Multicore Processor Dynamic DoS Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Hardware-based network traffic managers introduce undesirable latencies while attempting to protect hosts from Denial-of-Service (DoS) attacks by overloading them with network packets, reducing responsiveness or rendering hosts unable to respond.
Innovation Solution
A computer system utilizing a multicore processor with a shared memory, a data processor core, a dynamic DoS processor core, and a signaling processor core to regulate bandwidth and quality of service by selecting and managing queues based on traffic types, prioritizing trusted traffic, and dynamically adjusting processing to prevent overload.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hardware-based traffic managers are used to protect hosts from DoS attacks, then DoS protection capability is improved, but network packet processing latency increases
Solution Approach 1:
The patent segments the network traffic management system into multiple functional components: a hardware-based traffic manager for initial packet filtering and DoS protection, and a software-based processing system for detailed packet handling. This segmentation allows the hardware component to handle only critical protection functions with low latency, while less time-sensitive processing is handled by software, thereby resolving the contradiction between protection capability and processing speed.
2Reliability
If hardware-based traffic managers enforce bandwidth regulations, then host protection from DoS attacks is improved, but undesirable latencies are introduced into network packet processing
Solution Approach 1:
The patent introduces a software-based processing system as an intermediary between the hardware traffic manager and the host system. The hardware manager performs initial filtering and identifies potential DoS threats, then passes selected packets to the software intermediary for further processing and analysis before final delivery to the host. This intermediary approach allows the hardware to maintain strict bandwidth enforcement for protection while the software layer handles packets with more flexibility, reducing overall latency.
Data Source
AI summary
A method for providing dynamic denial-of-service (DoS) protection using a multicore processor is provided. The multicore processor includes a shared memory, a data processor core, a dynamic DoS processor core and a signaling processor core. The data path processor core receives a network packet addressed to a host computer, selects a target queue based on a traffic type of the network packet, and adds the network packet to the target queue. The target queue is selected from one of n queues, stored in the shared memory, associated with the traffic type. The dynamic DoS processor core services the target queue, including removing the network packet from the target queue and adding the network packet to the host queue. The signaling processor core services the host queue, including removing the network packet from the host queue and sending the network packet to the host computer.