Virtual Server SYN Cookie Validation for Network Load Balance Memory Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network load balance processing systems face high memory consumption issues during denial of service attacks, such as SYN Flood, leading to system crashes and service interruptions due to the need for establishing large numbers of connection records.
Innovation Solution
Implementing a network load balance processing system where the virtual server uses a SYN Cookies function to validate and acknowledge SYN packets without allocating memory for illegitimate connections, and sends a control command to the back-end server to start a connection service, thereby reducing memory allocation and consumption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the virtual server establishes connection records for each SYN packet during denial of service attacks, then the system can process legitimate connections, but memory resources are consumed and the system crashes due to heavy load
Solution Approach 1:
The virtual server pre-allocates a limited number of connection records before attacks occur. When the preallocated records are exhausted during an attack, the system automatically switches to a different processing mode that does not require additional connection records, preventing memory exhaustion while maintaining service for legitimate users.
Solution Approach 2:
The system dynamically switches between different connection processing modes based on the current state of connection records. When connection records are available, the system processes SYN packets normally; when records are exhausted, the system transitions to an alternative mode that bypasses the connection record requirement, adapting to attack conditions in real-time.
2Ease of operation
If the virtual server forwards all SYN packets to back-end servers, then connection establishment is maintained, but the load on the virtual server increases causing system crash
Solution Approach 1:
The invention extracts the connection record management function from the virtual server during attack conditions. By switching to a mode that does not require virtual server connection records, the system removes the burden of maintaining extensive connection state information from the virtual server, significantly reducing its processing load while still enabling connection establishment through alternative mechanisms.
3Measurement precision
If the virtual server processes each TCP handshake individually, then connection accuracy is maintained, but processing time increases during high-volume attacks
Solution Approach 1:
During attack conditions, the system applies partial action by processing only the essential elements of TCP handshakes without maintaining complete connection state information for each packet. The virtual server focuses on critical authentication and routing functions while omitting detailed connection tracking, thereby reducing processing time significantly while still ensuring accurate connection establishment for legitimate users.
Data Source
Figure 1~2
Figure 3~4
Figure 5
AI summary
A system, a method, and a device for network load balance processing are provided. The network load balance processing method includes: establishing, by a virtual server, connection with a client; sending, by the virtual server, a control command to a back-end server and information related to connection to the back-end server, such that the back-end server starts a connection service based on the control command directed to connection; forwarding, by the virtual server, a data request packet from the client, where the back-end server is configured to respond to the data request packet based on the connection service and send response information to the client. Through the present disclosure, the issue of high memory consumption in the network load balance processing is solved, thereby achieving an effect of low memory consumption in the network load balance processing.