Router Chip Firewall Circuitry for DoS Attack Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Router chips of the SOC type lack the computation power to effectively handle Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks, leading to system overload and unavailability.
Innovation Solution
Incorporating firewall circuitry between the network interface circuits and the central processing unit, which recognizes and blocks malicious data packets using a dedicated hardware component, reducing CPU computation load and implementing a rate-based method to selectively forward or discard packets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If router chips use embedded CPU for packet processing, then routing functionality is achieved, but computation power is insufficient to handle DoS attacks
Solution Approach 1:
The patent divides the packet processing function into two segments: a hardware firewall circuit that handles DoS attack detection and blocking, and a CPU that handles normal routing operations. This segmentation allows each component to be optimized for its specific function, with the firewall circuit providing dedicated DoS protection without overloading the CPU.
Solution Approach 2:
The firewall circuit acts as an intermediary component between the network interface and the CPU. It intercepts packets suspected of being DoS attacks and handles them separately, preventing these malicious packets from consuming CPU resources. This intermediary structure protects the CPU while maintaining routing functionality.
2Reliability
If firewall circuitry is added to handle DoS attacks, then protection capability is improved, but device complexity increases
Solution Approach 1:
The patent merges the firewall circuit with the router chip's existing architecture by integrating it into the SOC structure. The firewall circuit shares the same physical chip and communicates with existing components like the network interface and CPU through standard interfaces. This merging approach provides DoS protection while minimizing additional complexity by leveraging the existing chip infrastructure.
3Measurement precision
If CPU processes all packets, then comprehensive packet inspection is achieved, but system becomes vulnerable to overload during attacks
Solution Approach 1:
The patent extracts the DoS attack detection and blocking function from the CPU and places it in a dedicated hardware firewall circuit. This extraction allows the CPU to focus on legitimate routing operations while the firewall circuit handles malicious packets. The firewall circuit maintains packet inspection accuracy for DoS detection while preventing system overload during attacks.
Data Source
AI summary
A router chip is proposed which comprises a central processing unit, a plurality of network interface circuitry, and a firewall circuitry coupled between the plurality of network interface circuits and the central processing unit to selectively block network traffic.