Method and apparatus for preventing a denial of service (DOS) attack by selectively throttling TCP/IP requests

• US 6,789,203 B1
• Filed: 06/26/2000
• Issued: 09/07/2004
• Est. Priority Date: 06/26/2000
• Status: Active Grant

• Current Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Belissent, Jacques E.
• Primary Examiner(s): Smithers, Matthew
• Assistant Examiner(s): NGUYEN, MINH DIEU T
• Application Number:
  US09/604,552
• Time in Patent Office: 1,534 Days
• Field of Search: 709/223, 709/227, 713/200, 713/201, 370/229
• US Class Current: 726/22
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/193 at the transport layer, e.g. TCP related
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/163 In-band adaptation of TCP data exchange; In-band control procedures

Abstract

According to the present invention, method, apparatus, and computer readable medium for preventing a DoS attack without notifying the DoS attacker are disclosed. In one embodiment, in a client/server environment, a DoS defense module determines a connection request rate for a particular client. The client is blocked if the connection request rate is determined to be above a first pre-determined threshold. If, however, the connection request rate is below the first threshold but above a second threshold, then the client'"'"'s connection request rate is slowed, or throttled, down to a rate consistent with a connection delay interval that'"'"'s is based upon a throttling factor.

Claims

1. In a client/server environment, a method for preventing a denial of service (DoS) attack by a requesting client on a server computer, comprising:

receiving a connection request at a time t_n;

if the time t_n is within throttling interval m,

incrementing an interval m connection request count;

determining if the interval m connection request count is greater than a rejection threshold associated with the requesting client;

if it is determined that the interval m connection request count is greater than the rejection threshold,

rejecting the connection request;

if it is determined that the interval m connection request count is not greater than the rejection threshold,

waiting an interval m wait time; and

accepting the request by the server computer.

2. A method as recited in claim 1, further comprising:

if the time t_n is at a beginning of a throttling interval m+1, where the throttling interval m+1 is subsequent to the throttling interval m,

calculating a throttling interval m+1 wait time based upon,

a slow down threshold associated with the requesting client,

a total number of connection requests for the throttling interval m, and

the interval m wait time;

setting a throttling interval m+1 connection request count to zero;

waiting the throttling interval m+1 wait time; and

accepting the request by the server computer.

3. A method as recited in claim 2, wherein the throttling interval m+1 wait time is related to a difference between a throttling interval m+1 connection request count and the slowdown threshold.

4. A method as recited in claim 3, wherein the connection request is a TCP/IP type connection request.

5. A method as recited in claim 4, wherein the waiting the throttling interval m+1wait time for the connection request is a duration of time between a TCP accepted event and a connection accepted by an application event.

6. A method as recited in claim 1, wherein the requesting client is identified based upon a requesting client IP address uniquely associated with the requesting client.

7. A method as recited in claim 6, wherein the requesting client is one of a plurality of requesting clients, each of which is uniquely identified by an associated requesting client IP address.

8. A method as recited in claim 7, wherein the rejection threshold is one of a plurality of rejection thresholds each being associated with an associated one of the plurality of requesting clients.

9. A method as recited in claim 7, wherein the slowdown threshold is one of a plurality of slowdown thresholds each being associated with an associated one of the plurality of requesting clients.

10. A method as recited in claim 1, wherein the server computer is an electronic messaging system.

11. An apparatus for preventing a denial of service (DoS) attack by a requesting client on a server computer in a client/server environment, comprising:

a connection request receiver unit for receiving a connection request at a time t_n from the requesting client;

an incrementing unit coupled to the connection request receiver unit for incrementing an interval m connection request count when the time t_n is within but not at a beginning of a throttling interval m;

a processor unit coupled to the interval m connection request count buffer arrainged to determine if the interval m connection request count is greater than a rejection threshold associated with the requesting client; and

a request throttler unit coupled to the processor unit arrainged to,

reject the connection request when it is determined that the interval m connection request count is greater than the rejection threshold, and

wait an interval m wait time when it is determined that the interval m connection request count is not greater than the rejection threshold before the request is accepted by the server computer.

12. An apparatus as recited in claim 11 wherein when the time t_n is at a beginning of a throttling interval m+1, where the throttling interval m+1 is subsequent to the throttling interval m then the processor calculates a throttling interval m+1 wait time is based upon, a slow down threshold associated with the requesting client, a total number of connection requests for the throttling interval m, and the interval m wait time, and wherein the processor sets a throttling interval m+1 connection request count to zero, and wherein the request throttler unit waits the throttling interval m+1 wait time before the server computer accepts the request.

13. A method as recited in claim 12, wherein the throttling interval m+1 wait time is related to a difference between a throttling interval m+1 connection request count and the slowdown threshold.

14. A method as recited in claim 13, wherein the connection request is a TCP/IP type connection request.

15. A method as recited in claim 14, wherein the waiting the throttling interval m+1 wait time for the connection request is a duration of time between a TCP accepted event and a connection accepted by an application event.

16. A computer readable media including computer program code for preventing a denial of service (DoS) attack by a requesting client on a server computer, said computer readable media comprising:

computer program code for receiving a connection request at a time t_n;

computer program code for incrementing an interval m connection request count if the time t_n is within a throttling interval m;

computer program code for determining if the interval m connection request count is greater than a rejection threshold associated with the requesting client;

rejecting the connection request if it is determined that the interval m connection request count is greater than the rejection threshold;

computer program code for waiting an interval m wait time if it is determined that the interval m connection request count is not greater than the rejection threshold; and

computer program code for accepting the request by the server computer.

17. A computer readable media including computer program code for preventing a denial of service (DoS) attack by a requesting client on a server computer as recited in claim 16, further comprising:

computer program code for calculating a throttling interval m+1 wait time when the time t_n is at a beginning of a throttling interval m+1, where the throttling interval m+1 is subsequent to the throttling interval m, wherein the calculating is based upon a slow down threshold associated with the request client, a total number of connection requests for the throttling interval m, and the interval m wait time;

computer program code for setting a throttling interval m+1 connection request count to zero;

computer program code for waiting the throttling interval m+1 wait dime; and

computer program code for accepting the request by the server computer.