Adaptive Load Balancer Connection Limits for Cloud Native Scaling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud native environments, load balancers struggle to effectively throttle connection requests based on source IP due to the loss of client IP information during connection setup, leaving applications vulnerable to DDOS attacks and resource exhaustion.
Innovation Solution
Implementing a load balancer controller that dynamically adjusts connection limits based on the scaling state of cloud native applications, using either cloud provider configurations or application-specific settings to enforce throttling policies, allowing the load balancer to manage connections according to the application's current instance count and subnet restrictions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the load balancer routes traffic to cluster nodes, then traffic distribution and resource utilization are improved, but client source IP information is lost and connection throttling capability deteriorates
Solution Approach 1:
The patent introduces an IP mask configuration as an intermediary mechanism between the load balancer and backend services. The IP mask is applied to the source IP address to preserve the client's source IP information while allowing the load balancer to distribute traffic. This intermediary approach enables both traffic distribution and source IP preservation to coexist by modifying how IP addresses are handled in the traffic routing path.
2Reliability
If connection limits are applied at the load balancer, then protection against DDOS attacks is improved, but flexibility in adapting to application scaling state deteriorates
Solution Approach 1:
The patent implements dynamic connection limits that automatically adjust based on the application's scaling state. When the application scales up or down, the connection limits are dynamically modified to match the new capacity. This dynamic approach ensures that the load balancer maintains effective DDOS protection while adapting to changing application requirements, resolving the contradiction between fixed security policies and flexible scaling needs.
3Device complexity
If the application waits for TLS handshake to determine client identity, then connection setup complexity is reduced, but vulnerability to DDOS attacks during initial connection increases
Solution Approach 1:
The patent applies IP masking and connection limit enforcement as preliminary actions during the initial connection setup phase, before the TLS handshake completes. By pre-processing the source IP address with the IP mask and evaluating connection limits early in the connection lifecycle, the system maintains simple connection setup procedures while establishing security controls that prevent DDOS attacks from exploiting the delayed client identification.
Data Source
AI summary
Systems and methods are disclosed for implementing cloud native application load balancing. In certain embodiments, a method may comprise operating a cloud native application load balancing system to implement a process to impose application scaling-based connection limits on a cloud native (CN) application via a load balancer, including obtaining, at a load balancer controller (LBC), a set of connection limits for the CN application, the set of connection limits correlated to a scaling state of the CN application. The method may include configuring the load balancer to apply the set of connection limits for incoming connection requests directed to the CN application, obtaining, at the LBC, an indication of an update to the set of connection limits based on a change in the scaling state of the CN application, and controlling the load balancer to implement the update to the set of connection limits.