Routing-Aware Network Limiter Using Token Buckets and Bloom Filters
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computing service environments face challenges in distinguishing non-malicious from malicious network traffic, particularly during DDoS attacks, where malicious clients overwhelm destination hosts or services with excessive network packets, leading to system paralysis and resource consumption.
Innovation Solution
A networking device employs IP address mapping to destination hosts or services, using token buckets and Bloom limiters to regulate traffic, dropping or deprioritizing packets from overloaded source networks, and prioritizing legitimate traffic, thereby mitigating the impact of DDoS attacks by managing network traffic based on the physical capabilities of destination hosts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network traffic is regulated using traditional rate limiters, then malicious traffic can be blocked, but legitimate traffic may be misidentified and blocked as well
Solution Approach 1:
The patent segments the rate limiting mechanism into multiple components: token buckets are assigned to individual destination IP addresses rather than applying a single global rate limit, and Bloom filters are used to probabilistically identify source networks generating excessive traffic. This segmentation allows legitimate traffic to individual destinations to pass through while blocking malicious traffic patterns.
Solution Approach 2:
The patent introduces Bloom filters as an intermediary data structure between the traffic monitoring system and the rate limiting enforcement. The Bloom filter probabilistically determines whether a source network is generating excessive traffic, serving as a mediator that reduces false positives before traffic is actually blocked, thereby improving identification accuracy without unnecessarily blocking legitimate traffic.
2Adaptability or versatility
If IP address mapping is used to regulate traffic to destination hosts, then traffic can be controlled based on host capabilities, but complexity of traffic management increases
Solution Approach 1:
The patent creates a mapping between destination IP addresses and physical destination hosts, segmenting the traffic control mechanism by individual hosts. Each destination host receives its own token bucket allocation, allowing traffic regulation to be adapted to the specific capabilities and requirements of each host while maintaining manageable complexity through structured organization.
Solution Approach 2:
The patent performs preliminary mapping of IP addresses to destination hosts before traffic regulation is applied. This pre-establishment of relationships allows the system to efficiently determine which token bucket applies to each packet without complex real-time analysis, reducing operational complexity while maintaining adaptability.
3Ease of operation
If token buckets are allocated to each destination IP address, then traffic to individual destinations can be controlled, but resource consumption increases
Solution Approach 1:
The patent merges multiple destination IP addresses that map to the same physical destination host into a single token bucket allocation. This consolidation reduces the total number of token buckets required while maintaining the ability to control traffic to individual destinations through the IP-to-host mapping, thereby reducing resource consumption without sacrificing operational ease.
Solution Approach 2:
The patent makes the token bucket mechanism universal by allowing it to serve multiple destination IP addresses through the IP-to-host mapping relationship. A single token bucket associated with a destination host can regulate traffic across multiple IP addresses, reducing the quantity of resources needed while maintaining individual destination control capabilities.
Data Source
AI summary
Technology is described for managing network traffic directed to a plurality of destination internet protocol (IP) addresses that are served by a destination host or service. A network action communication for a destination IP address served by the destination host or service may be received. The destination host or service may be overloaded when a number of network action communications directed to the plurality of destination IP addresses served by the destination host or service exceeds a defined threshold. The network action communications may be dropped in order to prevent the destination host or service from receiving a volume of network traffic that exceeds the defined threshold.