Security Protocol URI Validation Against DoS Connection Floods
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security protocols, such as the three-domain secure (3DS) security protocol infrastructure, are vulnerable to denial-of-service (DoS) attacks, which can bypass authentication processes, exposing vulnerabilities and allowing fraudulent transactions to succeed.
Innovation Solution
A method and system that involve obtaining validation information for compiling a uniform resource identifier (URI) and including it in a security protocol response message, transmitted via a private network, to validate connection requests and prevent unauthorized access, using time-limited and unique validation information to minimize the attack surface.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a stand-in server is configured to bypass challenge requests during a DoS attack, then the security protocol infrastructure can maintain availability, but vulnerabilities are exposed allowing fraudulent transactions to succeed
Solution Approach 1:
The system generates and distributes unique validation URIs to authorized devices before the DoS attack occurs. These pre-configured URIs contain embedded validation information that allows the security protocol computing device to identify legitimate requests in advance, enabling the system to maintain availability while filtering out fraudulent requests during the attack.
Solution Approach 2:
The patent introduces an intermediary validation mechanism where unique URIs act as mediators between the security protocol computing device and end-user devices. These URIs carry validation information that the intermediary system checks to determine whether to permit or block connection requests, thus protecting against vulnerabilities while maintaining legitimate access.
2Reliability
If validation information is included in URIs transmitted via public network, then DoS attacks can be prevented, but the attack surface increases due to potential URI manipulation
Solution Approach 1:
The system changes the parameter of validation information from static to time-limited and device-specific. Each URI contains validation information that is unique to a particular device and time period, which reduces the attack surface because manipulated or stale URIs become invalid. This dynamic parameter approach maintains protection while limiting exploitation opportunities.
3Measurement precision
If time-limited validation information is used in URIs, then legitimate requests can be validated accurately, but the system requires periodic updates increasing operational complexity
Solution Approach 1:
The system implements self-service mechanisms where the security protocol computing device automatically manages the generation, distribution, and validation of time-limited URIs. The device itself handles the complexity of tracking validation information lifecycles and regenerating expiring URIs, reducing the operational burden on external systems while maintaining high validation accuracy.
Data Source
AI summary
A method and system for a denial-of-service attack prevention in a security protocol is provided. The method may include obtaining validation information usable in validating a connection request for use in compiling a uniform resource identifier (URI). The URI may be usable by an end-user device in connecting to a security protocol computing device over a public network. The validation information may be included in a security protocol response message and transmitting the response message to an endpoint via a private network. The method may include receiving a request to connect to the security protocol computing device via a public network using the URI. The method may include validating the request using the validation information and permitting connection to the security protocol computing device.