Line Card Message Processing for DoS Attack Defense
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network defense methods are unreliable in distinguishing and defending against attacks from the same IP address, leading to ineffective protection against Denial of Service (DoS) attacks and other malicious messages.
Innovation Solution
A message processing method that stores and shapes messages based on their types, rather than just IP addresses, using a storage module to categorize messages and a processing module to configure shaping values for each type, ensuring that only normal messages are processed and attack messages are filtered effectively.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traffic policing limitation is carried out on messages sent from different IP addresses respectively, then CPU resources are protected to a certain extent, but attack messages from the same IP address cannot be effectively defended
Solution Approach 1:
The patent segments the message classification dimension from IP address to message type, creating separate buffer areas for different message types (control messages, management messages, service messages, data messages). This segmentation enables more granular control over attack messages while maintaining protection for normal messages of the same type from different sources.
Solution Approach 2:
The patent applies local quality by configuring different shaping values for different message types based on their specific characteristics and requirements. Each message type receives tailored traffic policing parameters, allowing precise control over which messages are protected and which are limited, rather than applying a uniform policy to all messages.
2Productivity
If all received messages are processed by the CPU, then normal user requests can be handled, but CPU resources collapse under DoS attack
Solution Approach 1:
The patent performs preliminary action by classifying and shaping messages into different buffer areas before they reach the CPU. Traffic policing parameters are configured in advance for each message type, so that when attack messages arrive, they are automatically limited according to pre-configured rules, preventing CPU overload before it occurs.
Solution Approach 2:
The patent introduces buffer areas as an intermediary between message reception and CPU processing. These buffers act as a filtering layer that shapes and limits traffic based on message type, allowing normal messages to pass through to the CPU while blocking or limiting attack messages, thus protecting the CPU from direct exposure to malicious traffic.
Data Source
Figure 1~3
Figure 4~6
Figure 7~8
AI summary
The present invention provides a message processing method and device, and a line card, wherein the method includes: storing received messages to buffer areas corresponding to message types according to the message types; and shaping the messages stored in the buffer areas. Through the present invention, the problem of low reliability of attack defense for the messages in relevant technologies can be solved, so as to achieve the effects of effectively controlling attack messages and improving the reliability of a device.