Scalable DDoS protection of SSL-encrypted services

• US 10,116,692 B2
• Filed: 09/04/2015
• Issued: 10/30/2018
• Est. Priority Date: 09/04/2015
• Status: Active Grant

• Current Assignee: Arbor Networks Incorporated (NetScout Systems Incorporated)
• Original Assignee: Arbor Networks Incorporated (NetScout Systems Incorporated)
• Inventors: Huston, III, Lawrence B., Iekel-Johnson, Scott
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): Murphy, J. Brant
• Application Number:
  US14/846,403
• Publication Number:
  US 20170070531A1
• Time in Patent Office: 1,152 Days
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

A system for mitigating network attacks within encrypted network traffic is provided. The system includes a protected network including a plurality of devices. The system further includes attack mitigation devices communicatively coupled to the protected network and to a cloud platform. The attack mitigation devices are configured and operable to decrypt the encrypted traffic received from the cloud platform and destined to the protected network to form a plurality of decrypted network packets and analyze the plurality of decrypted network to detect attacks. The attack mitigation devices are further configured to generate, in response to detecting the attacks, attack signatures corresponding to the detected attacks and configured to send the generated attack signatures to attack mitigation services provided in the cloud platform. The attack mitigation services are configured and operable to drop encrypted network traffic matching the attack signatures received from the attack mitigation devices.

Claims

1. A system for mitigating network attacks within encrypted network traffic, the system comprising:

a cloud based Distributed Denial of Service (DDoS) mitigation service having a plurality of attack management devices;

one or more attack mitigation devices communicatively coupled to a protected network and to the cloud based DDoS mitigation service, wherein the one or more attack mitigation devices are configured and operable to decrypt the encrypted network traffic received from the DDoS mitigation service and destined to the protected network to form a plurality of decrypted network packets, analyze the plurality of decrypted network packets to detect one or more attacks by determining which decrypted network packets are associated with network attacks, generate, in response to detecting the one or more attacks, one or more attack signatures corresponding to the one or more detected attacks and send the generated one or more attack signatures to the one or more attack management devices utilizing cloud-signaling network protocols to push the attack signatures to the plurality of cloud based attack management devices wherein the one or more attack mitigation devices are further configured and operable to re-encrypt only decrypted network packets not associated with the one or more detected network attacks and to send the re-encrypted packets to the protected network; and

wherein the one or more attack management devices are configured and operable to block encrypted network traffic matching the one or more attack signatures from reaching the protected network without needing to decrypt incoming encrypted traffic received from one or more external devices.

2. The system as recited in claim 1, further comprising a Client Edge (CE) router device communicatively coupled to the one or more attack mitigation devices, the CE router device configured and operable to route the encrypted network traffic from the one or more attack mitigation devices to the protected network.

3. The system as recited in claim 1, wherein the one or more attack signatures are sent from the one or more attack mitigation devices to the cloud platform using one or more cloud signaling messages.

4. The system as recited in claim 1, wherein the encrypted network traffic comprises a Secure Socket Layer (SSL) traffic and wherein the one or more attack mitigation devices decrypt the SSL traffic using a private key and a certificate stored by the one or more attack mitigation devices.

5. The system as recited in claim 1, wherein the one or more attack mitigation devices are further configured and operable to drop one or more decrypted network packets associated with the one or more detected network attacks.

6. The system as recited in claim 1, wherein the generated one or more signatures comprise attributes that relate to at least one of a network layer and a transport layer.

7. The system as recited in claim 6, wherein the attributes comprise at least one of a source IP address, source port, destination port, protocol and Time To Live (TTL) value.

8. The system as recited in claim 1, wherein the one or more attacks comprise at least distributed denial of service attack.

9. The system as recited in claim 1, wherein the one or more attack mitigation devices reside within the cloud platform.