Network Perimeter Device DDOS Protection via Flow Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data center networks are vulnerable to distributed denial of service (DDOS) attacks, where 'fake client devices' overwhelm servers with excessive network traffic, leading to processing and capacity issues that negatively impact server operations.
Innovation Solution
A method and system for processing network traffic data units (NTDUs) that involves a perimeter device and filter devices to determine and manage valid client-to-resource traffic, using a selection function to route NTDUs through available filter devices, and implementing rate limiting and validation flows to prevent malicious traffic, thereby maintaining performance under increased client device demand without impacting latency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network devices implement strict traffic validation and filtering to prevent DDOS attacks, then security and reliability improve, but processing time and latency increase
Solution Approach 1:
The system performs preliminary actions by validating flows in advance and establishing validation results before actual traffic processing occurs. Flow validation is performed proactively so that when traffic arrives, the validation result is already available, enabling fast forwarding decisions without real-time validation delays.
Solution Approach 2:
The system implements feedback mechanisms where validation results from flow analysis are fed back into the forwarding decisions. Validation information about client devices and flows is used to make subsequent forwarding choices, allowing the system to learn from previous validation outcomes and optimize future processing speed and security.
2Reliability
If network devices process and validate all incoming traffic to ensure security, then reliability improves, but device complexity and processing overhead increase
Solution Approach 1:
The system segments the validation and forwarding functions into separate components. Validation is handled by dedicated validation entities that analyze flows independently from the forwarding entities that make routing decisions. This segmentation allows each component to specialize, reducing overall processing complexity while maintaining comprehensive validation.
Solution Approach 2:
The system introduces intermediary validation entities that act as mediators between incoming traffic and forwarding decisions. These intermediaries handle the complex validation logic separately, shielding the main forwarding path from validation complexity while ensuring all traffic is properly validated before forwarding.
3Reliability
If network devices implement comprehensive flow validation to filter malicious traffic, then security improves, but network throughput and productivity decrease
Solution Approach 1:
Flow validation is performed as a preliminary action that establishes validation results in advance. Once validation results are obtained for a flow, subsequent traffic in the same flow can be forwarded quickly without repeating the validation process, maintaining high throughput while ensuring comprehensive security.
Solution Approach 2:
Validation feedback mechanisms allow the system to use previously obtained validation results to accelerate future forwarding decisions. When a flow is validated, the result is fed back to enable fast forwarding for subsequent packets in the same flow, reducing the throughput penalty of validation.
Data Source
AI summary
In general, embodiments of the invention relate to processing network traffic data units (NTDUs). More specifically, embodiments of the invention relate to processing NTDUs transmitted between client device and the one or more protected resources. The protected resources are logically surrounded by a perimeter, which is implemented as a set of network devices that manage the flow of NTDUs between client devices and the protected resources. The perimeter works in conjunction with a set of filtering devices to determine whether a given NTDU can ultimately be transmitted to, and processed by, a protected resource.