Multistage Filter Rate Limiting for Scalable Network Traffic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional application delivery controllers (ADCs) face scalability issues in managing network traffic as the number of clients and content grows, leading to memory and computational inefficiencies, and are not effective in handling dynamic client and resource changes, especially when dealing with denial-of-service attacks.
Innovation Solution
Implementing a multistage filter with a hash table that dynamically tracks and limits access rates without explicitly tracking client and resource identities, using a combination of hash functions to distribute requests efficiently and adapt to changing network conditions, allowing for scalable and efficient rate limiting.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If conventional ADCs are used to manage network traffic, then traffic control functionality is provided, but scalability deteriorates as client and content numbers grow
Solution Approach 1:
The patent segments the rate limiting function into multiple distributed ADC instances, each managing a portion of the traffic control tasks. This segmentation allows the system to scale horizontally by adding more ADC instances rather than relying on a single complex device, directly addressing the scalability limitation of conventional ADCs.
Solution Approach 2:
The patent extracts the rate limiting logic from the main ADC processing path and implements it as a separate, optimized component. This extraction reduces the computational burden on the main ADC system, allowing it to handle larger volumes of traffic without proportionally increasing complexity.
2Measurement precision
If explicit tracking of client and resource identities is implemented, then fine grained rate limiting is achieved, but memory usage increases
Solution Approach 1:
The patent merges the client identification and resource identification into a single composite key that is hashed together. This merging allows the system to track client-resource pairs for fine-grained rate limiting without maintaining separate data structures for each identifier, thereby reducing memory consumption while preserving measurement precision.
Solution Approach 2:
The patent changes the parameter representation by using hashed values instead of raw identifiers. This parameter transformation compresses the memory footprint of tracked entities while maintaining the ability to perform precise rate limiting measurements through the properties of hash functions.
3Adaptability or versatility
If conventional ADCs handle dynamic client and resource changes, then traffic management is provided, but computational overhead increases
Solution Approach 1:
The patent implements dynamic rate limiting thresholds that automatically adjust based on observed traffic patterns and system load. This dynamic adaptation allows the system to respond to changing client and resource conditions without requiring intensive computational analysis, as the thresholds evolve with the traffic characteristics.
Solution Approach 2:
The rate limiting system performs self-adjustment by monitoring its own performance metrics and automatically tuning its parameters. This self-service capability reduces the need for external computational intervention and allows the system to adapt to dynamic conditions efficiently.
4Ease of operation
If pre-configured lists of clients and resources are used, then access control is simplified, but adaptability to new clients and resources deteriorates
Solution Approach 1:
The patent implements a universal rate limiting mechanism that works with any client and resource identifier without requiring pre-configuration. The hash-based approach allows the system to handle both known and unknown entities uniformly, providing ease of operation while maintaining high adaptability to new clients and resources.
Data Source
AI summary
Techniques of the present disclosure provide an embodiment of a multistage filter (MSF) that takes a rate limiting parameter. The entries of the MSF are updated upon each access. Each update may cause a different breakdown of entries in the MSF and the entries can be dynamically set to reduce collisions and their impact. In some embodiments, the MSF is: configured based on the rate limiting parameter, used to dynamically monitor network traffic and changing assignments, and adjustable in size. In some embodiments, hashing is performed on a per-row basis and seeding initializes entries of the buckets to entries that are the same within a given row and different within a given column.