users are treated fairly, but malicious traffic can overwhelm the system and prevent legitimate traffic from being processed
Solution Approach 1:
The patent applies local quality by assigning different processing priorities to different types of network traffic based on authentication status. Authenticated user traffic receives high-priority processing with guaranteed bandwidth, while non-authenticated traffic receives lower-priority processing. This differential treatment ensures that legitimate traffic maintains productivity while malicious traffic is naturally throttled and cannot overwhelm the system.
3Reliability
If the system disconnects users with suspicious traffic immediately, then DoS attacks are mitigated, but bona fide users may be wrongly disconnected
Solution Approach 1:
The patent implements preliminary action by establishing an authentication phase before full network access is granted. Users must successfully authenticate and join a lobby before their traffic is fully trusted. During this preliminary phase, traffic is monitored and placed in the non-authenticated queue. Only after successful authentication does the system transition the user to the authenticated queue, preventing premature disconnection of legitimate users while maintaining security.
4Reliability
If authenticated sockets are created for each user, then legitimate traffic is prioritized, but system complexity increases
Solution Approach 1:
The patent applies universality by using a single socket interface for both authenticated and non-authenticated users, with the difference being the queue assignment rather than separate socket implementations. The socket infrastructure itself remains universal and unchanged; what changes is the logical routing of traffic to different priority queues based on authentication status. This reduces complexity compared to implementing entirely separate socket systems for authenticated and unauthenticated users.
Data Source
AI summary
Various aspects of the subject technology relate to systems, methods, and machine-readable media for authenticating user accounts. The method includes authenticating at least one user account of a plurality of user accounts for lobbying into a session. The method includes generating at least one authenticated socket in a server for each authenticated user account. The method includes adding the at least one user account to the at least one authenticated socket. The method includes adding non-authenticated user accounts to non-authenticated sockets of a plurality of non-authenticated sockets. The method includes detecting network traffic flowing into the plurality of authenticated sockets and the plurality of non-authenticated sockets. The method includes disconnecting non-authenticated user accounts from the server when a threshold amount of suspicious and/or malicious network traffic is detected in a non-authenticated socket.