Floating Token Buckets for IPS Rate Limiting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Intrusion Prevention Systems (IPS) face challenges in enforcing system-wide rate limits for traffic protocols across multiple deep packet inspection engines, as a single engine may not be capable of processing high throughput, leading to the need for techniques to distribute bandwidth among traffic flows effectively.
Innovation Solution
Implementing a floating token bucket scheme where each rate limiter is associated with a token bucket that is passed among deep packet inspection engines, ensuring that only the engine in possession of the bucket can process traffic, and tokens are refilled and removed based on processing rates to enforce rate limits across multiple engines.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If multiple deep packet inspection engines are used to process traffic flows, then the aggregate processing throughput is improved, but coordinating rate limits across multiple engines becomes complex
Solution Approach 1:
A central controller acts as an intermediary between multiple deep packet inspection engines and the rate limiter. The controller receives rate limit parameters from the administrator, distributes them to engines, and collects processing statistics. This mediator architecture allows multiple engines to operate independently at high throughput while the controller ensures coordinated rate limiting across the entire system, resolving the contradiction between improved productivity and increased complexity.
2Productivity
If traffic is distributed across multiple engines, then the processing capacity is improved, but enforcing system-wide rate limits becomes difficult
Solution Approach 1:
The system implements feedback mechanisms where the central controller continuously monitors processing statistics from each deep packet inspection engine and adjusts rate limit enforcement accordingly. Each engine reports its processing rate to the controller, which then determines whether to allow, throttle, or block traffic from each engine to maintain system-wide rate limits. This feedback loop ensures reliable rate limit enforcement while preserving the high processing capacity provided by multiple engines.
3Device complexity
If a single deep packet inspection engine is used, then rate limit coordination is simple, but the processing throughput is insufficient
Solution Approach 1:
The system segments the deep packet inspection function across multiple independent engines, each capable of processing traffic flows in parallel. This segmentation increases processing throughput by utilizing multiple processing units simultaneously. The central controller coordinates these segmented engines to enforce rate limits, allowing the system to achieve both high productivity through segmentation and manageable complexity through centralized coordination.
Data Source
AI summary
Traffic flow rate limits are enforced in an Intrusion Prevention System (IPS) having a plurality of deep packet inspection (DPI) engines by using a floating token bucket scheme. The IPS includes a plurality of rate limiters which are associated with different classes (e.g., protocols) of traffic. A floating token bucket is associated with each rate limiter. The token bucket associated with a rate limiter is passed from DPI engine to DPI engine. Only the DPI engine currently in possession of the token bucket for a particular rate limiter is allowed to process traffic of the class associated with that rate limiter. A DPI engine is only allowed to process traffic associated with a token bucket in its possession if that token bucket is not empty. Use of such floating token buckets enforces rate limits for each traffic class across the multiple DPI engine.