Method for resisting a denial-of-service attack of a private network element

• US 20050235359A1
• Filed: 03/01/2005
• Published: 10/20/2005
• Est. Priority Date: 02/06/1996
• Status: Abandoned Application

• Current Assignee: Christopher D. Coley, Ralph E. Wesinger Jr
• Original Assignee: Christopher D. Coley, Ralph E. Wesinger Jr
• Inventors: Coley, Christopher D., Wesinger, Ralph E. Jr.
• Application Number:
  US11/070,847
• Publication Number:
  US 20050235359A1
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: G06Q 20/027 involving a payment switch or gateway
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

Methods and apparatus for resisting a denial-of-service attack of a private network element are disclosed. In one embodiment, a network device is configured to receive a packet destined for a private network element over an IP-compliant network. A proxy is assigned to examine the packet based on the destination port of the packet. The proxy agent then determines whether the packet is suspect and should be discarded. If the packet is suspect, it is discarded without shutting down said port.

Claims

1. A method for resisting a denial-of-service attack of a private network element comprising:

receiving a packet destined for a private network element over an IP-compliant network;

assigning a proxy agent operable within a firewall to examine said packet based on the destination port of said packet;

determining, by said proxy agent, whether said packet is suspect and should be discarded; and

if said packet is suspect, then discarding said packet without shutting down said port.

2. The method of claim 1, wherein said act of determining whether said packet is suspect further comprises comparing the source address of said packet against a list of addresses.

3. The method of claim 2, further comprising the act of performing additional verification checks on suspect addresses.

4. The method of claim 3, further comprising the act of performing additional verification based on the suspect packet'"'"'s port designation.

5. The method of claim 1, further comprising the act of maintaining a transaction log containing information regarding said incoming packets.

6. A firewall device for resisting a denial-of-service attack of a private network element comprising:

a firewall operatively disposed between a private network element and an IP-compliant network;

the firewall device configured to receive a packet destined for a private network element over an IP-compliant network and assign a proxy agent operable within said firewall to examine said packet based on the destination port of said packet; and

wherein the proxy agent is configured to discard suspect packets without shutting down said port.

7. The firewall device of claim 6, wherein said proxy agent is further configured to determine whether said packet is suspect by comparing the source address of said packet against a list of addresses.

8. The firewall device of claim 7, wherein said proxy agent is further configured to perform additional verification checks on suspect addresses.

9. The firewall device of claim 8, wherein said proxy agent is further configured to perform additional verification based on the suspect packet'"'"'s port designation.

10. The firewall device of claim 6, wherein said firewall device is further configured to maintain a transaction log containing information regarding said incoming access request packets.

11. A firewall apparatus for resisting a denial-of-service attack of a private network element comprising:

means for receiving a packet destined for a private network element over an IP-compliant network;

means for assigning a proxy agent operable within a firewall to examine said packet based on the destination port of said packet;

means for determining whether said packet is suspect and should be discarded; and

means for discarding said packet without shutting down said port if said packet is suspect.

12. The apparatus of claim 11, further comprising means for comparing the source address of said packet against a list of addresses.

13. The apparatus of claim 12, further comprising means for performing additional verification checks on suspect addresses.

14. The apparatus of claim 13, further comprising means for performing additional verification based on the suspect packet'"'"'s port designation.

15. The apparatus of claim 11, further comprising means for maintaining a transaction log containing information regarding said incoming access request packets.

16. A computer-readable device containing a set of computer instructions for performing a method for resisting a denial-of-service attack of a private network element, the method comprising:

receiving a packet destined for a private network element over an IP-compliant network;

assigning a proxy agent operable within a firewall to examine said packet based on the destination port of said packet;

determining, by said proxy agent, whether said packet is suspect and should be discarded; and

if said packet is suspect, then discarding said packet without shutting down said port.

17. The device of claim 16, wherein said act of determining whether said packet is suspect further comprises comparing the source address of said packet against a list of addresses.

18. The device of claim 17, further comprising the act of performing additional verification checks on suspect addresses.

19. The device of claim 18, further comprising the act of performing additional verification based on the suspect packet'"'"'s port designation.

20. The device of claim 16, further comprising the act of maintaining a transaction log containing information regarding said incoming access request packets.