Floating IP Gateway for DDoS Mitigation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Distributed denial-of-service (DDoS) attacks overwhelm networked computing systems by flooding them with data traffic, making it difficult to detect and mitigate due to widespread attacking source IP addresses and the use of sophisticated spoofing techniques with legitimate protocols, leading to service disruptions and overloading of single points of failure.

Innovation Solution

Implementing a floating IP gateway hosted in a mesh of distributed data centers, which synchronizes state information and controls ingress and egress traffic, making the customer IP interface inaccessible via a public IP address, thereby reducing the likelihood of DDoS attacks by distributing the attack surface across geographically distinct data centers.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If a single public IP interface is used for customer enterprise network, then network connectivity and service accessibility are improved, but the network becomes vulnerable to DDoS attacks and single point of failure

Engineering Contradiction:

Improvenetwork connectivityVSAvoidvulnerability to DDoS attacks

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The invention segments the single public IP interface into multiple virtual IP interfaces distributed across multiple data centers. Each data center hosts a virtualized gateway that can assume the customer's IP address, dividing the attack surface across multiple geographic locations rather than concentrating it at a single physical interface.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The invention introduces a floating IP gateway as an intermediary between the public Internet and the customer enterprise network. This gateway is virtualized and can be dynamically relocated across multiple data centers, acting as a mediator that absorbs and redistributes traffic to prevent direct exposure of the customer network to DDoS attacks.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Object-affected harmful factors

If broad packet-filtering or rate-limiting measures are employed to prevent DDoS attacks, then attack traffic is blocked, but legitimate service is also shut down causing denial of service to legitimate users

Engineering Contradiction:

Improveattack traffic blockingVSAvoidlegitimate service availability

Core Design Contradiction:

Object-affected harmful factorsVSReliability

Solution Approach 1:

The floating IP gateway is dynamically relocatable across multiple data centers based on traffic conditions and attack patterns. Rather than using static filtering rules that may block legitimate traffic, the system dynamically shifts the gateway location to maintain service availability while mitigating attacks, adapting in real-time to changing network conditions.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The invention changes the parameter of gateway location from fixed to floating/movable. By altering the physical location parameter of the IP gateway across multiple data centers, the system can evade distributed attacks without needing to apply broad filtering rules that would inadvertently block legitimate traffic.

Inventive Principle:

Principle #35Parameter changes

3Reliability

If multiple data centers form a floating gateway, then exposure to DDoS attacks is reduced and service uptime is enhanced, but system complexity increases

Engineering Contradiction:

Improveservice uptimeVSAvoiddistributed data center architecture

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The virtualized floating gateway is designed as a universal component that can operate across multiple different data center environments. This multi-functional design allows the same gateway software to be deployed and managed across diverse infrastructure platforms, reducing operational complexity despite the distributed architecture.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The invention uses virtualization to create copies of the IP gateway across multiple data centers. These virtual copies can be rapidly instantiated and migrated without requiring complex hardware configurations at each location, simplifying the management of the distributed architecture through software-based replication.

Inventive Principle:

Principle #26Copying

Data Source

PatentUS11012410B2Distributed denial-of-service prevention using floating internet protocol gateway

Publication Date: 2021.05.18 CHARTER COMM OPERATING LLC

AI summary

An apparatus for preventing data traffic overload of a customer enterprise network in a networked computing system includes a plurality of data centers, each of the data centers being in operative communication with one another via a secure connection. The data centers form at least one floating gateway for providing a distributed interface between a public network and an Internet Protocol (IP) interface of the customer enterprise network, the IP interface of the customer enterprise network being inaccessible using a public IP address. The apparatus further includes at least one controller in operative communication with the data centers. The controller is configured to synchronize state information among the data centers and to control ingress and egress data traffic for each of the data centers.