Edge Network Chaos Testing With Modified Request Copies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security testing methods for network traffic are difficult, time-consuming, and often fail to properly validate incoming requests, leading to improper responses from servers, especially in the context of content delivery networks and edge cloud platforms, which can be vulnerable to DDoS attacks and system compromises.
Innovation Solution
An infrastructure service duplicates and modifies request messages to include or exclude specific header information, sending both to an origin server for response comparison, creating a security report to verify server responses and identify configuration issues.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security testing methods are used to validate server instructions, then security validation can be achieved, but the testing process is time-consuming and may interrupt network service
Solution Approach 1:
The system performs security validation by injecting modified requests into the existing traffic flow before the requests reach the origin server. This preliminary action allows security testing to occur in real-time during normal operations, eliminating the need for separate time-consuming testing phases and avoiding service interruption.
Solution Approach 2:
The infrastructure service acts as an intermediary between end users and origin servers, intercepting requests and injecting modified versions for security validation. This intermediary approach enables continuous security testing without interrupting the normal request-response flow, as the original requests continue to be forwarded to servers while modified test requests are inserted into the stream.
2Productivity
If complex security instructions are deployed without thorough testing, then deployment speed is improved, but the server may fail to properly validate incoming requests
Solution Approach 1:
The system compares responses from the origin server to both original and modified requests, analyzing whether the server correctly validates security instructions. This feedback mechanism provides immediate validation of deployed security configurations, allowing rapid deployment while ensuring correctness through automated comparison and analysis of server responses.
Solution Approach 2:
The infrastructure service creates modified copies of original requests by altering header information while preserving the payload. These copied requests are injected into the traffic stream to test server validation logic, enabling rapid security testing of deployed instructions without requiring separate test environments or slowing down deployment.
3Ease of operation
If the load balancer acts on all traffic including directly addressed traffic, then traffic distribution is simplified, but security shielding function is compromised
Solution Approach 1:
The system applies different processing rules to different types of traffic. Directly addressed traffic to origin servers is excluded from load balancing actions and modified request injection, while other traffic continues to receive full security validation. This local quality approach maintains security shielding for critical traffic while preserving simplified traffic distribution where appropriate.
Data Source
AI summary
Methods and apparatus are disclosed herein that enable an infrastructure service to implement security verification without significantly interrupting end user network traffic. The infrastructure service copies request messages and modifies a portion of the header information of the request message. Both the original message and the modified message are then sent for fulfillment. The infrastructure service compares the responses in order to create a security test report.