Verifiable Delay Functions for DoS Rate-Limiting in Edge Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Decentralized data delivery networks are vulnerable to malicious attacks such as denial-of-service (DoS) and spamming, which disrupt legitimate access and cause network congestion, as they rely on peer nodes to distribute content without a central server, making it challenging to design secure and efficient protocols for large data distribution.
Innovation Solution
Implementing verifiable delay functions (VDFs) in client-server and peer-to-peer networks to rate-limit requests, where a server or node issues a VDF puzzle to clients or peers, requiring them to solve it before receiving further requests, thereby preventing malicious attacks by ensuring sequential computations cannot be parallelized, thus defending against DoS and spamming.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If decentralized peer-to-peer networks are used for data distribution, then network robustness and scalability are improved, but vulnerability to denial-of-service attacks increases
Solution Approach 1:
The system performs preliminary actions by requiring clients to solve VDF puzzles before allowing them to make requests to the network. This preliminary computational task creates a time delay that prevents malicious clients from launching immediate DoS attacks, while still allowing legitimate clients to access the network after completing the puzzle. The VDF puzzle is generated in advance and must be solved sequentially, creating a barrier against spamming and flooding attacks.
Solution Approach 2:
The VDF puzzle acts as an intermediary mechanism between the client and the network resources. Instead of directly granting access to the network, the system introduces the VDF puzzle as an intermediate step that must be completed. This intermediary computational task verifies client legitimacy without requiring trust in the client, thereby protecting the decentralized network from malicious actors while maintaining accessibility for legitimate users.
2Reliability
If rate-limiting mechanisms are implemented to prevent malicious attacks, then network security is improved, but request processing speed decreases
Solution Approach 1:
The system changes the parameter of time by introducing a time delay through VDF puzzle solving. The puzzle is designed to take a specific amount of time to solve (e.g., several seconds), which automatically rate-limits the request frequency. Legitimate clients can still make requests at reasonable intervals, while malicious clients attempting to flood the network are naturally throttled by the time required to solve each puzzle. This parameter change achieves security without requiring complex active monitoring or rejection mechanisms.
Solution Approach 2:
The rate-limiting mechanism is self-service in that clients automatically perform the VDF puzzle solving without requiring external intervention from the network. The client's own computational effort and time investment serve as the rate-limiting factor. This eliminates the need for complex server-side rate-limiting infrastructure, as the security mechanism is distributed and performed by each client independently, maintaining both security and network responsiveness.
3Object-affected harmful factors
If verifiable delay functions are used to rate-limit requests, then protection against spamming is improved, but computational overhead increases
Solution Approach 1:
The VDF puzzle is designed as a cheap, disposable computational task that clients perform temporarily to gain network access. The puzzle parameters can be adjusted to require modest computational resources (e.g., solving a puzzle that takes a few seconds), making it affordable for legitimate clients but sufficiently burdensome to prevent spamming. The puzzle is discarded after solving, and each client can generate new puzzles as needed, creating an economical security mechanism that scales with the number of legitimate users.
Solution Approach 2:
The system applies partial action by requiring only a portion of the client's computational capacity to be used for the VDF puzzle, rather than requiring full computational resources. The puzzle is designed to consume a reasonable amount of time and energy (e.g., several seconds of CPU time), which is excessive enough to prevent automated spamming but not so excessive as to burden legitimate clients. This partial computational requirement achieves effective spam protection while maintaining usability for genuine users.
Data Source
AI summary
Methods and systems are described for reducing malicious attacks on a first device in a computer network comprising a plurality of devices. The method may include, receiving by the first device, a request for a service from a second device. Next, determining that the second device is suspicious based on the request. Next, generating a verifiable delay function (VDF) based on the determination and transmitting the VDF to the second device. Then, receiving a solution associated with the VDF after a predetermined time duration, and verifying that the solution is correct. Finally, generating, based on the verification, a response to the request for the service from the second device. The network can include a client-server network, a decentralized network, or a decentralized data streaming network; the first device can include a server device, a first peer node, or a cacher peer node; and the second device can include a client device, a second peer node, or a viewer peer node.