Multi-Tiered Network Filtering System for DoS Defense

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current methods for defending networks against denial of service (DOS) attacks are inefficient, as they require expensive hardware, consume excessive power, and generate heat, making it difficult to effectively filter and police large volumes of data packets, thereby wasting resources and impacting legitimate users.

Innovation Solution

A multi-tiered filtering and policing system that uses no access lists, first access lists, and second access lists to filter data packets, along with a bin-based indexing system to identify and manage user signatures, allowing for scalable and granular control of data transmission based on rate limits and user classifications.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If CAM hardware is used to handle increased number of users, then the ability to identify and allow legitimate users is improved, but the cost, power consumption, and heat generation increase excessively

Engineering Contradiction:

Improveability to identify legitimate usersVSAvoidpower consumption

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The patent replaces hardware-based CAM (Content-Addressable Memory) search engines with a software-based filtering system using bit vectors and logical operations. This substitution eliminates the need for expensive, power-hungry specialized hardware while achieving the same packet filtering functionality through standard processors and memory structures.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The patent creates a simplified copy of the access control functionality by using bit vectors to represent user signatures and access lists, rather than implementing the full CAM hardware architecture. This software-based copy achieves equivalent filtering capability with dramatically reduced resource requirements.

Inventive Principle:

Principle #26Copying

2Reliability

If CAM hardware is used to handle increased number of users, then the ability to identify and allow legitimate users is improved, but the cost increases

Engineering Contradiction:

Improveability to identify legitimate usersVSAvoidcost

Core Design Contradiction:

ReliabilityVSEase of manufacture

Solution Approach 1:

The patent replaces expensive CAM hardware with standard software-based processing using bit vectors and logical operations. This substitution eliminates the need for costly specialized hardware components while maintaining the ability to identify and filter legitimate users effectively.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The patent uses software-based data structures (bit vectors, access lists) that can be easily created, modified, and discarded without the high costs associated with hardware reconfiguration. These software structures provide the necessary filtering functionality at a fraction of the hardware cost.

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

3Reliability

If packet analysis using user lists is performed for large numbers of users, then legitimate user identification is improved, but the system becomes unfeasible due to complexity and resource requirements

Engineering Contradiction:

Improvelegitimate user identificationVSAvoidsystem feasibility

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent changes the representation parameters from detailed user profiles to compact bit vectors, and from exhaustive packet analysis to efficient logical operations. This parameter transformation reduces the computational complexity from O(n) to O(1) for each packet, making the system feasible for large numbers of users.

Inventive Principle:

Principle #35Parameter changes

Solution Approach 2:

The patent segments the user identification system into modular components: bit vectors for user signatures, access lists for policy definitions, and hierarchical filtering stages. This segmentation allows the system to handle large numbers of users by processing only relevant bits and rules, rather than analyzing entire user profiles for each packet.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS7672336B2Filtering and policing for defending against denial of service attacks on a network

Publication Date: 2010.03.02 RIBBON COMMUNICATIONS OPERATING CO INC

AI summary

Described are computer-based methods and apparatuses, including computer program products, for filtering and policing for defending against denial of service attacks on a network. A data packet is filtered by a multi-tiered filtering and transmission system. Data packets matching the first tier filter are discarded. Data packets matching the second tier filter are transmitted to an output module based on a criterion. Data packets in the third tier filter are hashed into bins and data packets matching an entry in the bin are transmitted to the output module based on a criterion for the bin. Data packets in the fourth tier transmission system are transmitted to the output module based on a criterion. Data packets that do not meet the criterion for transmission to the output module are transmitted to an attack identification module which analyzes the data packets to identify attacks.