Network Component Rate Limiting for DoS Attack Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for mitigating Denial-of-Service (DoS) and Distributed Denial-of-Service (DDoS) attacks do not effectively address the impact on network components like routers and switches, as they often allow malicious traffic to overload these components, disrupting normal service.
Innovation Solution
A method and network component that filters packets using rules with match, action, and optional limit components, where packets are handled based on action only if the family history satisfies the limit component, and includes features like source address, sender reputation, and traffic rate limits to differentiate and manage malicious traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional security policies are used to filter packets, then normal traffic is allowed through, but malicious traffic can still overload network components
Solution Approach 1:
The patent applies preliminary action by implementing rate limiting thresholds before network components are overwhelmed. The system pre-defines acceptable traffic rates and proactively blocks excessive traffic before it can cause denial of service, rather than reacting after overload occurs.
Solution Approach 2:
The patent introduces an intermediary mechanism (rate limiting module) between the traffic source and network components. This intermediary monitors traffic rates and selectively blocks excessive packets, protecting downstream components from overload while allowing normal traffic to pass through.
2Object-affected harmful factors
If traffic filtering is applied at the security gateway, then some malicious traffic is blocked, but network components before the gateway remain vulnerable to overload
Solution Approach 1:
The patent applies segmentation by dividing the network into multiple zones with independent rate limiting policies. Different network components (routers, switches, gateways) each implement their own rate limiting, creating distributed protection layers that prevent any single point of failure and protect components at all levels.
Solution Approach 2:
The patent implements partial action by applying rate limiting selectively at multiple points in the network rather than relying on a single comprehensive filter. Each component applies partial filtering based on its local traffic patterns, collectively providing comprehensive protection without requiring any single component to handle all malicious traffic.
3Reliability
If rate limiting is implemented at multiple network components, then protection against DoS attacks is improved, but system complexity increases
Solution Approach 1:
The patent applies universality by implementing a standardized rate limiting mechanism that can be deployed uniformly across different network components (routers, switches, gateways). The same basic rate limiting logic and data structures are used throughout the network, reducing complexity through consistency while providing comprehensive DoS protection.
Data Source
AI summary
A network component has a set of one or more rules, each of which has a match component and an action component. If an incoming packet maps to the match component of a rule, then the packet is handled according to the rule's action component. If the rule also includes a limit component, then if the packet maps to the rule's match component, a family history of the rule is updated, and the packet is handled according to the rule's action component only if the rule's family history satisfies the rule's limit component.