Method and apparatus for recognizing and reacting to denial of service attacks on a computerized network

• US 20030065943A1
• Filed: 09/28/2001
• Published: 04/03/2003
• Est. Priority Date: 09/28/2001
• Status: Abandoned Application

• Current Assignee: Christoph Geis, Eberhard Pausch, Thomas Soysal
• Original Assignee: Christoph Geis, Eberhard Pausch, Thomas Soysal
• Inventors: Geis, Christoph, Soysal, Thomas, Pausch, Eberhard
• Application Number:
  US09/966,019
• Publication Number:
  US 20030065943A1
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

The invention refers to a procedure for recognizing and refusing attacks on server systems of network service providers and operators by means of an electronic intermediary device (4) installed on a computer network. This electronic intermediary device operates a computer program as well as a data carrier to realize the advantaged of the present invention. In addition, the present invention applies to any computer system connected to a network such as Internet (6), an intranet, a virtual private network and the like, regardless whether such network contains just one computer or many computers configured as a server computer (2) or as a client computer and also applies to a computer program product containing computer codes for recognizing and refusing attacks on server systems, and provides:

defense against DoS and DDoS attacks (flood attacks)

link level security,

examination of valid IP headers,

examination of the IP packet,

TCP/IP fingerprint protection,

blocking of each UDP network packet,

length restrictions of ICMP packets,

exclusion of specific external IP addresses,

packet-level firewall function, and

protection of reachable services of the target system.

The present invention thus guarantees a high degree of security and protection against DoS and DDoS attacks.

Claims

1. A method for recognizing and refusing DoS and DDoS attacks on server systems of network providers and operators by means of an electronic intermediary device implemented in a computer network, wherein the electronic intermediary device contains a computer program for carrying out defense against the DoS and DDoS attacks, for each one of an IP connection request, performing the following steps:

registering the IP connection request;

checking the validity of the registered IP connection request, and while the registered data packet is being checked for validity;

sending a periodic acknowledgement signal to preserve the network connection, and after receiving confirmation of the validity of the IP connection request;

forwarding a data packet associated with the IP connection request to a target system which was the subject of the IP connection request.