Two-Tier Hash for DoS Mitigation in Distributed Networks

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Legacy hash table implementations experience performance degradation as the number of entries in each bucket increases, leading to decreased insertion performance due to uneven distribution of entries across buckets, which is exacerbated in modern data centers with virtual 'composite nodes' and software-defined networks.

Innovation Solution

The implementation of an elastic flow distributor (EFD) using a perfect hash mechanism that rebalances entries across virtual buckets at insertion time, reducing the maximum number of entries in any bucket and maintaining performance by combining smaller virtual buckets with real buckets for hash table lookups and insertions.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of manufacture

If a traditional hash table implementation is used, then the structure is simple and easy to implement, but performance degrades as the number of entries in each bucket increases due to uneven distribution

Engineering Contradiction:
Improveease of implementationVSAvoidinsertion performance
Core Design Contradiction:
Ease of manufactureVSProductivity

Solution Approach 1:

The patent divides the traditional single hash table into a two-level hierarchical structure: a first-level hash table with fewer buckets that provides coarse-grained distribution, and second-level hash tables with more buckets that provide fine-grained distribution. This segmentation resolves the contradiction by maintaining simple implementation at the first level while achieving balanced distribution and good performance at the second level.

Inventive Principle:
Principle #1Segmentation

2Stability of the object's composition

If more buckets are added to the hash table, then entry distribution becomes more uniform, but the complexity of the data structure increases

Engineering Contradiction:
Improveentry distribution uniformityVSAvoiddata structure complexity
Core Design Contradiction:
Stability of the object's compositionVSDevice complexity

Solution Approach 1:

The patent transitions from a one-dimensional hash table structure to a two-dimensional hierarchical structure. The first level provides coarse distribution with fewer buckets, and the second level provides fine distribution with more buckets. This dimensional change allows achieving uniform entry distribution without proportionally increasing overall structure complexity, as the first level acts as a simplifying intermediary.

Inventive Principle:
Principle #17Another dimension (Dimensionality change)

3Productivity

If a large number of buckets are used, then insertion performance improves due to better distribution, but memory overhead and computational complexity increase

Engineering Contradiction:
Improveinsertion performanceVSAvoidmemory overhead
Core Design Contradiction:
ProductivityVSQuantity of substance

Solution Approach 1:

The patent segments the buckets into two hierarchical levels: a first level with a smaller number of buckets that reduces memory overhead and provides coarse distribution, and a second level with more buckets that achieves fine-grained distribution and good insertion performance. This segmentation resolves the contradiction by distributing the bucket burden across two levels rather than concentrating all buckets in a single level.

Inventive Principle:
Principle #1Segmentation

4Ease of manufacture

If traditional hashing is used without rebalancing, then the implementation is straightforward, but performance degrades under attack or uneven load conditions

Engineering Contradiction:
Improveimplementation simplicityVSAvoidperformance under attack
Core Design Contradiction:
Ease of manufactureVSReliability

Solution Approach 1:

The patent incorporates a feedback mechanism where the system monitors hash table performance and detects potential DoS attacks or uneven load conditions. When anomalies are detected, the system dynamically adjusts the distribution strategy or triggers rebalancing operations. This feedback loop maintains implementation simplicity while significantly improving reliability under attack conditions.

Inventive Principle:
Principle #23Feedback

Data Source

PatentUS11005884B2Denial of service mitigation with two-tier hash
Publication Date: 2021.05.11 INTEL CORP
  • US11005884B2 patent drawing
  • US11005884B2 patent drawing
  • US11005884B2 patent drawing

AI summary

A computing apparatus for providing a node within a distributed network function, including: a hardware platform; a network interface to communicatively couple to at least one other peer node of the distributed network function; a distributor function including logic to operate on the hardware platform, including a hashing module configured to receive an incoming network packet via the network interface and perform on the incoming network packet a first-level hash of a two-level hash, the first level hash being a lightweight hash with respect to a second-level hash, the first level hash to deterministically direct a packet to one of the nodes of the distributed network function as a directed packet; and a denial of service (DoS) mitigation engine to receive notification of a DoS attack, identify a DoS packet via the first-level hash, and prevent the DoS packet from reaching the second-level hash.