Multi-Tiered Network Filtering System for DOS Attack Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing prevalence of denial of service (DOS) attacks on networks poses a significant challenge as existing solutions, such as content-addressable memory (CAM) based search engines, are expensive, power-intensive, and inefficient, leading to resource wastage and financial losses for companies.
Innovation Solution
A multi-tiered filtering and policing system that uses no access lists, first access lists, and second access lists to filter data packets, combined with hashing and bin identification to efficiently identify and mitigate attacks, allowing legitimate users to access the network while preventing attackers from degrading service.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If CAM hardware is used to handle increased number of users, then filtering capability is improved, but cost increases, power consumption increases, and heat generation increases
Solution Approach 1:
The patent segments the filtering system into multiple software-based access list modules (no access list module, first access list module, second access list module) that process packets in stages. This segmentation replaces the monolithic CAM hardware approach with distributed software processing, reducing power consumption while maintaining filtering capability.
Solution Approach 2:
The patent substitutes mechanical/electronic CAM hardware with software-based filtering mechanisms running on general-purpose processors. The access list modules use software data structures and algorithms to perform packet filtering, eliminating the need for specialized CAM hardware and its associated power and heat requirements.
2Measurement precision
If packet analysis using user lists is performed for large number of users, then filtering accuracy is improved, but processing time increases and becomes unfeasible
Solution Approach 1:
The patent performs preliminary organization of user information into structured access lists before packet processing. The no access list, first access list, and second access list are pre-configured with user identifiers and permissions, enabling rapid lookup during packet filtering without analyzing raw user data in real-time.
Solution Approach 2:
The patent divides the user base into multiple segments organized across different access lists (no access list for blocked users, first access list for standard users, second access list for premium users). This segmentation allows the system to check only relevant lists for each packet, reducing processing time while maintaining accurate filtering.
3Adaptability or versatility
If multi-tiered filtering system is implemented, then scalability is improved, but device complexity increases
Solution Approach 1:
The patent implements universal access list modules that can handle multiple types of filtering operations (blocking, allowing, rate limiting) through a common software architecture. Each module (no access list module, first access list module, second access list module) performs similar functions with different configuration parameters, enabling scalability without proportionally increasing complexity.
Solution Approach 2:
The patent structures the filtering system as nested tiers where the no access list module operates first, then packets proceed to the first access list module, and finally to the second access list module if needed. This nested arrangement allows the system to scale by adding or removing tiers while maintaining a clear hierarchical structure that manages complexity.
Data Source
AI summary
Described are computer-based methods and apparatuses, including computer program products, for scalable filtering and policing mechanism for protecting user traffic in a network. A data packet is filtered by a multi-tiered filtering and transmission system. Data packets matching the first tier filter are discarded. Data packets matching the second tier filter are transmitted to an output module based on a criterion. Data packets in the third tier filter are hashed into bins and data packets matching an entry in the bin are transmitted to the output module based on a criterion for the bin. Data packets in the fourth tier transmission system are transmitted to the output module based on a criterion. Data packets that do not meet the criterion for transmission to the output module are transmitted to an attack identification module which analyzes the data packets to identify attacks.