Stream Steering Rate Limiting for Multi-Tenant DoS Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems are slow to identify and halt Denial of Service (DoS) attacks, which can significantly reduce communication bandwidth in computing environments, affecting multiple tenants.
Innovation Solution
Implementing stream steering hardware with an initial flow rate monitor, meters, and rate limiters to detect and manage data flows exceeding a threshold, preventing overwhelming of network interfaces by rate-limiting excessive data streams.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional DoS attack detection and remediation methods are used, then the system can identify and halt attacks, but the response time is too slow allowing significant bandwidth reduction
Solution Approach 1:
The patent implements preliminary action by pre-configuring rate limiters and flow monitors before attacks occur. The system establishes baseline traffic patterns and pre-sets rate limiting thresholds, enabling immediate enforcement when anomalies are detected without requiring real-time analysis and decision-making during the attack itself.
Solution Approach 2:
The patent introduces an intermediary rate limiting layer between network traffic sources and the computing system. This intermediary component (rate limiter) actively monitors and controls traffic flows, acting as a buffer that can immediately throttle malicious traffic before it overwhelms the system, thus reducing response time while maintaining protection effectiveness.
2Reliability
If rate limiting is applied to all data flows, then DoS attacks are prevented, but legitimate traffic is also restricted reducing system productivity
Solution Approach 1:
The patent applies local quality by implementing differentiated rate limiting policies for different data flows. Instead of uniform rate limiting across all traffic, the system monitors individual flow characteristics and applies rate limits only to specific flows that exceed thresholds, while allowing legitimate flows to pass through at full capacity. This localized approach protects the system from DoS attacks while preserving productivity for legitimate tenants.
Solution Approach 2:
The patent utilizes parameter changes by dynamically adjusting rate limiting thresholds based on traffic flow characteristics. The system monitors parameters such as packet rate, flow duration, and traffic patterns, and adjusts rate limiting parameters accordingly. This allows the system to maintain high productivity for legitimate traffic while effectively blocking DoS attacks that exhibit abnormal parameter patterns.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Apparatuses, systems, and techniques to monitor incoming data flows from a plurality of network sources and identify a data flow from any of the plurality of sources that exceeds a threshold value. In at least one embodiment, the data flow from any of the plurality of sources that exceeds the threshold value are rate-limited while the data flow from any of the plurality of sources that do not exceed the threshold value are passed through without any rate limiting.