Server Access Control via Transaction Interval Accumulation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional network monitoring tools are inadequate in distinguishing between recursive conditions from specific clients and general high traffic, fail to account for excessive transaction rates beyond IP addresses, and are inflexible in responding to excessive transaction rates, leading to server overload and denial of service.

Innovation Solution

A computer-implemented method that monitors transaction rates associated with user identifiers and network addresses, dynamically adjusts an accumulator based on historical intervals, and controls access by sending warnings, pausing transactions, or permanently denying access when thresholds are exceeded, ensuring fair distribution of server resources.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If conventional network monitoring tools are used to detect excessive transaction rates, then detection capability is provided, but the tools are inflexible and limited to denial of access responses only

Engineering Contradiction:

Improveresponse flexibilityVSAvoidaccess control effectiveness

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The system dynamically adjusts the accumulator value based on the current transaction interval compared to historical intervals. When the current interval is shorter than historical intervals (indicating accelerated transaction rates), the accumulator increases by a larger amount, triggering progressive responses (warning, delay, temporary halt, permanent denial) rather than a static binary decision

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The system changes the parameter of accumulator adjustment based on transaction interval analysis. The adjustment value is selected from pre-defined values based on how much the current interval deviates from historical intervals, allowing the system to adapt its response intensity to the severity of the transaction rate anomaly

Inventive Principle:

Principle #35Parameter changes

2Measurement precision

If network monitoring tools detect high transaction rates at high levels, then denial of service attacks are detected, but transaction rates that overwhelm server applications are overlooked

Engineering Contradiction:

Improvetransaction rate detection sensitivityVSAvoidserver protection effectiveness

Core Design Contradiction:

Measurement precisionVSReliability

Solution Approach 1:

The system performs preliminary analysis of transaction intervals before triggering denial of service protection. By accumulating interval deviations in the accumulator and comparing against thresholds, the system detects problematic patterns early, allowing progressive intervention (warnings, delays) before complete server overload occurs

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system uses feedback from historical transaction intervals to adjust the accumulator value for current transactions. This feedback mechanism allows the system to learn normal transaction patterns and detect deviations that indicate problematic behavior, improving detection precision for subtle overload conditions

Inventive Principle:

Principle #23Feedback

3Adaptability or versatility

If conventional monitoring tools associate transaction rates with single IP addresses, then network-level monitoring is provided, but excessive transaction rates from other identification forms are overlooked

Engineering Contradiction:

Improveidentification method coverageVSAvoidtransaction rate attribution accuracy

Core Design Contradiction:

Adaptability or versatilityVSMeasurement precision

Solution Approach 1:

The system is designed to work with multiple forms of transaction identification beyond just IP addresses. The accumulator and threshold comparison mechanism is identification-agnostic, allowing the same protective logic to apply whether transactions are identified by IP address, user ID, session token, or other identifiers

Inventive Principle:

Principle #6Universality (Multi-functionality)

4Ease of operation

If the server responds to each request from clients with correct target network address, then client access is permitted, but malicious attacks and looping conditions flood the server

Engineering Contradiction:

Improveclient access availabilityVSAvoidserver overload from excessive requests

Core Design Contradiction:

Ease of operationVSObject-generated harmful factors

Solution Approach 1:

The system applies preliminary anti-action by monitoring transaction intervals and accumulating deviations before the server processes requests. When the accumulator exceeds thresholds, the system proactively denies access or imposes delays, preventing malicious floods and looping conditions from overwhelming the server while allowing normal clients to proceed

Inventive Principle:

Principle #9Preliminary anti-action

Data Source

PatentUS10171632B2Controlling client access to a server application

Publication Date: 2019.01.01 KYNDRYL INC

AI summary

An approach is provided for controlling a rate at which requests from a client computer will be received by a server application executed on a server computer. Requests are received by the server computer at different times from the client computer and time intervals between different pairs of successive requests are measured. The server computer determines that each time interval is within a predefined range of time intervals. Based on each time interval being within the predefined range, the server computer determines and blocks a denial of service attack or an overload of requests from the client computer.