Dynamic Service Instance Shifting for DoS Attack Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Critical services are vulnerable to denial-of-service attacks, where attackers overload servers, and existing solutions like authentication and traffic filtering are either ineffective or unreliable, potentially delaying legitimate customer requests.
Innovation Solution
A system and method for dynamically shifting instances of a service from one set of servers to another, using a service repository and a deployment manager to register servers as candidates and periodically shift service instances based on a master almanac, making it difficult for attackers to target the service by spreading the load across multiple servers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traffic filtering and firewalls are used to detect and block suspicious traffic, then the service is protected from attacks, but legitimate customer requests may be filtered and delayed
Solution Approach 1:
The patent implements dynamic service instance shifting where service instances are moved between servers based on real-time conditions. The deployment manager continuously monitors server states and relocates service instances to maintain availability while avoiding static filtering delays. This dynamic approach allows the system to adapt to attack patterns without imposing fixed filtering overhead on legitimate requests.
Solution Approach 2:
The patent introduces a deployment manager as an intermediary component that orchestrates service instance placement and movement. Rather than using traditional firewalls as intermediaries that filter and potentially delay traffic, the deployment manager proactively manages service instance locations to prevent attack impact, eliminating the need for reactive traffic filtering that causes delays.
2Reliability
If service instances are deployed on a single set of servers, then the service is easily managed, but the service becomes vulnerable to denial-of-service attacks
Solution Approach 1:
The patent segments the service deployment across multiple servers and server sets. Instead of deploying all service instances on a single server or static set, the system divides service instances across multiple servers and dynamically shifts them between different server sets. This segmentation distributes the attack impact and prevents a single point of failure.
Solution Approach 2:
The system implements dynamic service instance shifting between different server sets based on monitored conditions. The deployment manager actively moves service instances between servers and server sets in response to detected attacks or anomalies, transforming a static deployment architecture into a dynamic, adaptive system that automatically responds to threats without requiring complex manual intervention.
3Reliability
If authentication is used to identify attackers, then the service can distinguish legitimate users, but attackers can still congest the service using login requests
Solution Approach 1:
The patent implements preliminary monitoring and detection of suspicious traffic patterns before authentication is even attempted. The system monitors incoming traffic for signs of attack (such as abnormal login request patterns) and can proactively shift service instances or block malicious traffic before authentication processes consume service capacity. This preliminary action prevents authentication resources from being wasted on attack attempts.
Solution Approach 2:
The system incorporates feedback mechanisms that monitor authentication patterns and traffic behavior in real-time. When suspicious patterns are detected (such as repeated failed login attempts or abnormal authentication traffic), the feedback loop triggers automatic responses such as shifting service instances or implementing rate limiting. This feedback-driven approach allows the system to maintain accurate user identification while automatically adjusting to prevent authentication-based attacks from congesting the service.
Data Source
AI summary
Systems and methods are disclosed for dynamically shifting one or more instances of a service from a first set of servers to a second set of servers. In an embodiment, a system includes a service repository that stores one or more services. The system also includes a deployment manager that deploys a set of instances of a service of the one or more services on a first set of servers and shifts one or more instances of the set of instances to a second set of servers.