DDoS Mitigation for SSL Services via Cloud Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for mitigating Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks on encrypted services, such as those using SSL, are ineffective as they require decryption which necessitates possession of private keys and certificates, posing security risks and being computationally expensive, especially for large-scale attacks.
Innovation Solution
A system comprising attack mitigation devices that decrypt and analyze encrypted network traffic to detect attacks, generate attack signatures, and send them to cloud-based services for blocking malicious traffic without needing to decrypt the entire incoming traffic, thus offloading processing to the cloud for scalable mitigation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional SSL proxy or WAF devices are used to decrypt and detect encrypted DoS/DDoS attacks, then attack detection capability is improved, but computational resource consumption and security risk increase
Solution Approach 1:
The system divides the attack mitigation function into two segments: on-premise attack mitigation devices that perform decryption and attack detection, and cloud-based services that provide mitigation actions. This segmentation allows the computationally intensive decryption and detection to be performed locally with limited resources, while leveraging cloud scalability for coordinated response.
Solution Approach 2:
The patent introduces cloud-based services as an intermediary between the on-premise attack mitigation devices and the target network. The cloud services receive attack signatures from multiple customers, correlate them, and provide coordinated mitigation actions, reducing the computational burden on individual on-premise devices while improving overall detection accuracy through aggregated intelligence.
2Adaptability or versatility
If cloud-based services manage private keys and certificates for DDoS prevention, then service scalability is improved, but data security risk increases
Solution Approach 1:
The system segments key management responsibilities: on-premise attack mitigation devices securely store and manage private keys and certificates locally, while cloud-based services provide scalable attack signature correlation and mitigation coordination. This segmentation maintains data security by keeping sensitive cryptographic materials on-premise while achieving scalability through cloud-based analytics.
3Measurement precision
If on-premise devices perform full decryption and analysis of all incoming traffic, then attack detection accuracy is improved, but network latency and throughput degradation occur
Solution Approach 1:
The on-premise attack mitigation devices perform partial decryption and analysis focused specifically on detecting attack patterns rather than fully decrypting and inspecting all traffic content. By applying partial action (selective decryption and targeted analysis), the system achieves sufficient attack detection accuracy while minimizing the computational overhead that would cause network latency and throughput degradation.
Data Source
AI summary
A system for mitigating network attacks within encrypted network traffic is provided. The system includes a protected network including a plurality of devices. The system further includes attack mitigation devices communicatively coupled to the protected network and to a cloud platform. The attack mitigation devices are configured and operable to decrypt the encrypted traffic received from the cloud platform and destined to the protected network to form a plurality of decrypted network packets and analyze the plurality of decrypted network to detect attacks. The attack mitigation devices are further configured to generate, in response to detecting the attacks, attack signatures corresponding to the detected attacks and configured to send the generated attack signatures to attack mitigation services provided in the cloud platform. The attack mitigation services are configured and operable to drop encrypted network traffic matching the attack signatures received from the attack mitigation devices.