Dynamic session rate limiter

• US 10,397,270 B2
• Filed: 01/04/2017
• Issued: 08/27/2019
• Est. Priority Date: 01/04/2017
• Status: Active Grant

• Current Assignee: A10 Networks Incorporated
• Original Assignee: A10 Networks Incorporated
• Inventors: Wolfe, Kurt
• Primary Examiner(s): Shehni, Ghazal B
• Application Number:
  US15/398,623
• Publication Number:
  US 20180191772A1
• Time in Patent Office: 965 Days
• CPC Class Codes: H04L 2463/142 Denial of service attacks against network infrastructure
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066

Abstract

Provided are methods and systems for dynamically limiting new sessions. A method for dynamically limiting new sessions may commence with initiating a dynamic session rate limiter based on predetermined criteria. The method may further include dynamically ascertaining, by the dynamic session rate limiter, a remaining session table capacity. The method may continue with dynamically limiting, by the dynamic session rate limiter, a number of new sessions according to a function selected to negatively correlate the new sessions and the remaining session table capacity.

Claims

1. A system for dynamically limiting new sessions, the system comprising:

a processor configured to initiate a dynamic session rate limiter based on predetermined criteria;

the dynamic session rate limiter configured to;

dynamically ascertain a remaining session table capacity; and

dynamically limit acceptance of session requests for new sessions according to a function selected to negatively correlate a number of the new sessions and a number of sessions allowed to be established at a current time in accordance with the remaining session table capacity; and

a storage node configured to;

maintain a session table; and

store the remaining session table capacity associated with the session table.

2. The system of claim 1, wherein the function includes an inverse proportionality between the new sessions and a logarithm of the remaining session table capacity.

3. The system of claim 1, wherein the predetermined criteria include determining that the remaining session table capacity for the new sessions is below a first predetermined threshold.

4. The system of claim 1, wherein the new sessions are limited without completing a three-way handshake.

5. The system of claim 1, wherein the new sessions are created as a result of an Internet of Things (IoT) botnet attack.

6. The system of claim 1, wherein the new sessions are created as a result of a Denial of Service (DoS) attack.

7. The system of claim 1, wherein the dynamic session rate limiter is further configured to:

dynamically determine that the remaining session table capacity for the new sessions is below a second predetermined threshold; and

based on the determination, selectively preclude the new sessions until the remaining session table capacity for the new sessions is above the second predetermined threshold.

8. The system of claim 7, wherein the precluding the new sessions includes limiting the number of the new sessions to zero.

9. The system of claim 1, wherein the dynamic session rate limiter is further configured to:

determine that at least one existing session is idle; and

based on the determination, terminate the at least one existing session to increase the remaining session table capacity.

10. The system of claim 9, wherein the session table stores data associated with the at least one existing session.

11. A method for dynamically limiting new sessions, the method comprising:

initiating, by a processor, a dynamic session rate limiter based on predetermined criteria;

dynamically ascertaining, by the dynamic session rate limiter, a remaining session table capacity associated with a session table, the session table being maintained by a storage node, the remaining session table capacity associated with the session table being stored in the storage node; and

dynamically limiting, by the dynamic session rate limiter, acceptance of session requests for new sessions according to a function selected to negatively correlate a number of the new sessions and a number of sessions allowed to be established at a current time in accordance with the remaining session table capacity.

12. The method of claim 11, wherein the function includes an inverse proportionality between the new sessions and a logarithm of the remaining session table capacity.

13. The method of claim 11, wherein the predetermined criteria include determining that the remaining session table capacity for the new sessions is below a first predetermined threshold.

14. The method of claim 11, wherein the new sessions are limited without completing a three-way handshake.

15. The method of claim 11, wherein the new sessions are created as a result of an Internet of Things (IoT) botnet attack.

16. The method of claim 11, wherein the new sessions are created as a result of a Denial of Service (DoS) attack.

17. The method of claim 11, further comprising:

dynamically determining that the remaining session table capacity for the new sessions is below a second predetermined threshold; and

based on the determination, selectively precluding, by the dynamic session rate limiter, the new sessions until the remaining session table capacity for the new sessions is above the second predetermined threshold.

18. The method of claim 17, wherein the precluding, by the dynamic session rate limiter, of the new sessions includes limiting the number of the new sessions to zero.

19. The method of claim 11, further comprising:

determining that at least one existing session is idle; and

based on the determination, terminating the at least one existing session to increase the remaining session table capacity.

20. A system for dynamically limiting new sessions, the system comprising:

a processor configured to initiate a dynamic session rate limiter based on predetermined criteria;

the dynamic session rate limiter configured to;

dynamically ascertain a remaining session table capacity; and

dynamically limit acceptance of session requests for new sessions according to a function selected to negatively correlate a number of the new sessions and a number of sessions allowed to be established at a current time in accordance with the remaining session table capacity;

dynamically determine that the remaining session table capacity for the new sessions is below a second predetermined threshold;

based on the determination, preclude the new sessions until the remaining session table capacity for the new sessions is above the second predetermined threshold;

determine that at least one existing session is idle; and

based on the determination, terminate the at least one existing session to increase the remaining session table capacity; and

a storage node configured to;

maintain a session table; and

store the remaining session table capacity associated with the session table.