NIC Hardware Classifier for DoS Attack Containment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Denial of Service (DoS) attacks on network systems consume excessive resources, disrupting services by overwhelming network bandwidth and resources, and existing mitigation methods are limited by resource availability and cost, particularly affecting multi-service hosts where a single targeted service disruption can halt all services on a shared computer system.
Innovation Solution
Implementing a method and system using a network interface card (NIC) with hardware and software resources to dynamically reroute packets during a DoS attack, utilizing standby and non-standby hardware receive rings and software receive rings to isolate and manage traffic, thereby containing the attack and maintaining system functionality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional DoS mitigation methods are used, then resource consumption is reduced, but service disruption occurs and all services on a shared host are halted
Solution Approach 1:
The patent segments network traffic into different queues based on destination IP addresses. It maintains a first queue for legitimate traffic and a second queue for DoS attack traffic. By separating traffic flows into distinct queues, the system can process legitimate services while isolating attack traffic, preventing the attack from halting all services on the shared host.
Solution Approach 2:
The patent introduces a intermediary mechanism using network interface card (NIC) hardware resources to manage traffic between legitimate services and DoS attacks. The NIC hardware processes packets and directs them to appropriate queues, acting as a mediator that protects legitimate services from attack traffic without requiring overprovisioning of host resources.
2Reliability
If overprovisioning is used to handle excess load, then service disruption is prevented, but resource allocation cost increases
Solution Approach 1:
The patent enables the network interface card to self-manage DoS attack traffic using its own hardware resources. The NIC hardware autonomously processes packets, identifies attack traffic, and directs it to appropriate queues without requiring excessive CPU resources or overprovisioning of host infrastructure. This self-service approach reduces the need for expensive overprovisioning while maintaining service continuity.
3Speed
If hardware resources are used for packet processing, then processing speed increases, but device complexity increases
Solution Approach 1:
The patent makes the network interface card hardware perform multiple functions: it processes legitimate traffic, identifies DoS attack traffic, and directs packets to appropriate queues. By enabling the NIC hardware to handle these diverse functions, the system achieves high processing speed without requiring separate complex processing systems for each function, thus managing device complexity while improving performance.
Data Source
AI summary
A method for processing packets, where the method includes programming a hardware classifier in a network interface card (NIC) to send packets associated with a first packet destination to a non-standby hardware receive ring (HRR), programming a software ring to obtain packets from the non-standby HRR, programming the software ring to send packets for the first destination to a first software receive ring (SRR), wherein the first packet destination is associated with the first SRR, obtaining identifying information about a packet associated with a denial of service (DoS) attack, programming the hardware classifier, using the identifying information, to send the packet associated with the DoS attack to a standby HRR, and for each packet received by the hardware classifier determining to which of the standby HRR and the non-standby HRR to send the packet using the programming of the hardware classifier.