Server Connection Minification for DoS Resource Conservation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing client-server systems face challenges in conserving server resources during denial of service (DoS) attacks, where attackers overwhelm servers with high or slow requests, leading to resource exhaustion and service disruptions.
Innovation Solution
Implementing a mechanism to identify and transition connections exhibiting attack characteristics into a 'minified' state, where server resources are reduced while maintaining the connection open, allowing the server to appear operational while minimizing resource usage, and potentially logging client information for analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the server maintains full resource allocation for each connection, then the service quality for legitimate clients is preserved, but the server resources are exhausted during DoS attacks
Solution Approach 1:
The patent applies local quality by differentiating resource allocation based on connection characteristics. Legitimate connections receive full resource allocation with complete HTTP processing, while suspicious connections (identified by slow request patterns, high connection counts, or abnormal behavior) are transitioned to a minified state with reduced resource allocation. This allows the server to maintain high service quality for legitimate clients while conserving resources during attacks.
Solution Approach 2:
The patent implements dynamic resource allocation through the connection state machine, which can transition connections between different states (normal, minified, closed). The server dynamically adjusts resource allocation based on real-time analysis of connection behavior, request rates, and other metrics. This dynamic approach allows the server to adapt resource usage to actual service needs rather than maintaining static allocation.
2Quantity of substance
If the server closes connections exhibiting attack characteristics, then server resources are conserved, but the appearance of service availability is lost
Solution Approach 1:
The patent extracts the resource-intensive HTTP processing layer from suspicious connections while maintaining the underlying TCP connection. When a connection is transitioned to the minified state, the server stops allocating resources for HTTP request parsing, response generation, and application logic execution. The connection is kept open at the transport layer to maintain the appearance of service availability, but the harmful resource consumption is extracted and eliminated.
3Ease of operation
If the server processes all HTTP requests fully, then complete service functionality is provided, but resource exhaustion occurs during slow DoS attacks
Solution Approach 1:
The patent applies partial action by performing only essential HTTP processing for connections in the minified state. Instead of fully parsing HTTP requests, generating complete responses, and executing application logic, the server performs minimal processing to maintain connection appearance while discarding the harmful request data. This partial processing approach prevents resource exhaustion while maintaining the illusion of service functionality.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
According to certain non-limiting embodiments disclosed herein, the functionality of a server is extended with a mechanism for identifying connections with clients that have exhibited attack characteristics (for example, characteristics indicating a DoS attack), and for transitioning internal ownership of those connections such that server resources consumed by the connection are reduced, while keeping the connection open. The connection thus moves from a state of relatively high resource use to a state of relatively low server resource use, and the server is able to free resources such as memory and processing cycles previously allocated to the connection. In some cases, the server maintains the connection for at least some time and uses it to keep the client occupied so that it cannot launch - or has fewer resources to launch - further attacks, and possibly to gather information about the attacking client.