Web Conferencing DDoS Mitigation via Middlebox OTP Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Web conferencing platforms are vulnerable to distributed denial of service (DDoS) attacks during connectivity checks, which conventional security measures struggle to mitigate effectively, especially when dealing with large volumes of requests.
Innovation Solution
Implementing a middlebox that validates incoming requests for connectivity checks using a one-time password (OTP) scheme, such as the Lamport OTP algorithm, and message integrity validation, to authenticate and filter out invalid requests, potentially offloading excessive traffic to a DDoS Open Threat Signaling (DOTS) server when necessary.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional security measures are used to protect against DDoS attacks, then network security is improved, but the ability to handle large volumes of requests during connectivity checks deteriorates
Solution Approach 1:
The system performs preliminary actions by pre-establishing a seed value and sharing it with the middlebox before the DDoS attack occurs. The middlebox uses this seed to generate expected passkey values in advance, enabling rapid validation of incoming connectivity check requests without requiring persistent signaling or complex authentication during the attack.
Solution Approach 2:
The patent extracts the authentication logic from the web conferencing server and places it in the middlebox (firewall/NAT device). The middlebox independently validates connectivity check requests using the extracted seed value and passkey generation algorithm, removing the authentication burden from the server and enabling it to handle large volumes of requests efficiently.
2Reliability
If authentication validation is performed for each connectivity check request, then security against invalid requests is improved, but processing time and network overhead increase
Solution Approach 1:
The middlebox performs self-service authentication by using the pre-shared seed value to independently generate and validate passkey values. It does not require continuous communication with the web conferencing server for authentication, enabling fast local validation of connectivity check requests while maintaining security.
Solution Approach 2:
The system uses periodic action through the sequential generation of passkey values based on a counter. The middlebox validates requests by checking if the provided passkey matches the expected value generated from the current counter state, enabling efficient validation without persistent signaling. The counter increments periodically to generate new passkey values.
3Object-affected harmful factors
If a middlebox validates connectivity checks using OTP scheme, then DDoS mitigation capability is improved, but device complexity increases
Solution Approach 1:
The patent applies parameter changes by transforming the authentication mechanism into a simple passkey validation system. The middlebox changes from performing complex authentication to validating simple passkey values generated from a seed and counter, significantly reducing computational complexity while maintaining DDoS mitigation capability.
Solution Approach 2:
The system uses disposable passkey values that are generated once and validated once, then discarded. Each passkey is tied to a specific counter value and time window, making them single-use credentials. This eliminates the need for complex persistent authentication mechanisms while providing effective DDoS protection.
Data Source
AI summary
A web conferencing operator can enable participants to share multimedia content in real-time despite one or more of the participants operating from behind a middlebox via network address translation (NAT) traversal protocols and tools, such as STUN, TURN, and/or ICE. In NAT traversal, participants share a transport addresses that the participants can use to establish a joint media session. However, connectivity checks during NAT traversal can expose a media distribution device hosted by the web conferencing operator to various vulnerabilities, such as distributed denial of service (DDoS) attacks. The web conferencing operator can minimize the effects of a DDoS attack during the connectivity checks at scale and without significant performance degradation by configuring the middlebox to validate incoming requests for the connectivity checks without persistent signaling between the web conference operator and the middlebox.