Dynamic Keyword Filtering for Control Plane Attack Defense
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional broadband access servers struggle to distinguish between normal user access messages and cyber-attack messages, leading to the discarding of legitimate traffic and excessive CPU resource consumption in virtualization environments, especially when faced with large quantities of cyber-attack messages.
Innovation Solution
Implementing a method where a random keyword is generated and dynamically transmitted to both transmission and reception communication devices, allowing the receiving device to compare the message keyword with its locally stored set to identify and discard cyber-attack messages, while updating the keyword to prevent prediction by attackers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If message transmission rate limiting is applied to prevent control plane attacks, then control plane reliability is improved, but normal user access messages are incorrectly discarded
Solution Approach 1:
The patent applies preliminary action by inserting a forwarding plane device between the user access network and control plane device. This forwarding plane performs preliminary filtering of access messages before they reach the control plane, identifying and discarding cyber-attack messages in advance while allowing normal messages to pass through. This resolves the contradiction by preventing attack messages from overwhelming the control plane while preserving normal user access.
2Reliability
If conventional look up table and rate limiting methods are used in virtualization environment, then control plane protection is improved, but CPU processing power is excessively consumed
Solution Approach 1:
The patent applies segmentation by dividing the network device into distinct functional planes: a forwarding plane responsible for high-speed message filtering and a control plane responsible for legitimate message processing. The forwarding plane uses efficient data structures (hash tables, trie trees) to quickly identify and discard attack messages without involving the CPU-intensive control plane, thus reducing CPU consumption while maintaining protection effectiveness.
Solution Approach 2:
The forwarding plane acts as an intermediary between the user access network and the control plane in virtualized environments. It filters and forwards only legitimate messages to the control plane, preventing CPU overload while maintaining control plane protection. This intermediary layer resolves the contradiction by offloading filtering tasks from the CPU to dedicated forwarding hardware or software.
3Object-affected harmful factors
If message filtering is performed without accurate identification, then cyber-attack messages may be blocked, but normal user access messages are incorrectly discarded
Solution Approach 1:
The patent applies local quality by implementing different filtering strategies for different types of messages and network conditions. The forwarding plane uses multiple data structures (hash tables for exact matching, trie trees for prefix matching) with different characteristics suited for different filtering scenarios. This allows accurate identification of attack messages while preserving normal messages by applying the most appropriate filtering method to each message type.
Solution Approach 2:
The patent applies parameter changes by dynamically adjusting filtering parameters such as threshold values, data structure selection, and message rate limits based on network conditions and observed traffic patterns. This allows the system to adapt to different types of attacks and normal traffic variations, improving accuracy in distinguishing attack messages from legitimate messages while reducing false positives.
Data Source
Figure 1~2
Figure 3~4
Figure 5
AI summary
A method and system for defending against cyber-attacks, and a computer storage medium are provided. An apparatus for defending against cyber-attacks randomly generates a new keyword. The apparatus for defending against cyber-attacks transmits the new keyword to a transmitting device and a receiving device, respectively. The receiving device updates a keyword set of the receiving device to include the new keyword, acquires a keyword carried in a communication message transmitted by the transmitting device, and determines whether the communication message is a cyber-attack message according to the keyword carried and the keyword set. The receiving device discards the communication message in response to the communication message being determined to be a cyber-attack message.