Two-Tier Hash for DoS Mitigation in Distributed Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Legacy hash table implementations experience performance degradation as the number of entries in each bucket increases, leading to decreased insertion performance due to uneven distribution of entries across buckets, which is exacerbated in modern data centers with virtual 'composite nodes' and software-defined networks.
Innovation Solution
The implementation of an elastic flow distributor (EFD) using a perfect hash mechanism that rebalances entries across virtual buckets at insertion time, reducing the maximum number of entries in any bucket and maintaining performance by combining smaller virtual buckets with real buckets for hash table lookups and insertions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If a traditional hash table implementation is used, then the structure is simple and easy to implement, but performance degrades as the number of entries in each bucket increases due to uneven distribution
Solution Approach 1:
The patent divides the traditional single hash table into a two-level hierarchical structure: a first-level hash table with fewer buckets that provides coarse-grained distribution, and second-level hash tables with more buckets that provide fine-grained distribution. This segmentation resolves the contradiction by maintaining simple implementation at the first level while achieving balanced distribution and good performance at the second level.
2Stability of the object's composition
If more buckets are added to the hash table, then entry distribution becomes more uniform, but the complexity of the data structure increases
Solution Approach 1:
The patent transitions from a one-dimensional hash table structure to a two-dimensional hierarchical structure. The first level provides coarse distribution with fewer buckets, and the second level provides fine distribution with more buckets. This dimensional change allows achieving uniform entry distribution without proportionally increasing overall structure complexity, as the first level acts as a simplifying intermediary.
3Productivity
If a large number of buckets are used, then insertion performance improves due to better distribution, but memory overhead and computational complexity increase
Solution Approach 1:
The patent segments the buckets into two hierarchical levels: a first level with a smaller number of buckets that reduces memory overhead and provides coarse distribution, and a second level with more buckets that achieves fine-grained distribution and good insertion performance. This segmentation resolves the contradiction by distributing the bucket burden across two levels rather than concentrating all buckets in a single level.
4Ease of manufacture
If traditional hashing is used without rebalancing, then the implementation is straightforward, but performance degrades under attack or uneven load conditions
Solution Approach 1:
The patent incorporates a feedback mechanism where the system monitors hash table performance and detects potential DoS attacks or uneven load conditions. When anomalies are detected, the system dynamically adjusts the distribution strategy or triggers rebalancing operations. This feedback loop maintains implementation simplicity while significantly improving reliability under attack conditions.
Data Source
AI summary
A computing apparatus for providing a node within a distributed network function, including: a hardware platform; a network interface to communicatively couple to at least one other peer node of the distributed network function; a distributor function including logic to operate on the hardware platform, including a hashing module configured to receive an incoming network packet via the network interface and perform on the incoming network packet a first-level hash of a two-level hash, the first level hash being a lightweight hash with respect to a second-level hash, the first level hash to deterministically direct a packet to one of the nodes of the distributed network function as a directed packet; and a denial of service (DoS) mitigation engine to receive notification of a DoS attack, identify a DoS packet via the first-level hash, and prevent the DoS packet from reaching the second-level hash.


