System and method for traffic management control in a data transmission network

• US 6,930,978 B2
• Filed: 06/06/2001
• Issued: 08/16/2005
• Est. Priority Date: 05/17/2000
• Status: Expired due to Term

• Current Assignee: Trend Micro Inc.
• Original Assignee: DeepNines Incorporated
• Inventors: Sharp, Clifford F., Dark, Susan Pittman
• Primary Examiner(s): Chin, Wellington
• Assistant Examiner(s): PHAM, BRENDA H
• Application Number:
  US09/875,319
• Publication Number:
  US 20020131366A1
• Time in Patent Office: 1,532 Days
• Field of Search: 370229-235, 370/252, 370/218, 370/232, 370/255, 370/389, 370/401, 370/402, 370/363, 370/368, 370/371, 370/374, 370/378, 370/379, 370/381, 370/382, 370/383, 370/386, 370/428, 370/429, 709/224, 709/102, 709/105, 709/319, 709/226, 709/229
• US Class Current: 370/229
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/0882 Utilisation of link capacity
• CPC Class Codes: H04L 43/0888 Throughput
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Abstract

A traffic management system sniffs data arriving at any point in a system. The sniffer operates to remember certain parameters pertaining to the data. When the amount of data arriving at the point begins to reach a critical level (usually dependent upon data processing capability associated with that point), the system begins to remove (and share) subsequent arriving data based, in part, upon the remembered parameters of recently received data. Data that is stored is returned to the system when the critical threshold recedes.

Claims

1. A traffic management system for use in conjunction with packet data, said system operative for passing data packets there through, said system comprising:

means for reviewing certain parameters of data which is flowing into said system;

means for remembering for a period of time said reviewed certain parameters in conjunction with each received packet; and

means operative upon attainment of packet flow volume into said system reaching a certain level for temporarily storing certain subsequently received packets in accordance with selective remembered parameters of previously received packets.

2. The traffic management system of claim 1 wherein said certain level is user controlled.

3. The traffic management system of claim 1 wherein said certain level includes a plurality of levels, wherein the attainment of each successive level results in a more stringent application of said remembered certain parameters.

4. The traffic management system of claim 1 wherein said temporary storing means including a cache and a data storage, said data storage used when said cache is full.

5. The traffic management system of claim 1 wherein said remembered parameters include one or more of:

a sender'"'"'s address;

a prior trouble-causing address;

a notice of a potential trouble address;

amount of data transmitted from a particular address in a period of time;

number of packets arriving from a particular address in a period of time;

an address'"'"' domain name;

date of initial encounter with an address;

date of latest encounter with an address.

6. The traffic management system of claim 1 further including means for retrieving said temporarily stored data packets when traffic flow into said system falls below said certain level;

and

means for putting said retrieved data packets through said system.

7. The traffic management system of claim 6 wherein said retrieving means includes means for retrieving packets in an order based upon why said packets had been stored.

8. The traffic management system of claim 1 further comprising means for dynamically displaying information pertaining to temporarily stored ones of said data packets.

9. The traffic management system of claim 8 further comprising means for transmitting said display information to a remote location.

10. The traffic management system of claim 8 wherein displaying means includes means for displaying data selected from the list of;

prioritized packets in PTS, user overrides of prioritized stored packets, threshold limits reduced thereby automatically releasing stored packets.

11. The method of claim 1 wherein said data is flowing into said system from a public network and directed to a particular address on said network.

12. The method of claim 1 wherein said data is flowing into said system from a particular address on a public network, said data destined for an address on said public network.

13. A traffic management system for use in conjunction with packet data, said system operative for passing data packets there through, said system comprising:

means for reviewing certain parameters of data which is flowing into said system;

means for remembering for a period of time said reviewed certain parameters in conjunction with each received packet, wherein said remembered parameters include one or more of;

a sender'"'"'s address;

a prior trouble-causing address;

a notice of a potential trouble address;

amount of data transmitted from a particular address in a period of time;

number of packets arriving from a particular address in a period of time;

an address'"'"' domain name;

date of initial encounter with an address;

date of latest encounter with an address;

means operative upon attainment of packet flow volume into said system reaching a certain level for temporarily storing certain subsequently received packets in accordance with selective remembered parameter of previously received packets; and

wherein said certain level includes a plurality of levels arranged in a sequence, and wherein as the sequence of levels gets closer to an absolute maximum data flow rate more and more of said remembered parameters are included as a basis for said determination to temporarily store a particular packet.

