PROTECTING AGAINST DENIAL OF SERVICE ATTACKS USING TRUST, QUALITY OF SERVICE, PERSONALIZATION, AND HIDE PORT MESSAGES

• US 20100235632A1
• Filed: 04/09/2010
• Published: 09/16/2010
• Est. Priority Date: 05/12/2006
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Yin, Jian, Iyengar, Arun K., Srivatsa, Mudhakar
• Granted Patent: US 8,250,631 B2
• Time in Patent Office: Days
• US Class Current: 713/166
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 2463/141 Denial of service attacks against endpoints in a network
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

According to an embodiment of the invention, a system for processing a plurality of service requests in a client-server system includes a challenge server for: presenting a cryptographic challenge to the client; initializing a trust cookie that encodes a client'"'"'s initial priority level after the client correctly solves the cryptographic challenge; computing a trust level score for the client based on a service request wherein said trust level score is associated with an amount of resources expended by the server in handling the service request such that a higher trust level score is computed for service requests consuming less system resources; assigning the trust level score to the client based on the computation; and embedding the assigned trust level score in the trust cookie included in all responses sent from the server to the client. The system further includes an application server coupled with a firewall.

Claims

1. An information processing system comprising:

a challenge server operatively coupled with a client system, said challenge server comprising an interface for communicating with said client system, wherein said challenge server is configured for;

presenting a cryptographic challenge to the client system;

initializing a trust cookie that encodes the client system'"'"'s initial priority level after the client system correctly solves the cryptographic challenge;

computing a trust level score for the client system based on a service request, wherein said trust level score is associated with an amount of resources expended by an application server in handling the service request such that a higher trust level score is computed for service requests consuming less system resources;

assigning the trust level score to the client system based on the computation;

embedding the assigned trust level score in the trust cookie included in all responses sent from the application server to the client system; and

the information processing system further comprising;

the application server comprising an interface with the client system requesting a service from said application server;

a firewall coupled with the application server, said firewall configured to;

receive the service request from the client system;

receive the trust cookie from the client system;

serve the client system by presenting the valid trust cookie at a priority level associated with an assigned trust level score;

for the client with a low assigned trust level score, limiting a number of service requests that said client system can issue per unit of time; and

dropping any request from a client system with no trust cookie or an invalid trust cookie.

2. The system of claim 1 wherein the application server updates the trust cookie based upon client requests.

3. The system of claim 1 wherein the challenge server is further configured for modifying the assigned trust level score provided to the client system based on a subsequent request from said client system.

4. The system of claim 1 wherein the trust cookie further comprises a secret cryptographic key.

5. The system of claim 1 wherein the trust cookie further comprises a symmetric key encryption algorithm.

6. The system of claim 1 wherein a lower trust level score is achieved by a service request consuming more system resources.

7. The system of claim 1 wherein the trust cookie comprises a client system IP address, an application server IP address, a time at which the trust cookie was issued, and the trust level score.

8. A computer readable medium comprising program code for causing a computer to perform functions of:

presenting a cryptographic challenge to a client system;

initializing a trust cookie that encodes the client system'"'"'s initial priority level after said client system correctly solves the cryptographic challenge;

computing a trust level score for the client system based on a service request from the client system, wherein said trust level score is associated with an amount of resources expended by an application server in handling said service request such that a higher trust level score is computed for service requests consuming less system resources;

assigning the trust level score to the client system based on the computation; and

embedding the assigned trust level score in the trust cookie included in all responses sent from the application server to the client system.

9. The computer readable medium of claim 8 wherein the program code further causes the computer to modify the assigned trust level score provided to the client system based on a subsequent request from said client system.

10. The computer readable medium of claim 8 wherein the trust cookie comprises a client system IP address, an application server IP address, a time at which the trust cookie was issued, and the trust level score.

11. The computer readable medium of claim 10 wherein the trust cookie further comprises a symmetric key encryption algorithm.

12. The computer readable medium of claim 10 wherein the trust cookie further comprises a secret cryptographic key.

13. A method of preventing denial of service attacks, said method comprising steps of:

using an adaptive challenge server for;

limiting a number of port keys issued to a client system requesting a service from a server within a network;

issuing a cryptographic challenge to the client system;

embedding an authentication message in a destination port number of a packet sent to the client system;

delivering a port key to the client system to be used by said client system to compute an authentication code to access the embedded authentication message, only after the client system has correctly solved the cryptographic challenge;

and

using a server-side firewall for filtering packets sent by the client system by;

preventing unadmitted client systems from accessing the server; and

dropping all packets that do not have a correct destination port number.

14. The method of claim 13 wherein filtering the packets further comprises filtering the packets based on the destination port number.

15. The method of claim 14 further comprising using a fair queuing filter for using probabilistic fair queuing to limit a rate at which the packets are sent by the client system.

16. The method of claim 13 wherein embedding the authentication message comprises embedding a sixteen-bit code.

17. The method of claim 16 wherein the authentication message comprises JavaScripts.

18. The method of claim 13 wherein embedding the authentication message is done responsive to receiving a correction solution to the cryptographic challenge.

19. The method of claim 13 wherein filtering the packets further comprises modifying the destination port number on legitimate incoming packets to an application'"'"'s actual port number by transforming said destination port to an authenticated port using a keyed pseudo-random function of a client address, a server IP address, and a current time.

20. The method of claim 13 further comprising changing at least one port number before embedding the authentication message.