Dynamic Hardware Policer Allocation for Control Plane Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Denial of service attacks on network elements, which flood control plane processors with innocuous control plane data, lead to resource exhaustion and denial or limitation of services for legitimate data processing.
Innovation Solution
A method and apparatus for dynamically installing and evicting control plane data policing rules from system memory to specialized hardware memory based on processing statistics, using ternary content addressable memory (TCAM) for efficient policing of control plane data, allowing for faster processing and reduced CPU load.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If control plane data policing rules are stored in system memory (software), then more rules can be stored and flexibility is improved, but processing speed decreases and CPU load increases
Solution Approach 1:
The patent segments policing rules into two categories: frequently used rules are installed in hardware (TCAM) for fast processing, while less frequently used rules remain in system memory (software). This segmentation allows the system to maintain both high processing speed for critical rules and high adaptability through the larger software rule set.
Solution Approach 2:
The patent introduces a policing rule manager as an intermediary component that dynamically manages the installation and eviction of policing rules between system memory and hardware. This mediator optimizes the distribution of rules to balance processing speed and adaptability based on traffic patterns and attack detection.
2Productivity
If control plane data policing rules are stored in specialized hardware memory (TCAM), then processing speed is improved and CPU load is reduced, but the number of rules that can be stored is limited
Solution Approach 1:
The patent implements dynamic management of policing rules in hardware memory. The policing rule manager continuously monitors traffic patterns and dynamically installs or evicts rules based on current network conditions and detected attacks, allowing the hardware rule set to adapt to changing threats while maintaining fast processing speed.
Solution Approach 2:
The system changes the parameters of rule selection based on traffic analysis. When attacks are detected, the system prioritizes installing attack-mitigation rules in hardware even if they displace other rules, dynamically adjusting which rules reside in fast hardware memory based on current network security requirements.
3Adaptability or versatility
If all policing rules are kept in system memory, then rule flexibility is maintained, but resource exhaustion occurs during denial of service attacks due to high CPU load
Solution Approach 1:
The patent extracts the most critical policing rules from the software system and places them in dedicated hardware enforcement mechanisms. This extraction of high-priority rules to hardware relieves the CPU from processing these time-critical decisions, ensuring CPU resources remain available for legitimate network operations even during attacks.
Solution Approach 2:
The patent replaces the software-based policing mechanism (which relies on CPU processing) with a hardware-based enforcement mechanism for critical rules. This substitution moves the enforcement burden from the general-purpose CPU to specialized hardware, preventing CPU resource exhaustion during denial of service attacks while maintaining rule flexibility through the hybrid architecture.
Data Source
AI summary
A method and apparatus of a network element that installs a control plane data rule from system memory to specialized hardware memory in a network element is described. In an exemplary embodiment, the network element receives control plane data processing statistics of control plane data that is received by the network element, where the control plane data is policed using a plurality of control plane data policing rules stored in the system memory. The network element further determines that a candidate policing rule is being utilized greater than a threshold based on at least the control plane data processing statistics, where the candidate policing rule is one of the plurality of control plane data policing rules stored in the system memory. The network element additionally installs the candidate policing rule in the specialized hardware memory, where the candidate policing rule is subsequently used by the network element to police the control plane data.