Realization of DDoS Resilience Through XDP-Based Communication Control With Individual Identification Tokens in UDP Data

Distributed Denial of Service (DDoS) attacks remain a critical threat to Internet services, depleting server resources through massive and often spoofed traffic. This paper aims to establish a communication environment in which such attacks are institutionally infeasible, overcoming the limitations of traditional approaches such as IP-based filtering, CDN absorption, and CAPTCHA-based countermeasures. Specifically, we propose a communication architecture that embeds cryptographically verifiable individual identification tokens in the UDP payload and verifies them at the NIC driver layer using eBPF/XDP. In this architecture, the communication unit is redefined from the conventional IP address to a token-based ID, allowing unregistered traffic to be discarded immediately at the earliest stage. The proposed method is characterized by its ability to block malicious traffic before any bandwidth consumption occurs, while accurately allowing only legitimate token-based communications to pass through to the network stack. Furthermore, per-ID rate control is introduced to institutionally suppress excessive or malicious use. A Bloom filter-based approximate check is also placed at the first stage to reduce per-packet processing costs and significantly lower CPU utilization. Experimental evaluations with large-scale SYN flood, UDP flood, and HTTP flood attacks demonstrate that, even when using a typical PC (Core i9 12thGen, 16 cores, 24 threads, up to 5.2 GHz), CPU utilization remains 64.09% in a 20 GbE environment for SYN flood and 80.48% for UDP floods with invalid tokens. In the case of HTTP floods, while conventional software-based defenses easily drive CPU usage around 100% in a 10,000 req/s, the proposed method suppresses it to less than 1.54%, while maintaining the availability of legitimate traffic even under attack. These results indicate that DDoS attacks become structurally infeasible under the proposed communication model.