Smart NIC Hardware Accelerator for DoS Attack Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing denial-of-service (DoS) attack identification and mitigation mechanisms are computationally intensive, requiring numerous rate counters and threshold values that need to be learned periodically, making them inefficient for data center servers and stand-alone firewall appliances.
Innovation Solution
A Smart NIC-based hardware accelerator that updates rate-based counters by performing a longest prefix match on domain names and path strings, constructing challenge messages when thresholds are exceeded, and allowing legitimate requests to pass through without CPU intervention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If rate-based filtering with numerous counters and threshold values is used for DoS attack identification, then attack detection capability is improved, but computational load on CPU increases
Solution Approach 1:
The patent extracts the computationally intensive rate counter update operations from the main CPU and implements them in hardware using a dedicated rate counter update circuit. This circuit independently performs longest prefix match operations and updates rate counters without CPU intervention, thereby reducing CPU computational load while maintaining comprehensive DoS attack detection capability through multiple parallel counters.
Solution Approach 2:
The patent introduces a hardware-based rate counter update circuit as an intermediary between network packet input and CPU processing. This intermediary handles the computationally intensive tasks of parsing application layer requests, performing longest prefix match on domain names and path strings, and updating rate counters, allowing the CPU to focus on higher-level security decision-making.
2Measurement precision
If fine-grained rate monitoring with massive number of counters is implemented, then DoS attack identification accuracy is improved, but processing time increases
Solution Approach 1:
The patent replaces software-based rate counter updating with a dedicated hardware circuit that performs longest prefix match operations in parallel. This hardware implementation maintains fine-grained monitoring precision through multiple counters while dramatically reducing processing time by eliminating software interpretation overhead and enabling simultaneous counter updates.
Solution Approach 2:
The patent implements preliminary action by pre-configuring multiple rate counters with specific match criteria in the hardware circuit. When packets arrive, the circuit simultaneously evaluates multiple pre-defined patterns and updates corresponding counters in parallel, avoiding sequential processing delays while maintaining precise rate monitoring for different traffic patterns.
3Adaptability or versatility
If periodic learning of threshold values is performed, then adaptability to legitimate traffic is improved, but system complexity increases
Solution Approach 1:
The patent implements self-service through automated threshold value learning that operates independently without requiring manual configuration or complex administrative intervention. The system automatically monitors traffic patterns, identifies legitimate traffic baselines, and adjusts threshold values dynamically, thereby improving adaptability while keeping system complexity manageable through automated rather than manual processes.
4Reliability
If challenge messages are constructed and transmitted for rate threshold violations, then DoS attack mitigation is improved, but network latency increases
Solution Approach 1:
The patent implements preliminary action by pre-configuring challenge message templates and response validation logic before attacks occur. When rate thresholds are violated, the system immediately transmits pre-formatted challenge messages without requiring real-time message construction, thereby maintaining strong DoS mitigation through challenge-response verification while minimizing additional latency through template-based rapid response generation.
Data Source
AI summary
Systems and methods for providing an integrated or Smart NIC-based hardware accelerator for a network security device to facilitate identification and mitigation of DoS attacks is provided. According to one embodiment, a processor of a network security device receives an application layer protocol request from a client, directed to a domain hosted by various servers and protected by the network security device. The application layer protocol request is parsed to extract a domain name and a path string. The hardware acceleration sub-system updates rate-based counters based on the application layer protocol request by performing a longest prefix match on the domain name and the path string. When a rate threshold associated with the rate-based counters is exceeded, a challenge message is created and transmitted to the client, having embedded therein the application layer protocol request; otherwise the application layer protocol request is allowed to pass through the network security device.