SDN Controller Rate-Limit Meter Allocation for DDoS Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods lack effective DDoS prevention mechanisms in Software Defined Networks (SDNs), which are essential for protecting network destinations from flooding attacks and ensuring continuous service availability, as existing solutions are either non-programmable, introduce significant overhead, or are not scalable.
Innovation Solution
Implementing a method where the SDN controller allocates rate-limiting meters to network elements based on available capacity and traffic flow paths, allowing for distributed and scalable DDoS prevention by configuring meter entries to limit traffic according to specified rate limits, thereby minimizing overhead and enabling finer-grained control over traffic flows.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a DoS prevention and mitigation scrubber box is used, then DoS attacks can be detected and mitigated, but the solution lacks programmability and introduces additional overhead in the network
Solution Approach 1:
The patent introduces a controller as an intermediary component that manages rate limit indicators and coordinates DoS prevention across multiple network elements. The controller receives rate limit indicators from network destinations and distributes them to appropriate network elements, providing centralized programmability without requiring complex scrubber boxes at every network location.
Solution Approach 2:
The patent segments the DoS prevention functionality by separating the control plane (controller managing rate limit indicators) from the data plane (network elements enforcing rate limits). This segmentation allows simple network elements to enforce rate limits while the intelligent control logic resides in the controller, reducing overall system complexity and overhead.
2Productivity
If rate limit indicators are distributed to multiple network elements, then DDoS prevention becomes more scalable and lightweight, but coordination and allocation complexity increases
Solution Approach 1:
The patent implements self-service through automatic meter allocation where the controller autonomously receives rate limit indicators from network destinations and automatically distributes them to appropriate network elements based on traffic flow paths. This eliminates manual configuration complexity while enabling scalable distributed DoS prevention across the network.
Solution Approach 2:
The system uses feedback mechanisms where network elements report meter status and traffic conditions back to the controller, which then adjusts rate limit indicator distribution accordingly. This feedback loop enables dynamic coordination of rate limiting across multiple network elements without requiring complex manual allocation.
3Quantity of substance
If meter entries are installed on network elements with fewest empty slots, then resource utilization is optimized, but allocation time and complexity increase
Solution Approach 1:
The controller performs preliminary allocation of rate limit indicators to network elements based on predicted traffic patterns and current meter slot availability. By proactively distributing rate limits before traffic bursts occur, the system optimizes slot utilization without requiring complex real-time calculations during attack scenarios, reducing allocation time.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method in a controller module is described for allocating rate-limiting meters to a plurality of network elements (NEs) of a software defined network (SDN). The method includes receiving a plurality of rate limit indicators, from one or more network destinations, for a plurality of flows of data that arrive at the network destinations; sending one or more meter installation messages to cause a plurality of meter entries corresponding to the plurality of rate limit indicators to be installed by one or more of the NEs according to a metering configuration that is determined by, for each of the flows, selecting a flow of the plurality of flows that has not been selected yet and that traverses a path in the SDN having a fewest number of the plurality of NEs, and selecting a NE from the path that the selected flow traverses to have a meter entry installed.