Packet Traffic Management Cache Protection Against SYN Floods
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The limited number of source port values and the interference of SYN flood requests complicate the efficient management of network flow control operations between control and data flow segments in packet traffic management, leading to potential Denial of Service (DoS) attacks.
Innovation Solution
A packet traffic management device employs a data flow segment and a control segment, where the control segment generates flow control data and offloads it to the high-speed cache of the data flow segment, and adaptive filters are activated to differentiate between genuine and malicious connections, thereby protecting the cache from SYN flood attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If source port values are recycled quickly to handle high connection volume, then connection throughput is improved, but the risk of SYN flood attacks increases because recycled ports may be used before previous connections are closed
Solution Approach 1:
The system performs preliminary verification by checking whether a connection with a recycled source port is genuinely new or a replayed malicious packet before allowing it to proceed. This preliminary check prevents SYN flood attacks while enabling rapid port recycling for legitimate connections.
2Speed
If flow control data is off-loaded to high-speed cache for all connections, then packet processing speed is improved, but cache resources are consumed by malicious SYN flood packets
Solution Approach 1:
A control segment acts as an intermediary between incoming packets and the high-speed cache. It filters and validates packets before they are off-loaded to the cache, preventing malicious SYN flood packets from consuming cache resources while allowing legitimate traffic to be processed at high speed.
3Reliability
If adaptive filters are activated to detect malicious connections, then security is improved, but processing overhead increases
Solution Approach 1:
The system applies adaptive filtering selectively rather than universally. Filters are activated based on detected attack patterns and traffic conditions, applying partial monitoring and filtering only when necessary. This reduces processing overhead while maintaining security detection capability during actual attacks.
Data Source
AI summary
Embodiments are directed towards minimizing the impact flood attacks may have on packet traffic management performance. A packet traffic management device (“PTMD”) may employ a data flow segment (“DFS”) and control segment (“CS”). The CS may perform high-level control functions and per-flow policy enforcement for connection flows maintained at the DFS, while the DFS may perform statistics gathering, per-packet policy enforcement (e.g., packet address translations), or the like, on connection flows maintained at the DFS. The DFS may include high-speed flow caches and other high-speed components that may be comprised of high-performance computer memory. The impact of flood attacks may be reduced by protecting the high-speed flow caches from being consumed by flow control data associated with malicious and/or in-operative non-genuine network connections. In at least one of the various embodiments, flood control filters may be adaptively activated based on the condition and quality of network traffic received at PTMD.