Distributed Rate Limiting for Network Attack Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Distributed platforms face performance degradation and service disruptions due to large-scale network-based attacks, such as DDoS, which overwhelm servers and impact legitimate users, as existing redundancy mechanisms are insufficient to handle increasing attack sizes and resource capabilities.
Innovation Solution
Implementing distributed rate limiting across a distributed platform architecture, where each server monitors request rates and escalates protections by messaging other servers to limit request rates proportionally, allowing for decentralized command and control to identify and respond to attacks quickly, preventing overload on both distribution points and origin servers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If distributed platform redundancy is used to protect against DDoS attacks, then service availability is improved for small-scale attacks, but the platform becomes vulnerable to large-scale attacks that can overwhelm multiple servers
Solution Approach 1:
The patent segments the distributed platform into multiple hierarchical levels (individual servers, distribution points, origin servers) and implements rate limiting at each level independently. This segmentation allows the system to contain attacks at the source distribution point level before they can propagate to other servers or origin servers, thereby maintaining service availability against large-scale attacks.
Solution Approach 2:
The patent implements preliminary rate limiting measures at distribution points before attacks can overwhelm the entire platform. By monitoring and limiting request rates in advance at each distribution point, the system prevents attacks from scaling to platform-wide impact, ensuring service availability is maintained proactively rather than reactively.
2Object-affected harmful factors
If rate limiting is implemented at individual servers, then local attack impact is reduced, but the aggregate effect of attacks across multiple servers can still overwhelm origin servers
Solution Approach 1:
The patent merges rate limiting capabilities across multiple servers and distribution points into a coordinated hierarchical system. By combining monitoring and rate limiting actions at the distribution point level and propagating limits to origin servers, the system ensures that aggregate attack effects are controlled collectively, preventing origin server overwhelm while maintaining individual server reliability.
Solution Approach 2:
The patent implements feedback mechanisms where distribution points monitor aggregate request rates and adjust rate limiting actions accordingly. When aggregate traffic approaches thresholds that could overwhelm origin servers, the system feeds back rate limiting instructions to distribution points and servers, dynamically adjusting protection levels to maintain origin server availability while responding to evolving attack patterns.
3Speed
If distributed platforms respond to attacks at each distribution point independently, then local response time is improved, but coordinated platform-wide protection is reduced
Solution Approach 1:
The patent segments attack response authority across hierarchical levels, allowing distribution points to independently detect and respond to attacks locally with fast response times. Simultaneously, the segmented architecture enables coordinated platform-wide protection through hierarchical propagation of rate limiting decisions from distribution points to origin servers, achieving both rapid local response and unified platform-wide adaptability.
Solution Approach 2:
The patent adds a hierarchical dimension to distributed platform architecture, organizing servers and distribution points in multiple levels (server level, distribution point level, origin server level). This dimensional organization enables independent local response at each level while maintaining coordinated platform-wide protection through hierarchical information flow and rate limiting propagation, resolving the contradiction between speed and coordination.
Data Source
AI summary
Some embodiments provide distributed rate limiting to combat network based attacks launched against a distributed platform or customers thereof. The distributed rate limiting involves graduated monitoring to identify when an attack expands beyond a single server to other servers operating from within the same distributed platform distribution point, and when the attack further expands from one distributed platform distribution point to other distribution points. Once request rates across the distributed platform distribution points exceed a global threshold, a first set of attack protections are invoked across the distributed platform. Should request rates increase or continue to exceed the threshold, additional attack protections can be invoked. Distributed rate limiting allows any server within the distributed platform to assume command and control over the graduated monitoring as well as escalating the response to any identified attack.