Service Function Chaining Node for DDoS Mitigation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current systems face challenges in effectively mitigating Distributed Denial-of-Service (DDoS) attacks across multiple domains due to difficulties in identifying attackers, leveraging amplification techniques, and managing resource usage efficiently, leading to potential overload and increased latency.

Innovation Solution

Implementing a service function chaining (SFC) node that receives packets with SFC Path IDs and Indices, determines whether to apply service functions, sets treated indicators, and modifies paths to optimize resource allocation and traffic steering, enabling collaboration between security service functions across domains through standardized APIs and tunnels.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If service functions are applied to all packets to ensure security, then detection and mitigation capability is improved, but resource usage increases and latency increases

Engineering Contradiction:

Improvedetection and mitigation capabilityVSAvoidresource usage

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The patent applies service functions selectively based on packet characteristics and threat levels rather than uniformly to all packets. Different packets receive different levels of security processing - high-priority or suspicious packets undergo full inspection while normal packets receive streamlined processing, optimizing the balance between security and resource consumption

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The system performs partial security processing on packets that don't require full inspection. By applying only necessary service functions to each packet based on its characteristics, the system avoids excessive processing while maintaining adequate security coverage, reducing overall resource usage and latency

Inventive Principle:

Principle #16Partial or excessive action

2Reliability

If service functions are applied to all packets to ensure security, then detection and mitigation capability is improved, but latency increases

Engineering Contradiction:

Improvedetection and mitigation capabilityVSAvoidlatency

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent implements differentiated processing where packets are routed through appropriate service function chains based on their characteristics. Critical packets receive immediate attention with optimized processing paths, while less critical packets undergo standard processing, thereby reducing overall latency while maintaining detection capability

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The system applies service functions partially based on packet priority and threat assessment. High-priority packets receive complete security processing while lower-priority packets receive reduced processing, preventing unnecessary latency for non-critical traffic while maintaining security effectiveness

Inventive Principle:

Principle #16Partial or excessive action

3Adaptability or versatility

If multiple domains implement independent security services to maintain domain autonomy, then adaptability is improved, but device complexity increases

Engineering Contradiction:

Improvedomain autonomyVSAvoidsystem complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent employs universal service function chains that can be deployed across multiple domains with consistent behavior. The same service function modules handle security tasks in different domains, providing adaptability and domain autonomy while reducing complexity through standardized, reusable components rather than custom implementations in each domain

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The system introduces service function chains as intermediary layers between domains. These chains act as standardized mediators that simplify inter-domain interactions, allowing each domain to maintain autonomy while reducing overall system complexity through a uniform interface and processing model

Inventive Principle:

Principle #24Intermediary (Mediator)

4Productivity

If security services are centralized to improve resource sharing, then productivity is improved, but adaptability worsens

Engineering Contradiction:

Improveresource sharing efficiencyVSAvoiddomain autonomy

Core Design Contradiction:

ProductivityVSAdaptability or versatility

Solution Approach 1:

The patent segments security services into modular service function chains that can be distributed across multiple locations while maintaining centralized coordination. This segmentation enables resource sharing and productivity improvements while preserving domain autonomy through localized service instances that can be independently configured and adapted

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS11240264B2System and method for security service collaboration

Publication Date: 2022.02.01 TELEFONAKTIEBOLAGET LM ERICSSON (PUBL)

AI summary

Systems and methods are provided for mitigating security attacks by enabling collaboration between security service functions. A Service Function Chaining (SFC) node receives a packet and determines whether to apply a service function to the packet. Responsive to determining that the packet has been treated by the service function, the packet can be reclassified and switched to a different SFC path.