Pending Interest Table Segmentation for DDoS Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Node devices in name-based networks, such as CCN/NDN, are vulnerable to distributed denial of service (DDoS) attacks due to pending interest table (PIT) overflow, where excessive request messages hinder normal processing, as they either delete recorded information or discard new messages.
Innovation Solution
The node device configures multiple pending interest tables (PITs) corresponding to interface units, with a control unit identifying the appropriate PIT for each request message and controlling storage to prevent overflow, and transmits traffic control messages when capacity thresholds are exceeded to manage request message flow.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single pending interest table (PIT) is used to store all request messages, then the PIT can maintain complete routing information for all interfaces, but the PIT becomes vulnerable to overflow during DDoS attacks
Solution Approach 1:
The single PIT is divided into multiple sub-PITs, each corresponding to a specific interface unit. This segmentation isolates the impact of DDoS attacks to individual sub-PITs rather than affecting the entire PIT, preventing system-wide overflow while maintaining complete routing information across all sub-PITs collectively.
2Reliability
If multiple PITs are configured corresponding to each interface unit, then overflow damage is minimized by isolating attacks to specific PITs, but the device complexity increases
Solution Approach 1:
Multiple PITs are created with each PIT dedicated to a specific interface unit. This segmentation provides isolation so that attacks targeting one interface only affect its corresponding PIT, not the entire system, thereby improving attack resistance while keeping management straightforward through interface-based mapping.
Solution Approach 2:
The control unit acts as an intermediary that manages the mapping between interface units and corresponding PITs. It receives request messages, identifies the source interface unit, and directs the message to the appropriate PIT, simplifying the management complexity by providing a centralized coordination mechanism.
3Productivity
If the PIT capacity is increased to handle more request messages, then the node can process more traffic, but the node becomes more vulnerable to DDoS attacks causing overflow
Solution Approach 1:
Instead of using one large PIT that can be overwhelmed by DDoS attacks, the system segments the capacity across multiple smaller PITs. Each PIT handles traffic from a specific interface unit, so even if one PIT reaches capacity due to an attack, other PITs continue to process normal traffic, maintaining overall productivity while limiting attack impact.
Data Source
AI summary
A node apparatus and method are described to prevent overflow of a pending interest table (PIT) in a name based network system. The node apparatus and method increases a number of PITs to correspond to a number of interface units so that the PITs match the interface units, respectively, and stores a request message flowing in per interface unit in the matching PITs. In addition, when a capacity used at each of the PITs exceeds a threshold, the node apparatus and method transmits a traffic control message for traffic control through respectively matching interface units to prevent overflow of the PITs.