Web Switch Transaction Rate Limiting for DoS Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Web switches are vulnerable to denial of service attacks, such as SYN flooding, and individual source IP addresses can monopolize network resources, disrupting service, necessitating a solution to protect web servers from excessive resource usage.
Innovation Solution
Implementing transaction rate limiting to monitor new connections, where clients exceeding a predetermined threshold are temporarily frozen out, preventing resource monopolization and thwarting malicious attacks without alerting the client, applied on a per-interface or per-service basis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If web switches allow all connection requests without rate limiting, then network service availability is maintained for legitimate clients, but the system becomes vulnerable to denial of service attacks and resource monopolization
Solution Approach 1:
The patent implements preliminary rate limiting measures by monitoring and tracking connection rates from each source IP address before the attack fully impacts the system. The web switch proactively identifies excessive connection patterns and applies rate limiting thresholds in advance, preventing resource exhaustion before it occurs. This includes maintaining connection rate statistics and comparing them against predetermined thresholds to freeze out malicious clients before they can monopolize resources.
2Object-affected harmful factors
If transaction rate limiting is implemented to prevent attacks, then protection against denial of service is improved, but legitimate traffic may be incorrectly blocked
Solution Approach 1:
The patent employs dynamic rate limiting where the threshold for freezing out clients is not fixed but adapts based on observed traffic patterns and system conditions. The web switch monitors connection rates over time and adjusts the predetermined threshold dynamically, allowing legitimate traffic variations while maintaining protection against attacks. This dynamic approach ensures that rate limiting parameters evolve with traffic characteristics, reducing false positives against legitimate users.
Solution Approach 2:
The system implements feedback mechanisms by continuously monitoring connection rate statistics from source IP addresses and using this information to adjust rate limiting decisions. The web switch tracks the number of connections from each source IP, compares current rates against historical data and thresholds, and adjusts freezing out decisions based on this feedback loop. This allows the system to learn from traffic patterns and distinguish between legitimate high-volume users and malicious attackers.
3Difficulty of detecting and measuring
If the system monitors and tracks connection rates from each source IP, then ability to detect attacks is improved, but system resource consumption increases
Solution Approach 1:
The patent segments the monitoring and rate limiting functionality into modular components within the web switch architecture. Each source IP address is tracked independently with its own connection rate statistics, allowing selective monitoring and rate limiting applied only where needed. This segmentation enables the system to focus computational resources on suspicious IP addresses rather than uniformly monitoring all traffic, reducing overall resource consumption while maintaining detection capability.
Data Source
AI summary
Transaction rate limiting is provided to monitor new connections. If the number of new connections requested by a particular client exceeds a predetermined threshold value, then the client may be frozen out for a configured period of time. By denying access for the configured period of time, the client is prevented from monopolizing a particular client. Additionally, if the client does have malicious intent, a denial of service attack may be thwarted. The denial of service may be accomplished without alerting the client. This prevents a malicious client from regrouping and attempting an assault via a different mechanism.