CDN Edge Rate Limiting for On-Premise DDoS Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
On-premise networks face resource consumption and service disruption due to excessive network traffic, particularly during DDoS attacks, as they lack sufficient resources to manage and filter incoming requests effectively.
Innovation Solution
Implementing a content distribution network (CDN) to rate limit network traffic by generating decisions at the CDN using an on-premise rate limiter, which analyzes and restricts requests, and caching these decisions for future reference.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If rate limiting is implemented at the on-premise network, then service availability is maintained for legitimate traffic, but resource consumption increases during DDoS attacks
Solution Approach 1:
The patent introduces a CDN edge node as an intermediary between the client and the on-premise network. The edge node performs rate limiting and DDoS protection functions, acting as a mediator that protects the on-premise network resources from direct exposure to attack traffic while maintaining service availability for legitimate users.
Solution Approach 2:
The patent segments the network architecture into multiple components: CDN edge nodes for traffic management, on-premise networks for service provision, and cloud infrastructure for support. This segmentation allows the rate limiting function to be distributed across edge nodes rather than concentrated at the on-premise network, reducing resource consumption at the critical service backend.
2Measurement precision
If rate limiting is performed by analyzing all incoming traffic, then attack detection accuracy improves, but processing time increases
Solution Approach 1:
The patent implements preliminary actions by pre-configuring rate limiting thresholds, blocking lists, and detection rules at the CDN edge nodes before attacks occur. This allows the system to respond quickly to known attack patterns without performing complex real-time analysis, reducing processing time while maintaining detection accuracy.
Solution Approach 2:
The patent applies local quality by implementing different rate limiting strategies for different traffic types and sources at the edge node. Instead of uniformly analyzing all traffic, the system applies specialized detection rules to specific protocols, IP ranges, and request patterns, improving processing efficiency while maintaining accurate attack detection where needed.
Data Source
AI summary
Techniques are disclosed that relate to rate limiting network traffic at a content distribution network based on decisions provided by a rate limiter located on an on-premise network. A computer system may receive, at the CDN, network traffic requesting access to a service associated with an on-premise network. The computer system sends, to a second computing system deployed in the on-premise network, a request to decide whether to rate constrain the network traffic. The second computing system is configured to perform an analysis on the network traffic. In response to the request, the computer system receives a decision from the second computing system. The computer system implements the decision for the network traffic at the CDN.