Encapsulation Tunnel Configuration Using Dynamic Capacity Checks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
DDoS attacks overwhelm network components by flooding them with malicious requests, making it difficult to mitigate due to spoofed IP addresses, and existing solutions struggle to efficiently configure threat mitigation systems for quick protection.
Innovation Solution
A method and system that dynamically determine the available capacity of threat mitigation systems, allowing automatic configuration of encapsulation tunnels for forwarding clean packets based on desired capacity, using scrubbing centers and provider Internet circuits.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Manufacturing precision
If manual configuration of threat mitigation systems is used, then configuration accuracy can be ensured, but setup time increases significantly
Solution Approach 1:
The system automatically performs capacity checks and configures encapsulation tunnels without manual intervention. The threat mitigation system self-determines available capacity at scrubbing centers and self-configures the appropriate tunnel parameters, eliminating the time-consuming manual configuration process while maintaining accuracy through automated validation.
Solution Approach 2:
The system performs dynamic capacity checks beforehand to determine available bandwidth at scrubbing centers before finalizing the configuration. By预先 determining the capacity and pre-calculating optimal tunnel parameters, the system ensures accurate configuration is ready in advance, reducing setup time when threats are detected.
2Productivity
If dynamic capacity checks are implemented, then resource utilization is optimized, but system complexity increases
Solution Approach 1:
The system introduces an automated configuration intermediary that mediates between capacity detection and tunnel setup. This intermediary component simplifies the overall system by centralizing the complex logic for dynamic capacity assessment and automatic configuration, making the system more manageable while enabling optimized resource utilization through real-time capacity monitoring.
3Speed
If automatic configuration is used, then response speed to DDoS attacks improves, but configuration reliability may decrease
Solution Approach 1:
The system implements feedback mechanisms where configuration decisions are based on real-time capacity monitoring and validation. The automated configuration continuously receives feedback about actual system performance and capacity availability, adjusting tunnel parameters dynamically to maintain reliability while responding quickly to DDoS attacks. This closed-loop approach ensures automatic configuration remains reliable.
Data Source
AI summary
An automatic provisioning and configuration system for threat mitigation may be provided. Hardware and software resources may be automatically configured to designate a return path for forwarding clean data packets to a target network. A return path from a scrubbing center to the target network may be selected and configured, for example, based on the geographic location of the scrubbing center and information regarding available capacity of the return path to the target network, among other information. The system may also perform a set of dynamic checks to determine whether one or more scrubbing centers have capacity (and/or are likely to continue to have capacity) to provide an encapsulation tunnel between the scrubbing center and the target network for clean return traffic.