Edge Service Proxy Routing Against SYN Flood Attacks

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Edge servers in networks are vulnerable to attacks such as distributed denial of service attacks, particularly from malicious customer devices initiating numerous connection requests without completing the connection process, which drains server resources.

Innovation Solution

Implementing a local area network router that acts as a proxy between customer devices and edge servers, establishing separate connections and filtering inbound requests, while authenticating applications and enforcing bandwidth limits to protect edge servers from attacks.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Speed

If edge servers directly accept connection requests from customer devices, then service responsiveness is improved, but vulnerability to attacks increases

Engineering Contradiction:

Improveservice responsivenessVSAvoidvulnerability to attacks

Core Design Contradiction:

SpeedVSObject-affected harmful factors

Solution Approach 1:

A network switching device is introduced as an intermediary between customer devices and edge servers. The device establishes separate TCP connections with both the customer device and the edge server, acting as a proxy that forwards packets between them. This intermediary structure allows the edge server to remain insulated from direct exposure to malicious traffic while maintaining service responsiveness through the proxy's efficient packet forwarding.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If the network switching device acts as a proxy establishing separate connections, then protection from attacks is improved, but device complexity increases

Engineering Contradiction:

Improveprotection from attacksVSAvoidconnection management complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The connection management function is segmented into distinct components: the network switching device handles connection establishment and proxy functions separately from the edge server's core service logic. By dividing the system into modular functional blocks, the complexity of proxy connection management is isolated to a specific device, making it easier to implement, maintain, and update without affecting the overall edge server system.

Inventive Principle:

Principle #1Segmentation

3Loss of energy

If bandwidth limits are enforced on TCP connections, then resource consumption is reduced, but service quality may deteriorate

Engineering Contradiction:

Improveresource consumptionVSAvoidservice quality

Core Design Contradiction:

Loss of energyVSProductivity

Solution Approach 1:

The network switching device dynamically enforces bandwidth limits on TCP connections by adjusting transmission parameters. Rather than applying fixed restrictions, the device can modify bandwidth allocation based on connection priorities, service types, and current network conditions. This parameter-based control allows resource consumption to be optimized while maintaining acceptable service quality through adaptive adjustment.

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS12603874B2Systems and methods for customer control of edge service

Publication Date: 2026.04.14 CENTURYLINK INTELLECTUAL PROPERTY LLC

AI summary

In a network including a wide area network and a local area network, an edge server may be within the wide area network and geographically close to a customer device of the local area network. Such an edge server may be vulnerable to attacks, such as distributed denial of service attacks, including SYN floods. Systems and methods for customer control of edge service are provided while mitigating such attacks.