Shuffle-Sharded Load Balancing for Cloud Service DDoS Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional cloud-hosting infrastructure systems lack configurable flexibility and telemetry information for layer 3 and 4 routing, leading to inefficiencies in resource allocation and increased vulnerability to DDOS attacks, which can impact other services.
Innovation Solution
Implementing shuffle sharding with a load-balancer program that routes data traffic through ingress host cells based on mapping data, captures telemetry information, and isolates services using quarantine cells to mitigate DDOS attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If conventional layer 3 network load balancing functions are used, then routing operations can be performed, but telemetry information related to routing actions is not accessible to the service provider
Solution Approach 1:
The patent introduces a layer 7 load balancer as an intermediary component between the layer 3 network load balancer and the service provider's computing resources. This layer 7 load balancer acts as a mediator that receives telemetry information from the layer 3 load balancer and makes it accessible to the service provider, thereby resolving the information loss without significantly increasing architectural complexity
Solution Approach 2:
The patent adds a layer 7 dimension to the existing layer 3 networking architecture. By introducing application-layer load balancing capabilities, the system gains access to telemetry information that was previously unavailable at the network layer, effectively adding another dimension of observability and control
2Reliability
If conventional security services drop traffic exceeding threshold amounts, then DDOS attack mitigation can be performed, but acceptable data traffic is also dropped indiscriminately
Solution Approach 1:
The patent applies different security policies to different sources of traffic based on their characteristics. Instead of a uniform threshold-based approach, the system identifies and treats malicious traffic differently from legitimate traffic, allowing acceptable data traffic to pass through while blocking only the harmful portions
Solution Approach 2:
The system uses telemetry information to monitor traffic patterns and adjust security responses dynamically. By analyzing traffic characteristics in real-time, the security services can distinguish between DDOS attacks and legitimate high-volume traffic, adjusting drop thresholds based on feedback from observed traffic patterns
3Reliability
If conventional security services drop suspicious traffic indiscriminately, then security can be maintained, but noisy neighbor problems occur impacting other computing services
Solution Approach 1:
The patent segments the traffic handling architecture into isolated components, including separate load balancers and computing resource groups. This segmentation contains DDOS attacks and malicious traffic to specific segments, preventing them from affecting other computing services hosted on the same infrastructure
Solution Approach 2:
The patent extracts malicious traffic from the general traffic flow and routes it through separate security handling paths. By taking out suspicious traffic early in the processing chain and treating it differently from legitimate traffic, the system maintains security while preventing noisy neighbor effects
Data Source
AI summary
Embodiments include hardware and software resources of a distributed computing system for routing user data traffic to computing resources organized using a shuffle sharding arrangement. Layer 3 (L3) network load balancers proxy or route user data traffic requests to layer 4 (L4) transport load balancers. A L4 transport load balancer proxies and routes the requests to certain ingress cells that are assigned or mapped to the hosted computing services of the user requests according to proxy or routing functions and mapping data. The assignments between cells and computing services may be implemented by a cell manager program when onboarding the computing services in accordance with the shuffle sharding arrangement and configuration. The transport load-balancer may impose and enforce the shuffle sharding by routing user data to ingress cells assigned to the computing services using previously determined mappings data stored in a mappings database (or data file).