Hardware Cookie Validation for Stateless DDoS Packet Dropping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for mitigating DDoS attacks fail to efficiently drop spurious network packets without storing state information or performing complex operations like maintaining connection tables.
Innovation Solution
A hardware device with a network traffic manager apparatus generates and validates connection identifier cookies based on network packet data, comparing them to determine and drop mismatched packets, thus mitigating DDoS attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If state information is stored for each connection to validate packets, then packet validation reliability is improved, but device complexity and memory requirements increase
Solution Approach 1:
The patent extracts only the essential validation information (cookies) from the full connection state and stores only these minimal identifiers in the connection table. This allows packet validation without storing complete connection state information, reducing memory requirements while maintaining validation reliability.
Solution Approach 2:
The patent uses cookie values as copies or representations of connection state information. Instead of storing full connection states, the system stores simplified cookie identifiers that serve as references to connection state, enabling validation without the complexity of maintaining complete state information.
2Measurement precision
If connection tables are accessed frequently for each packet, then packet validation accuracy is improved, but processing time and processor load increase
Solution Approach 1:
The patent performs preliminary actions by pre-computing and storing connection validation cookies in the connection table during connection establishment. This allows fast lookup during packet validation without performing complex real-time computations, reducing processing time while maintaining accuracy.
Solution Approach 2:
The patent replaces complex processor-based validation operations with hardware-accelerated cookie comparison mechanisms. The validation process is shifted from software-intensive connection table scanning to hardware-efficient cookie matching, reducing processor load and processing time.
3Reliability
If complex operations are performed on network packets, then validation reliability is improved, but device complexity and processing overhead increase
Solution Approach 1:
The patent changes the validation parameter from complex connection state analysis to simple cookie value comparison. By transforming the validation mechanism into a parameter-based comparison system, the patent maintains reliability while significantly reducing processing complexity.
Solution Approach 2:
The patent uses simple, easily generated cookie values as the validation mechanism instead of complex state management systems. These cookies are lightweight data structures that can be quickly generated and compared, reducing device complexity while maintaining validation effectiveness.
Data Source
AI summary
Methods, non-transitory computer readable media, network traffic manager apparatuses, and systems that assist with mitigating DDOS attack using a hardware device includes determining when a received network packet in an established connection between a client and a destination server includes a connection identifier cookie. A connection validation cookie is generated based on at least data in the received network packet, when the determination indicates the received network packet includes the connection identifier cookie. The connection identifier cookie is compared against the generated connection validation cookie. The received network packet is dropped when the comparison indicates the connection validation cookie fails to match the connection identifier cookie.