Rate Limiting System for Network Flood Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current firewalls, both perimeter and system firewalls, are ineffective in managing and detecting packet floods, leading to resource wastage and failure to control traffic rates, especially in cases where a server is under heavy load or low configuration, and existing methods do not optimize filtering based on host capabilities.
Innovation Solution
Implementing a rate limiting system (RLS) that parses data packets and adjusts filtering rules based on feedback from host systems about their available resources, using a Central Switch Controller to collect and authenticate feedback and modify filtering behavior accordingly, thereby controlling packet floods at the perimeter level.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If perimeter firewalls filter all incoming traffic, then security is improved, but host resources are wasted handling excessive traffic and the firewall cannot adapt to host capabilities
Solution Approach 1:
The system implements feedback by having the host system send capability information (CPU load, memory availability, network interface status) to the perimeter firewall. The firewall uses this feedback to dynamically adjust filtering thresholds and packet handling strategies, ensuring optimal resource utilization while maintaining security.
Solution Approach 2:
The firewall transitions from static filtering rules to dynamic adaptive filtering. It continuously monitors host capability feedback and adjusts its filtering behavior in real-time, changing packet acceptance thresholds, rate limiting parameters, and resource allocation based on current host conditions.
2Ease of manufacture
If perimeter firewalls use fixed filtering rules, then implementation is simple, but they cannot adapt to servers with different configurations and load conditions
Solution Approach 1:
The host system automatically generates and sends capability information to the firewall without manual configuration. The firewall autonomously processes this information and adjusts its filtering rules dynamically, eliminating the need for manual rule customization for each host while maintaining high adaptability.
Solution Approach 2:
The firewall dynamically changes filtering parameters (thresholds, rate limits, resource allocation) based on received host capability data. Instead of fixed rules, it adjusts operational parameters in real-time to match host conditions, achieving versatility without complex rule sets.
3Reliability
If system firewalls handle packet floods, then host-based protection is provided, but local LAN subnets may be flooded and resources are wasted
Solution Approach 1:
The perimeter firewall performs preliminary filtering of suspicious and excessive traffic before it reaches the host system. By detecting and blocking potential floods at the perimeter using adaptive thresholds, it prevents harmful traffic from entering the internal network, protecting both the host and LAN subnet.
Solution Approach 2:
The perimeter firewall acts as an intermediary between external networks and the internal host/LAN. It mediates traffic flow by filtering and rate-limiting packets based on host capability feedback, preventing excessive traffic from overwhelming the host or propagating to the LAN subnet while still allowing legitimate traffic through.
4Ease of operation
If firewalls filter at IP level, then filtering is straightforward, but Layer 4 protocol attacks like SYN floods are not effectively detected
Solution Approach 1:
The system adds Layer 4 protocol analysis capability to the traditional IP-level filtering. It examines TCP flags, SYN packet patterns, and protocol-specific characteristics while maintaining the simplicity of IP-level operation, enabling detection of SYN floods and other Layer 4 attacks without abandoning straightforward filtering approaches.
Data Source
AI summary
A method of controlling protection of a computing device or computer network. The method comprises directing incoming data packets to the computing device or computer network via a rate limiting system that is adapted to parse the data packets, providing the computing device or computer network with at least one threshold parameter for identifying a data flood condition, the threshold parameter being a function of one or more available computing resources of the computing device or computer network; the computing device or computer network responding to incoming data packets received via the rate limiting system that cause the at least one threshold parameter to be breached by generating event data; generating feedback data based on the event data; transmitting the feedback data to the rate limiting system; and the rate limiting system modifying its behavour according to the feedback data.