SYSTEMS AND METHODS FOR MITIGATING AND/OR PREVENTING DISTRIBUTED DENIAL-OF-SERVICE ATTACKS

• US 20180013786A1
• Filed: 07/17/2017
• Published: 01/11/2018
• Est. Priority Date: 05/05/2016
• Status: Active Grant

• Current Assignee: Neustar Incorporated
• Original Assignee: Neustar Incorporated
• Inventors: Knopf, Brian R.
• Granted Patent: US 11,277,439 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 2463/141 Denial of service attacks against endpoints in a network
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Systems and methods are described that mitigates and/or prevents distributed denial-of-service (DDOS) attacks. In one implementation, a gateway include one or more processors configured to obtain network data from one or more entities associated with the gateway, provide the network data to a server, and obtain a set of entity identifiers from the server. The set of entity identifiers may be generated based on at least the network data. The one or more processors may be further configured to filter communications based on the set of entity identifiers.

Claims

1. A gateway for mitigating and/or preventing distributed denial-of-service (DDOS) attack, the gateway comprising:

one or more processors configured to;

obtain network data from one or more entities associated with the gateway;

provide the network data to a server;

obtain a set of entity identifiers from the server, wherein the set of entity identifiers is generated based on at least the network data; and

filter communications based on the set of entity identifiers.

2. The gateway of claim 1, wherein the one or more processors are further configured to:

obtain a server signature from the server, wherein the server signature is generated based on at least a first portion of the set of entity identifiers; and

verify the server signature prior to the filtering of the communications based on the set of entity identifiers.

3. The gateway of claim 1, wherein the one or more processors are further configured to:

obtain a server signature from the server, wherein the server signature is generated based on at least a first portion of the set of entity identifiers;

provide the server signature to a second server;

obtain a second server signature from the second server, wherein the second server signature is generated based on at least a second portion of the set of entity identifiers and provided to the gateway after the second server verifies the server signature; and

verify the second server signature prior to the filtering of the communications based on the set of entity identifiers.

4. The gateway of claim 1, wherein the one or more processors are further configured to provide a gateway signature to the server, wherein the gateway signature is generated based on at least a first portion of the network data, and wherein the set of entity identifiers is generated after the server verifies the gateway signature.

5. The gateway of claim 1, wherein:

the one or more processors are further configured to provide a gateway signature to the server,

the gateway signature is generated based on at least a first portion of the network data,

the server provides the gateway signature to a second server,

the second server verifies the gateway signature,

the second server obtains a second server signature,

the second server provides the second server signature to the server, and

the set of entity identifiers is generated after the server verifies the second server signature.

6. The gateway of claim 1, wherein the set of entity identifiers includes one or more identifiers associated with entities that are determined by the server as being targets or potential targets of a DDOS attack, and wherein the filtering of the communications include rejecting communications destined for the entities that are determined by the server as being targets or potential targets of the DDOS attack.

7. The gateway of claim 1, wherein the set of entity identifiers includes one or more identifiers associated with entities that are determined by the server as being trusted entities, and wherein the filtering of the communications include rejecting communications that are destined for entities other than the entities that are determined by the server as being trusted entities.

8-10. -10. (canceled)

11. A method for mitigating and/or preventing distributed denial-of-service (DDOS) attacks, the method comprising:

obtaining network data from one or more entities associated with a gateway;

providing the network data to a server;

obtaining a set of entity identifiers from the server, wherein the set of entity identifiers is generated based on at least the network data; and

filtering communications based on the set of entity identifiers.

12. The method of claim 11, further comprising:

obtain a server signature from the server, wherein the server signature is generated based on at least a first portion of the set of entity identifiers; and

verify the server signature prior to the filtering of the communications based on the set of entity identifiers.

13. The method of claim 11, further comprising:

obtain a server signature from the server, wherein the server signature is generated based on at least a first portion of the set of entity identifiers;

provide the server signature to a second server;

obtain a second server signature from the second server, wherein the second server signature is generated based on at least a second portion of the set of entity identifiers and provided to the gateway after the second server verifies the server signature; and

verify the second server signature prior to the filtering of the communications based on the set of entity identifiers.

14. The method of claim 11, further comprising:

providing a gateway signature to the server, wherein the gateway signature is generated based on at least a first portion of the network data, and wherein the set of entity identifiers is generated after the server verifies the gateway signature.

15. The method of claim 11, further comprising providing a gateway signature to the server, and wherein:

the gateway signature is generated based on at least a first portion of the network data,

the server provides the gateway signature to a second server,

the second server verifies the gateway signature,

the second server obtains a second server signature,

the second server provides the second server signature to the server, and

the set of entity identifiers is generated after the server verifies the second server signature.

16. The method of claim 11, wherein the set of entity identifiers includes one or more identifiers associated with entities that are determined by the server as being targets or potential targets of a DDOS attack, and wherein the filtering of the communications include rejecting communications destined for the entities that are determined by the server as being targets or potential targets of the DDOS attack.

17. The method of claim 11, wherein the set of entity identifiers includes one or more identifiers associated with entities that are determined by the server as being trusted entities, and wherein the filtering of the communications include rejecting communications that are destined for entities other than the entities that are determined by the server as being trusted entities.

18-20. -20. (canceled)

21. A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for mitigating and/or preventing distributed denial-of-service (DDOS) attacks, the method comprising:

obtaining network data from one or more entities associated with a gateway;

providing the network data to a server;

obtaining a set of entity identifiers from the server, wherein the set of entity identifiers is generated based on at least the network data; and

filtering communications based on the set of entity identifiers.

22. The method of claim 21, further comprising:

obtain a server signature from the server, wherein the server signature is generated based on at least a first portion of the set of entity identifiers; and

verify the server signature prior to the filtering of the communications based on the set of entity identifiers.

23. The method of claim 21, further comprising:

obtain a server signature from the server, wherein the server signature is generated based on at least a first portion of the set of entity identifiers;

provide the server signature to a second server;

obtain a second server signature from the second server, wherein the second server signature is generated based on at least a second portion of the set of entity identifiers and provided to the gateway after the second server verifies the server signature; and

verify the second server signature prior to the filtering of the communications based on the set of entity identifiers.

24. The method of claim 21, further comprising:

providing a gateway signature to the server, wherein the gateway signature is generated based on at least a first portion of the network data, and wherein the set of entity identifiers is generated after the server verifies the gateway signature.

25. The method of claim 21, further comprising providing a gateway signature to the server, and wherein:

the gateway signature is generated based on at least a first portion of the network data,

the server provides the gateway signature to a second server,

the second server verifies the gateway signature,

the second server obtains a second server signature,

the second server provides the second server signature to the server, and

the set of entity identifiers is generated after the server verifies the second server signature.

26. The method of claim 21, wherein the set of entity identifiers includes one or more identifiers associated with entities that are determined by the server as being targets or potential targets of a DDOS attack, and wherein the filtering of the communications include rejecting communications destined for the entities that are determined by the server as being targets or potential targets of the DDOS attack.

27-30. -30. (canceled)