NIC Throttling Function for DOS Attack Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network interface controllers (NICs) struggle to handle high rates of packet arrival during denial of service (DOS) attacks, leading to packet dropping and degradation of network traffic, as they overwhelm host processors and firewalls, which fail to process legitimate traffic due to resource exhaustion.
Innovation Solution
A system and method where the NIC monitors the host processor's load and throttles packet transmission using a throttling function, dropping undesired packets to prevent overflow and maintain network protection without severely impacting desired traffic, by implementing a throttling function that adjusts packet flow based on queue lengths and priority.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the NIC transfers packets to the host computer at high speed, then network throughput is improved, but the host processor or memory bus becomes over-burdened and unable to accept packets, causing packet dropping
Solution Approach 1:
The patent introduces a buffer memory as an intermediary component between the NIC and the host processor. This buffer temporarily stores incoming packets, decoupling the high-speed packet arrival from the slower processor handling. The buffer acts as a mediator that absorbs the throughput difference, allowing high network throughput while preventing packet loss due to processor overload.
Solution Approach 2:
The patent implements preliminary action by pre-allocating buffer memory space and establishing buffer management mechanisms before packet flooding occurs. The system proactively manages buffer allocation and packet queuing in advance, rather than reacting to overflow conditions. This preliminary preparation ensures that when high-rate packet arrival occurs, the system can immediately absorb the traffic without dropping packets.
2Measurement precision
If the firewall processes all incoming packets during a DOS attack, then packet classification accuracy is improved, but the firewall becomes overwhelmed and cannot service valid connection traffic
Solution Approach 1:
The patent applies segmentation by dividing the packet processing workload between the NIC and the host processor. The NIC performs initial packet filtering and classification, segmenting the processing tasks. This allows the firewall to focus on complex classification decisions while the NIC handles preliminary filtering, maintaining classification accuracy without overwhelming the firewall's processing capacity.
Solution Approach 2:
The patent implements partial action by having the NIC perform partial packet processing and filtering before packets reach the host processor. The NIC executes preliminary classification and discards obviously unwanted packets, so the firewall only needs to process a subset of packets. This partial preprocessing maintains overall classification accuracy while preserving firewall processing capacity for legitimate traffic.
3Quantity of substance
If the NIC accepts all incoming packets during a DOS attack, then network traffic capture is improved, but packet overflow occurs and network performance degrades
Solution Approach 1:
The patent implements feedback mechanisms where the NIC monitors buffer utilization levels and adjusts packet acceptance accordingly. When the buffer approaches capacity, the NIC provides feedback to throttle or drop incoming packets, preventing overflow. This feedback-controlled packet acceptance maintains optimal packet capture volume while avoiding the harmful effects of buffer overflow and performance degradation.
Solution Approach 2:
The patent applies dynamics by making the NIC's packet acceptance rate adjustable rather than fixed. The system dynamically modifies the packet acceptance threshold based on current buffer conditions, processor load, and traffic patterns. This dynamic adjustment allows the NIC to capture maximum legitimate traffic while automatically reducing acceptance during attack conditions, preventing overflow and maintaining network performance.
Data Source
AI summary
A system and method for controlling a flow of data from a network interface controller (NIC) to a host processor coupled to the NIC. Data such as IP packets are received by the NIC and may be transmitted to the host processor for further processing such as firewall processing. The NIC is in communication with the host processor using, for example, a software driver running on the host processor. The NIC may monitor the processing load on the host processor as it handles packet data received from the NIC. As the processing load increases, the NIC may begin to throttle the quantity of packets being sent to the host processor in order to avoid overloading the host processor. The throttling may be governed by a heuristic throttling function.