Securing An Access Provider

• US 20100217863A1
• Filed: 05/07/2010
• Published: 08/26/2010
• Est. Priority Date: 08/24/2000
• Status: Active Grant

• Current Assignee: AOL Inc. (Apollo Global Management, Inc.), Avago Technologies International Sales Pte Limited (Broadcom, Inc.)
• Original Assignee: AOL Inc. (Apollo Global Management, Inc.), Foundry Networks Incorporated (Broadcom, Inc.)
• Inventors: Jalan, Rajkumar, Wright, Christopher J., Rolon, Terry, Robertson, Jonathan K., Hufford, Patrick, Stehnach, Thomas
• Granted Patent: US 8,108,531 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 45/50 using label swapping, e.g. multi-protocol label switch [MPLS]
• CPC Class Codes: H04L 47/822 Collecting or measuring resource availability data
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

To secure an access provider, communications to/from the access provider are monitored for a partially-completed connection transaction. Detected partially-completed connection transactions are terminated when they remain in existence for a period of time that exceeds a threshold period of time. The monitoring may include detecting partially-completed connection transactions initiated by an access requestor, measuring the period of time that a partially-completed connection transaction remains in existence, comparing the period of time with the threshold period of time, and resetting a communication port located on the access provider.

Claims

1. A method of handling connection transactions, the method comprising:

detecting, at an intermediary device, a partially-completed connection transaction in which a time out condition is reached prior to receipt of an acknowledgement corresponding to a connection transaction request submitted by a requestor device to an access providing host; and

delaying termination of the partially-completed connection transaction to allow the intermediary device to continue monitoring communications from the requestor device to the access providing host as well as other access providing hosts.

2. The method of claim 1, further comprising blocking, at the intermediary device, the connection transaction request.

3. The method of claim 1, wherein the intermediary device is a switch capable of performing load balancing for the access providing host as well as the other access providing hosts.

4. The method of claim 1, wherein delaying termination of the partially-completed connection transaction to allow the intermediary device to continue monitoring communications from the requestor device to the access providing host as well as other access providing hosts comprises monitoring, at the intermediary device, connection transaction requests across multiple access providing hosts.

5. The method of claim 4, wherein monitoring connection transaction requests across multiple access providing hosts comprises measuring, at the intermediary device, timing of connection transaction requests across multiple access providing hosts.

6. The method of claim 1, further comprising terminating the connection transaction request.

7. The method of claim 1, further comprising, in response to detecting the partially-completed connection transaction, adding the requestor device to information identifying requestor devices that previously submitted a partially-completed connection transaction request to enable blocking of future connection transaction requests received from the requestor device.

8. The method of claim 1, further comprising blocking, at the intermediary device, the connection transaction request in response to a determination that a return address included in the connection transaction request differs from an actual return address of the requestor device.

9. A networking device comprising:

a processor; and

a memory encoded with machine readable instructions that, when executed by the processor, operate to cause the processor to perform operations comprising;

detecting a partially-completed connection transaction in which a time out condition is reached prior to receipt of an acknowledgement corresponding to a connection transaction request submitted by a requestor device to an access providing host; and

delaying termination of the partially-completed connection transaction to allow the networking device to continue monitoring communications from the requestor device to the access providing host as well as other access providing hosts.

10. The networking device of claim 9, wherein the operations further comprise blocking the connection transaction request.

11. The networking device of claim 9, wherein the networking device is a switch capable of performing load balancing for the access providing host as well as the other access providing hosts.

12. The networking device of claim 9, wherein delaying termination of the partially-completed connection transaction to allow the networking device to continue monitoring communications from the requestor device to the access providing host as well as other access providing hosts comprises monitoring connection transaction requests across multiple access providing hosts.

13. The networking device of claim 12, wherein monitoring connection transaction requests across multiple access providing hosts comprises measuring timing of connection transaction requests across multiple access providing hosts.

14. The networking device of claim 9, wherein the operations further comprise terminating the connection transaction request.

15. The networking device of claim 9, wherein the operations further comprise, in response to detecting the partially-completed connection transaction, adding the requestor device to information identifying requestor devices that previously submitted a partially-completed connection transaction request to enable blocking of future connection transaction requests received from the requestor device.

16. The networking device of claim 9, wherein the operations further comprise blocking the connection transaction request in response to a determination that a return address included in the connection transaction request differs from an actual return address of the requestor device.

17. A storage medium encoded with instructions that, when executed by a processing device, operate to cause the processing device to perform operations comprising:

detecting, at an intermediary device, a partially-completed connection transaction in which a time out condition is reached prior to receipt of an acknowledgement corresponding to a connection transaction request submitted by a requestor device to an access providing host; and

delaying termination of the partially-completed connection transaction to allow the intermediary device to continue monitoring communications from the requestor device to the access providing host as well as other access providing hosts.

18. The storage medium of claim 17, wherein the intermediary device is a switch capable of performing load balancing for the access providing host as well as the other access providing hosts.

19. The storage medium of claim 17, wherein delaying termination of the partially-completed connection transaction to allow the intermediary device to continue monitoring communications from the requestor device to the access providing host as well as other access providing hosts comprises monitoring, at the intermediary device, connection transaction requests across multiple access providing hosts.

20. The storage medium of claim 19, wherein monitoring connection transaction requests across multiple access providing hosts comprises measuring, at the intermediary device, timing of connection transaction requests across multiple access providing hosts.