WAN defense mitigation service

• US 20060236394A1
• Filed: 04/13/2005
• Published: 10/19/2006
• Est. Priority Date: 04/13/2005
• Status: Active Grant

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: MCI Incorporated (Verizon Communications Inc.)
• Inventors: Morrow, Christopher, Gill, James
• Granted Patent: US 8,839,427 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

A mitigation service may be used to mitigate a network attack in a network including a group of mitigation devices. Datagrams, intended for a customer that is subject of a network attack, may be received by at least one of the mitigation devices based on an anycast address associated with the mitigation devices. Each of the mitigation devices is addressable via the anycast address. The received datagrams may be processed to remove malicious datagrams and leave legitimate datagrams. The legitimate datagrams may be forwarded to the customer via a tunnel configured between an address associated with the customer and the anycast address associated with the mitigation devices.

Claims

1. A method for mitigating a network attack in a network including a plurality of mitigation devices, comprising:

receiving traffic, intended for a customer device that is subject of a network attack, by at least one of the mitigation devices based on an anycast address associated with the mitigation devices, each of the mitigation devices being addressable via the anycast address;

processing the received traffic to remove malicious traffic and leave legitimate traffic; and

forwarding the legitimate traffic to the customer device.

2. The method of claim 1, further comprising:

redirecting traffic intended for the customer device to the anycast address associated with the mitigation devices.

3. The method of claim 2, wherein redirecting traffic intended for the customer device includes setting a next-hop attribute for a route or address associated with the customer device to the anycast address associated with the mitigation devices.

4. The method of claim 3, wherein setting a next-hop attribute includes changing a next-hop attribute associated with the customer device as part of an ingress policy of a network device.

5. The method of claim 2, wherein redirecting traffic intended for the customer device includes:

load-balancing the traffic to ones of the mitigation devices using anycasting.

6. The method of claim 2, wherein redirecting traffic intended for the customer device includes:

forwarding a portion of the traffic to one of the mitigation devices, and

forwarding another portion of the traffic to another one of the mitigation devices.

7. The method of claim 1, wherein the network further includes a network device;

and

wherein the method further comprises;

receiving, by the network device, traffic intended for the customer device;

identifying, by the network device, one of the mitigation devices associated with the anycast address based on a number of hops that the identified mitigation device is away from the network device; and

forwarding the received traffic to the identified mitigation device.

8. The method of claim 1, further comprising:

configuring a tunnel from the anycast address associated with the mitigation devices and an address associated with the customer device.

9. The method of claim 8, wherein forwarding the legitimate traffic to the customer device includes:

sending the legitimate traffic to the customer device via the tunnel.

10. The method of claim 8, wherein configuring a tunnel comprises:

using a same configuration for the tunnel by any of the mitigation devices to send legitimate traffic to the customer device.

11. The method of claim 8, wherein forwarding the legitimate traffic to the customer device includes:

applying a tunnel encapsulation to the legitimate traffic, and

forwarding the legitimate traffic with the tunnel encapsulation to the customer device via the tunnel.

12. A method for mitigating a network attack in a network including a plurality of mitigation devices, comprising:

receiving traffic, intended for a customer device that is subject of a network attack, by at least one of the mitigation devices;

processing the received traffic to remove malicious traffic and leave legitimate traffic; and

forwarding the legitimate traffic to the customer device via a tunnel.

13. The method of claim 12, further comprising:

configuring the tunnel from an anycast address associated with the mitigation devices and an address associated with the customer device, each of the mitigation devices being addressable via the anycast address.

14. The method of claim 13, wherein configuring the tunnel comprises:

using a same configuration for the tunnel by any of the mitigation devices to send legitimate traffic to the customer device.

15. The method of claim 12, wherein forwarding the legitimate traffic to the customer device includes:

applying a tunnel encapsulation to the legitimate traffic, and

forwarding the legitimate traffic with the tunnel encapsulation to the customer device via the tunnel.

16. The method of claim 12, wherein receiving traffic by at least one of the mitigation devices includes:

receiving the traffic based on an anycast address associated with the mitigation devices, each of the mitigation devices being addressable via the anycast address.

17. The method of claim 16, wherein the network further includes a network device;

and

wherein the method further comprises;

receiving, by the network device, traffic intended for the customer device;

identifying, by the network device, one of the mitigation devices associated with the anycast address based on a number of hops that the identified mitigation device is away from the network device; and

forwarding the received traffic to the identified mitigation device.

18. The method of claim 12, further comprising:

setting a next-hop attribute for a route or address associated with the customer device to an anycast address associated with the mitigation devices, each of the mitigation devices being addressable via the anycast address.

19. The method of claim 12, further comprising:

load-balancing the traffic intended for the customer device to ones of the mitigation devices using anycasting.

20. The method of claim 12, further comprising:

forwarding a portion of the traffic intended for the customer device to one of the mitigation devices, and

forwarding another portion of the traffic intended for the customer device to another one of the mitigation devices.

21. A method for mitigating a network attack in a network including a plurality of mitigation devices, comprising:

receiving datagrams, intended for a customer that is subject of a network attack, by at least one of the mitigation devices based on an anycast address associated with the mitigation devices, each of the mitigation devices being addressable via the anycast address;

removing malicious datagrams from the received datagrams to leave legitimate datagrams; and

forwarding the legitimate datagrams to the customer via a tunnel configured between an address associated with the customer and the anycast address associated with the mitigation devices.

22. A network, comprising:

a plurality of distributed mitigation centers, each of the mitigation centers comprising;

a plurality of mitigation devices, each of the mitigation devices being addressable by a same anycast address,

at least one of the mitigation devices being configured to;

receive traffic, intended for a customer that is subject of a network attack, based on the anycast address,

process the traffic to remove malicious traffic and leave legitimate traffic, and

forward the legitimate traffic to the customer via a tunnel.

23. The network of claim 22, wherein the tunnel is configured from the anycast address associated with the mitigation devices and an address associated with the customer.

24. The network of claim 22, wherein the tunnel is used by any of the mitigation devices to send legitimate traffic to the customer.

25. The network of claim 22, wherein when forwarding the legitimate traffic to the customer, the at least one of the mitigation devices is configured to:

apply a tunnel encapsulation to the legitimate traffic, and

forward the legitimate traffic with the tunnel encapsulation to the customer via the tunnel.

26. The network of claim 22, further comprising a network device configured to:

receive traffic intended for the customer,

identify one of the mitigation devices associated with the anycast address based on a number of hops that the identified mitigation device is away from the network device, and

forward the received traffic to the identified mitigation device.

27. The network of claim 22, further comprising a network device configured to:

receive notification of the network attack,

set a next-hop attribute associated with the customer to the anycast address associated with the mitigation devices, and

output the next-hop attribute on the network.