Packet Policer Segmentation for DoS Attack Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional traffic policing systems disproportionately discard legitimate packets during Denial-of-Service (DoS) attacks, rendering them ineffective due to their inability to differentiate between packet sizes and rates, leading to overloading and disruption of network resources.
Innovation Solution
Implementing a system with multiple packet policers that track rates of packets across various size ranges, dynamically adjusting parameters such as threshold rates and burst-size limits to differentiate between legitimate and illegitimate traffic, ensuring that only excessive packets are discarded while allowing legitimate traffic to be processed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a traditional traffic policer limits the total bandwidth of incoming packets, then the network resource is protected from overload, but legitimate packets with small sizes are disproportionately discarded
Solution Approach 1:
The traffic policer is segmented into multiple rate policers, each responsible for tracking packets of specific size ranges. This segmentation allows differential policing strategies for different packet sizes, preventing uniform discarding of all packets when bandwidth limits are exceeded.
Solution Approach 2:
Each rate policer is configured with local quality parameters (threshold rates and burst-size limits) specific to its assigned packet size range. This enables tailored protection strategies where small packets have different thresholds than large packets, preserving legitimate small packets while blocking attack traffic.
2Reliability
If a rate policer limits the rate of incoming packets, then the network resource is protected from high packet rates, but legitimate packets of any size are discarded when packet rates exceed the threshold
Solution Approach 1:
The single rate policer is divided into multiple rate policers, each tracking packets within specific size ranges. This segmentation enables size-aware rate limiting where the threshold rate applies differently to different packet sizes, preserving legitimate traffic patterns.
Solution Approach 2:
The system changes the parameter of rate thresholding by making it size-dependent. Each rate policer has threshold rates and burst-size limits configured according to its packet size range, transforming the uniform rate limiting into adaptive rate limiting that preserves legitimate traffic.
3Measurement precision
If multiple packet policers track rates of packets with various sizes, then differentiation between legitimate and illegitimate traffic is improved, but device complexity increases
Solution Approach 1:
The policing function is segmented into multiple specialized rate policers, each handling a specific packet size range. This segmentation improves measurement precision by tracking different packet types separately, while the modular structure keeps each individual policer simple and manageable.
Solution Approach 2:
Each rate policer is a universal component that can handle any packet size range assigned to it. The same policer structure and logic are reused across different size ranges, reducing overall system complexity through component reuse while maintaining high differentiation accuracy.
Data Source
AI summary
The disclosed method may include (1) determining a size of a packet received at a network device, (2) identifying, within a plurality of packet policers that track rates of packets with various sizes received at the network device, a packet policer that tracks rates of packets whose sizes are within a range that includes the size of the packet, (3) determining a current rate of packets tracked by the packet policer, and then (4) handling the packet based at least in part on whether the current rate exceeds a threshold rate. Various other apparatuses, systems, and methods are also disclosed.