RDMA Connection Cookie Verification for DoS Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
RDMA connection setups are vulnerable to denial-of-service (DoS) attacks, where malicious clients tie up server resources with incomplete connection requests, as the server allocates hardware and memory resources before verifying the legitimacy of the client.
Innovation Solution
Implementing a cookie-based verification system where the server only allocates resources after receiving a suitable cookie from the client, which is derived from the initial connection request, thereby reducing the risk of DoS attacks by ensuring legitimate clients provide the required cookie before resource allocation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If the server allocates hardware and memory resources before verifying the legitimacy of the client, then the connection setup speed is improved, but the server becomes vulnerable to DoS attacks where malicious clients tie up server resources
Solution Approach 1:
The server performs preliminary verification by checking for a valid cookie in the connection request message before allocating any hardware or memory resources. This preliminary action ensures that only legitimate clients can proceed to resource allocation, preventing DoS attacks while maintaining efficient connection setup for authenticated clients
Solution Approach 2:
A cookie-based verification mechanism is introduced as an intermediary between the connection request and resource allocation. The cookie acts as a mediator that carries verification information, allowing the server to authenticate clients without delaying the connection setup process for legitimate users while blocking malicious requests
2Reliability
If the server requires cookie verification before resource allocation, then security against DoS attacks is improved, but the connection establishment process becomes more complex
Solution Approach 1:
The verification logic is extracted into a separate cookie checking mechanism that operates independently from the main resource allocation process. This extraction allows the connection establishment to proceed through distinct phases: cookie verification first, then resource allocation, making the process more manageable and less complex overall
Solution Approach 2:
The connection establishment process is segmented into distinct stages: (1) receiving connection request with cookie, (2) verifying cookie validity, (3) allocating resources if verification succeeds. This segmentation reduces complexity by breaking down the monolithic connection process into manageable, sequential steps with clear decision points
Data Source
AI summary
A processor is configured to receive, from a client, a first message indicating a request to establish a connection between the client and a server, to ascertain that the first message does not include any cookie satisfying one or more criteria, to send, to the client, a second message that includes a first cookie, without allocating an endpoint on the server for the connection, in response to ascertaining that the first message does not include any cookie satisfying the criteria, to receive subsequently, from the client, a third message, to ascertain that the third message includes a second cookie, and that the second cookie satisfies the criteria, to allocate the endpoint for the connection in response to ascertaining that the second cookie satisfies the criteria, and to send, to the client, a fourth message indicating that the server is ready to receive data communication at the allocated endpoint.