Client Domain Protection Through Traffic Rule Conflict Resolution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing DDoS attack mitigation systems face challenges in identifying and resolving conflicts between traffic management rules within a client domain, leading to potential attack refusal and improper traffic routing due to outdated or inactive rules, especially in DOTS architectures.
Innovation Solution
A method involving discovery of other client nodes within a domain, detection of conflicts between traffic management rules, and resolution through rule modification or identification of conflicting nodes, utilizing server-assisted or intra-domain discovery mechanisms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a DOTS client sends a request to the DOTS server to install a traffic management rule, then the attack mitigation capability is improved, but if there is a conflict with existing rules, the request is rejected causing attack refusal
Solution Approach 1:
The DOTS client performs discovery of other client nodes in the domain before sending traffic management rule requests to the DOTS server. This preliminary action allows the client to identify existing rules and their owners, enabling conflict detection and resolution before the server rejects the request, thus maintaining attack mitigation capability while avoiding attack refusal.
Solution Approach 2:
The system implements a feedback mechanism where the DOTS client receives information about conflicting rules from the DOTS server (including rule identifier and owner client identifier), uses discovery to identify the owner client, and then coordinates with that client to resolve the conflict. This feedback loop enables continuous improvement of traffic management rules while preventing attack refusal.
2Reliability
If the DOTS server installs filtering rules based on client requests, then the traffic management effectiveness is improved, but outdated rules from inactive clients cause conflicts and routing issues
Solution Approach 1:
The system enables active DOTS clients to self-identify and self-coordinate with each other through the discovery mechanism. When a conflict is detected, the DOTS client can autonomously identify the owner of the conflicting rule and initiate resolution actions without requiring complex server-side intervention to track and manage all rules in the domain, thus reducing rule conflict management complexity.
Solution Approach 2:
The DOTS server acts as an intermediary that facilitates conflict resolution by providing information about conflicting rules and their owners to the DOTS client. The server mediates the interaction between clients with conflicting rules, enabling coordinated resolution while maintaining traffic management effectiveness.
3Reliability
If multiple DOTS clients in the same domain send conflicting requests, then individual attack mitigation is improved, but overall traffic routing becomes improper due to rule conflicts
Solution Approach 1:
The discovery mechanism merges information about all DOTS clients in the domain, allowing them to coordinate their traffic management rules. By combining knowledge of existing rules and their owners, the system enables clients to adjust their requests to avoid conflicts, maintaining both individual attack mitigation capability and overall traffic routing coordination.
Data Source
Figure 1~2
Figure 3A~3C
Figure 4A~4B
AI summary
The invention relates to a method for protecting a client domain, for example against a computing attack, implemented in a client node of the client domain, said method comprising: - the discovery (21) of at least one other client node of said client domain, so-called discovered node; - the detection (22) of a conflict between at least two management rules for the traffic associated with said client domain; and - the resolution (23) of the detected conflict, comprising: o if one of said rules has been installed by a said discovered node, the modification of said rule or of a state associated with said discovered node; o otherwise, the obtaining, originating from a said discovered node, of an identification information item in respect of at least one node of the client domain that has installed one of said rules; the detection and/or the resolution of said conflict using information items obtained during the discovery of said at least one other node of the client domain.