Container-Virtualized Overload Control With Load Defense Containers

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In container-virtualized computing systems, overload situations often result in the rejection of authorized request messages due to resource limitations, leading to a decreased quality of service and potential Denial-of-Service attacks, which existing measures fail to address efficiently.

Innovation Solution

Implement a load defense container that provides modified, load-reducing processing forms for request messages during overload, such as challenge-response methods, static content delivery, and authorized user verification, while maintaining a load balancer to forward messages to either work or load defense containers based on capacity utilization and attack detection.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If the maximum number of containers is reached and request messages continue to rise, then new containers cannot be activated to handle the load, but authorized user requests are rejected leading to decreased quality of service

Engineering Contradiction:

Improvenumber of request messages handledVSAvoidquality of service for authorized users

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The system segments incoming request messages into two categories: authorized user requests and unauthorized/attack requests. This segmentation is achieved through verification mechanisms that identify the source and legitimacy of each request, allowing the system to handle authorized requests even when container capacity is reached while blocking unauthorized ones.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

A verification mechanism acts as an intermediary between the load balancer and work containers. This intermediary verifies incoming request messages before forwarding them to containers, preventing unauthorized requests from consuming container resources while ensuring authorized requests are always routed appropriately.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If overprovisioning is implemented to handle exceptional load levels, then more containers are kept ready than needed for customary load, but resource waste increases

Engineering Contradiction:

Improveability to handle exceptional loadVSAvoidresource waste from idle containers

Core Design Contradiction:

ReliabilityVSLoss of energy

Solution Approach 1:

The system implements dynamic container activation based on real-time verification of incoming requests. Instead of maintaining a static overprovisioned pool, containers are activated or deactivated dynamically according to the actual verified load from authorized users, optimizing resource utilization while maintaining reliability.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The verification mechanism provides feedback about the nature and source of incoming requests to the container management system. This feedback enables intelligent decisions about container activation and deactivation, ensuring containers are maintained only when needed for authorized requests rather than maintaining excessive standby capacity.

Inventive Principle:

Principle #23Feedback

3Strength

If request messages are discarded without handling during overload, then system resources are protected from damage, but legitimate service delivery is compromised

Engineering Contradiction:

Improvesystem protection from overload damageVSAvoidservice delivery to authorized users

Core Design Contradiction:

StrengthVSProductivity

Solution Approach 1:

The verification mechanism performs preliminary anti-action by identifying and blocking unauthorized requests before they can overload the system. This preventive measure protects system resources from malicious attacks while simultaneously ensuring that authorized requests are always accepted and handled, even when overall system load is high.

Inventive Principle:

Principle #9Preliminary anti-action

Solution Approach 2:

The system performs preliminary verification of incoming requests to determine their legitimacy before routing them to work containers. This preliminary action ensures that only authorized requests consume container resources, protecting the system from overload while maintaining service delivery for legitimate users.

Inventive Principle:

Principle #10Preliminary action

4Reliability

If challenge-response methods are implemented in load defense containers, then unauthorized requests are filtered more effectively, but processing time for each request increases

Engineering Contradiction:

Improveaccuracy of attack detectionVSAvoidrequest processing time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The verification mechanism applies challenge-response methods selectively rather than to all requests. By identifying and applying verification only to suspicious or unauthorized requests while allowing clearly legitimate requests to pass through with minimal overhead, the system maintains high detection accuracy while minimizing overall processing time impact.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS12399748B2Method for overload control in a container-virtualized computing apparatus

Publication Date: 2025.08.26 SIEMENS AG

AI summary

Provided is a method for overload protection in a container-virtualized computing apparatus that provides a computer-implemented application by at least one work container, having the following steps: —receiving a request message to call the application, checking the currently existing workload of the computing apparatus against a stipulated load limit value, and if the current workload is higher than the load limit value, forwarding the request message to a load rejection container that provides at least one form of handling of the application that is modified compared to the work container.