Containerized Web Server DDoS Mitigation via Traffic Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current DDoS attack mitigation methods, such as rate-limiting and virtual machine-based systems, struggle to differentiate between legitimate and malicious traffic, leading to service downtime and data corruption, and are inefficient due to resource-intensive virtual machines and security flaws in container technologies.
Innovation Solution
The use of containerized server architecture with duplicate container instantiations for isolating and redirecting traffic, combined with resource monitoring and load balancing, to quickly replicate services and assess traffic patterns, thereby minimizing downtime and enhancing security by segregating suspicious traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If rate-limiting is used to mitigate DDoS attacks, then network traffic is reduced, but both legitimate and malicious traffic are cut off, resulting in service downtime
Solution Approach 1:
The system segments traffic into multiple channels based on source identification. Legitimate traffic is routed through fast-pass channels while malicious traffic is directed to analysis channels. This segmentation allows differential handling of traffic types, maintaining service availability for legitimate users while isolating malicious traffic for assessment.
Solution Approach 2:
The patent introduces an intermediary traffic assessment mechanism that sits between the network and the service. This intermediary analyzes traffic patterns and makes routing decisions without requiring complete traffic blocking. The intermediary assesses traffic legitimacy in real-time and routes accordingly, preventing both legitimate and malicious traffic from being uniformly blocked.
2Reliability
If virtual machines are used to isolate services during attacks, then service isolation is achieved, but resource consumption increases and startup time lengthens
Solution Approach 1:
The patent creates lightweight copies of service containers that can be rapidly deployed. Instead of using full virtual machines, the system uses container copying techniques where a new container is created as a copy of the existing service container. This copying approach maintains service isolation while consuming significantly fewer resources and enabling faster deployment compared to traditional VM-based isolation.
Solution Approach 2:
The system employs ephemeral container instances that are created on-demand during attacks and discarded when no longer needed. These temporary container copies provide isolation during the attack period but are designed to be short-lived and resource-efficient. After the attack subsides, these disposable container instances are terminated, freeing up resources while having provided the necessary isolation during the critical period.
3Productivity
If containers are used to run services, then resource efficiency improves, but security isolation between containers and host is compromised
Solution Approach 1:
The patent applies different security isolation qualities to different containers based on their risk profiles and service criticality. High-risk or non-critical services run in containers with stricter isolation policies, while critical services use containers with more permissive settings. This local quality approach allows the system to maintain resource efficiency through containerization while applying enhanced security isolation only where necessary, rather than uniformly across all containers.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
A web server operating in a container (90) has resource and network limits applied to add an extra layer of security. If a monitor (6) detects that the container's resource usage is approaching these limits, indicative of a DDoS attack, (step 210) or identifies traffic sources (38, 39) exhibiting suspicious behaviour, a restrictor function (72) caps the resources allowed by the original Webserver container (90) to protect servers running in other containers from overwhelming any shared resources (1, 2, 3). A duplicator function (73) starts up replica containers (91, 92, 99) with the same resource limits and a load balancing function (75) then directs incoming traffic (31, 32,,38, 39) to these overflow containers (91, 92).Traffic from suspicious sources is directed to specially-configured attack-assessment containers (99) where a 'dummy' web server operates. The behaviour of these sources is analysed by a behaviour monitoring function (77).