PROCESS TO THWART DENIAL OF SERVICE ATTACKS ON THE INTERNET

• US 20080016566A1
• Filed: 07/06/2007
• Published: 01/17/2008
• Est. Priority Date: 09/28/2000
• Status: Active Grant

• Current Assignee: Alcatel-Lucent USA, Inc. (Nokia Corporation)
• Original Assignee: Alcatel-Lucent USA, Inc. (Nokia Corporation)
• Inventors: Raz, Danny
• Granted Patent: US 7,627,677 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

Coordinated SYN denial of service (CSDoS) attacks are reduced or eliminated by a process that instructs a layer 4-7 switch to divert a small fraction of SYN packets destined to a server S to a web guard processor. The web guard processor acts as a termination point in the connection with the one or more clients from which the packets originated, and upon the establishment of a first TCP connection with a legitimate client, opens a new TCP connection to the server and transfers the data between these two connections. It also monitors the number of timed-out connections to each client. When a CSDoS attack is in progress, the number of the forged attack packets and hence the number of timed-out connections increases significantly. If this number exceeds a predetermined threshold amount, the web guard processor declares that this server is under attack. It then reprograms the switch to divert all traffic (i.e. SYN packets) destined to this server to the web guard processor, or to delete all SYN packets to the server in question. If the number of timed-out connections increases, it can also inform other web guard processor arrangements, and/or try to find the real originating hosts for the forged packets. In either event, the server is thus shielded from, and does not feel the effects of, the DoS attack. Alternatively, a simpler approach is to arrange layer 4-7 switches to forward SYN packets to respective “null-cache” TCP proxies that each are arranged to operate without an associated cache, and therefore be inexpensive to install and operate. These null-cache TCP proxies, when subject to a CSDoS attack, will not successfully establish a TCP connection with a malicious host, due to the nature of the attack itself. Accordingly, no connections will be made from the null-cache TCP proxies to the server under attack, and the server will be protected.

Claims

1. A method for thwarting coordinated SYN denial of service (CSDoS) attacks against a server S disposed in a network of interconnected elements communicating using the TCP protocol, the attack originating from a malicious host generating SYN packets destined for the server, comprising:

arranging a switch receiving the SYN packets destined to the server to forward the SYN packets to a TCP proxy;

wherein the TCP proxy, when subject to a CSDoS attack, does not successfully establish a TCP connection with the malicious host, and no TCP connection is made from the TCP proxy to the server, thereby protecting the server from the attack.

2. The method of claim 1, wherein the SYN packets destined to the server are forwarded to the TCP proxy using an entry in the switch that is associated with the TCP proxy.

3. The method of claim 1, wherein the TCP proxy sends SYN/ACK response packets to forged addresses.

4. The method of claim 1, further comprising:

generating an alarm indicating that the server is under attack.

5. The method of claim 1, further comprising:

notifying the server that it is under attack.

6. The method of claim 1, further comprising:

notifying other TCP proxies in the network that the server is under attack.

7. The method of claim 1, wherein the TCP proxy is arranged to operate without an associated cache.

8. A method for thwarting coordinated SYN denial of service (CSDOS) attacks against a server S disposed in a network of interconnected elements communicating using the TCP protocol, comprising the steps of

forwarding a statistical sampling of packets from a switch in the network to a processor;

and

if packets in the sampling indicate an attack, altering the operation of the switch to reduce the effects of the attack.

9. The method of claim 8, wherein altering the operation of the switch comprises:

arranging the switch to divert all packets destined to the server to the processor.

10. The method of claim 8, wherein altering the operation of the switch comprises:

discarding the packets destined to the server.

11. The method of claim 8, further comprising:

generating an alarm indicating that the server is under attack.

12. The method of claim 8, further comprising:

notifying the server that it is under attack.

13. The method of claim 8, further comprising:

notifying other processors in the network that the server is under attack.

14. The method of claim 8, wherein the statistical sampling of packets comprises a predetermined fraction of the packets.

15. A system for thwarting coordinated SYN denial of service (CSDOS) attacks against a server, comprising:

a network of interconnected elements communicating using the TCP protocol, wherein the network of interconnected elements comprises a network switch, the server, and a web guard processor;

wherein the network switch is adapted to divert, to the web guard processor, a predetermined fraction of SYN packets destined for the server;

wherein the web guard processor is adapted to establish a first TCP connection with one or more clients originating the packets and to establish a second TCP connection with the server, so that packets can be transmitted between the one or more clients and the server;

wherein the web guard processor is further adapted to monitor the number of timed-out connections between the web guard processor and the one or more clients, and, if the number of timed-out connections between the web guard processor and the one or more clients exceeds a first predetermined threshold, to control the network switch to divert all SYN packets destined to the server to the web guard processor.

16. The system of claim 15, wherein the web guard processor is further adapted to generate an alarm indicating that the server is likely to be under attack.

17. The system of claim 15, wherein the web guard processor is further adapted to determine if the number of timed-out connections between the web guard processor and the clients exceeds a second predetermined threshold, and, if so, to control the network switch to delete all SYN packets destined for the server.

18. The system of claim 15, wherein the web guard processor is further adapted to generate an alarm indicating that the server is under attack.

19. The system of claim 15, wherein the web guard processor is further adapted to notify the server that it is under attack.

20. The system of claim 15, wherein the web guard processor is further adapted to notify other web guard processors in the network that the server is under attack.