UDP DDoS Protection via STUN IP Allocation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for protecting User Datagram Protocol (UDP) from Distributed Denial of Service (DDoS) attacks are ineffective due to the lack of accurate filtering techniques for UDP spoofed attacks, which are complex to implement and often circumvented by attackers, and require changes to applications or servers, affecting latency and bandwidth.
Innovation Solution
A system utilizing a Session Traversal Utilities for Network Address Translation (STUN) server to allocate destination IP addresses and ports from a pool, detecting high traffic volumes to identify DDoS attacks, and blocking the affected IP addresses by stopping port allocations and sending blackholing requests to upstream routers, without requiring changes to the application or server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If filtering techniques are applied per source IP for non-spoofed attacks, then protection effectiveness is improved, but the system becomes vulnerable to spoofed attacks where source IPs are fake
Solution Approach 1:
The patent introduces a intermediary allocation mechanism that assigns temporary destination IP addresses and ports from a pool to application servers. This intermediary layer prevents direct exposure of real server IPs to attackers, making spoofed attacks ineffective since the attack target is dynamically allocated rather than fixed. The intermediary allocation system acts as a buffer between attackers and legitimate servers.
2Reliability
If existing filtering methods are implemented, then some protection is provided, but they require changes to applications or servers which affects latency and bandwidth
Solution Approach 1:
The system performs preliminary allocation of destination IP addresses and ports to application servers before any attack occurs. This pre-allocation creates a ready-to-use protection layer that requires no runtime modifications to applications or servers. When attacks are detected, the pre-configured allocation system can immediately respond by blocking traffic to specific allocated IPs without introducing latency through dynamic computation or application changes.
3Reliability
If traffic is redirected to scrubbing centers for DDoS protection, then attack filtering is improved, but internet bandwidth limitations and increased latency occur
Solution Approach 1:
The patent extracts the protection functionality from external scrubbing centers and implements it locally through the allocation system. By detecting attacks on allocated destination IPs and automatically blocking them at the local level, the system eliminates the need to redirect traffic over the internet to remote scrubbing centers. This local extraction of protection capability maintains high processing speed and avoids internet bandwidth limitations while still providing effective attack filtering.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system for protecting application servers using User Datagram Protocol (UDP) from Distributed Denial of Service (DDoS) attacks, comprising: a protocol interface adapted to receive from a Session Traversal Utilities for Network Address Translation (STUN) server a plurality of requests for a source Internet Protocol (IP) address and source port, the plurality of requests originated from at least one application server; a processing unit adapted to allocates an available destination IP address and a destination port from a pool of destination IP addresses and destination ports and provides the STUN server the allocated destination IP address and destination port in response to the reception of the plurality of requests; wherein the processing unit identifies a DDoS attack on one of the allocated destination IP addresses by detecting high traffic volume on the one of the allocated destination IP addresses, and blocking the attacked destination IP address.