Authentication Server Load Balancing for DOS Attack Mitigation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

AAA servers face service disruptions and quality degradation due to friendly DOS attacks when numerous clients reconnect to the network, overwhelming the servers with bulk authentication requests.

Innovation Solution

Implementing a reservation mechanism where authentication servers dynamically allocate services to clients, reserving service for a predefined time interval and distributing requests across available servers to manage the load effectively.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If static AAA servers are used to enhance authentication service quality, then authentication service quality is improved, but the servers stop responding during DOS attacks

Engineering Contradiction:

Improveauthentication service availabilityVSAvoidserver response capability under load

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent implements dynamic load balancing that continuously monitors server status and redistributes authentication requests in real-time. When servers become unresponsive due to DOS attacks, the system dynamically reroutes requests to available servers, maintaining service availability while adapting to changing system conditions.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The system changes operational parameters by monitoring server response times and authentication request queues. When parameters indicate server overload or unresponsiveness, the load balancer adjusts routing parameters to redirect traffic, transforming the static server allocation into an adaptive system that responds to changing conditions.

Inventive Principle:

Principle #35Parameter changes

2Productivity

If AAA servers authenticate hundreds of computers per second, then authentication throughput is improved, but servers stop responding when all computers reconnect simultaneously

Engineering Contradiction:

Improveauthentication requests per secondVSAvoidserver responsiveness

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent segments the authentication service across multiple servers and introduces a load balancing layer that divides incoming authentication requests among available servers. This segmentation prevents any single server from being overwhelmed by bulk reconnection requests, maintaining both high throughput and server responsiveness.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The load balancer acts as an intermediary between clients and authentication servers, receiving authentication requests and intelligently distributing them. This intermediary layer absorbs traffic spikes and prevents direct overload of individual servers, maintaining system reliability during mass reconnection events.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Ease of operation

If computers reconnect after network disconnection, then network connectivity is restored, but bulk authentication requests overwhelm the AAA server

Engineering Contradiction:

Improvenetwork reconnection capabilityVSAvoidfriendly DOS attack effect

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The load balancing system performs preliminary actions by pre-monitoring server capacity and authentication request queues before bulk reconnections occur. When connection spikes are detected, the system proactively redistributes load to available servers, preventing overwhelming any single server and eliminating the friendly DOS effect.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS8151338B2Method and system for continuously serving authentication requests

Publication Date: 2012.04.03 CISCO TECHNOLOGY INC

AI summary

A method and system for continuously serving the authentication requests of networked computers is disclosed. The authentication requests of computers are served and the services for the computers are reserved for a predefined time interval. The authentication service for a computer is reserved by an authentication server, which receives authentication requests of the computer.