14. The traffic management system of claim 13 further including means for arbitrarily selecting packets for temporary storing when said data flow rate reaches its maximum capacity.

15. A data network monitoring system comprising:

at least one data sniffer;

a temporary storage device;

a processor for performing data throughput measurements on data passing through said system; and

said processor further operative for diverting to said temporary storage device selected data entering said system, said selected data controlled in part by information obtained from said data sniffer and from said throughput measurement means.

16. The data network monitoring system of claim 15 wherein said system further comprises a store of data having undesirable characteristics, and wherein said processor operates to compare said store of undesirable data with data obtained from said data sniffer.

17. The data network monitoring system of claim 15 wherein said processor increases the number of said selected packets so as to maintain system throughput at or below a maximum number, where said maximum number is below the limits of the data transmission media entering said system.

18. The data network monitoring system of claim 15 further comprising means operable upon a determination that the data throughput through said system is below a certain limit for allowing certain ones of said diverted data to pass through said system.

19. The data network monitoring system of claim 15 further comprising a display for displaying in real time certain parameters pertaining to system operation.

20. The data network monitoring system of claim 15 wherein said parameters are selected from the list comprising:

Preset Threshold Limits;

Bandwidth Capacity;

Allowed IP Addresses;

Disallowed IP Addresses; and

Prioritized Packets.

21. The data network of claim 15 wherein said data which is diverted by said processor may originate at a specific site and destined for a public network or may originate at a location connected to the public network and destined for said specific site.

22. The method of controlling a traffic management system, said method comprising the steps of:

reviewing certain parameters of data packets flowing into said system;

remembering for a period of time said reviewed certain parameters in conjunction with each received data packet; and

upon attainment of packet flow volume into said system reaching a certain level, temporarily storing certain subsequently received packets in accordance with selective remembered parameter of previously received packets.

23. The method of claim 22 wherein said certain level is user controlled.

24. The method of claim 22 wherein said certain level includes a plurality of levels, wherein the attainment of each successive level results in a more stringent application of said remembered certain parameters.

25. The method of claim 22 wherein said remembered parameters include one or more of:

a sender'"'"'s address;

a prior trouble causing address;

a notice of a potential trouble address;

amount of data transmitted from a particular address in a period of time;

number of packets arriving from a particular address in a period of time;

an address'"'"' domain name;

date of initial encounter with an address;

date of latest encounter with an address.

26. The method of claim 25 wherein said certain level includes a plurality of levels arranged in a sequence, and wherein as the sequence of levels gets closer to an absolute maximum data flow rate more and more of said remembered parameters are included as a basis for said determination to temporarily store a particular packet.

27. The method of claim 26 further including the step of:

arbitrarily selecting packets for temporary storing when said data flow rate reaches its maximum capacity.

28. The method of claim 22 further including the step of:

retrieving said temporarily stored data packets when traffic flow into said system falls below said certain level.

29. The method of claim 28 further including the step of:

putting said retrieved data packets through said system.

30. The method of claim 22 further comprising the step of:

dynamically displaying information pertaining to temporarily stored ones of said data packets.

31. The method of claim 30 wherein said displaying step includes:

transmitting said display information to a remote location.

32. The method of claim 30 wherein said displaying step includes

displaying data selected from the list of;

prioritized packets in PTS, user overrides of prioritized stored packets, threshold limits reduced thereby automatically releasing stored packets.

33. The method of claim 22 wherein said data packets flowing into said system may come from a public network or may come from a specific system.

34. A data flow control system for preventing an enterprise data processing system from being overloaded with data requests directed to said enterprise system from sources external to said enterprise system, said data flow system comprising:

a gateway for accepting data directed to said enterprise system from any said external source;

a data monitoring circuit for observing selected portions of certain data directed to said gateway, and

a delay path operable when the amount of data currently being handled by said enterprise system reaches a certain threshold for temporarily removing selected data which is directed to said enterprise system away from enterprise system.

35. The system of claim 34 wherein the exact ones of said data which are temporarily removed are selected under control of information provided by said data monitoring circuit.

36. The system of claim 34 wherein said certain threshold has gradations and wherein the amount and types of data that are temporarily removed operate in proportion to said gradations.

37. A method for preventing data from flowing beyond a particular point faster than the handling capability associated with that point;

said method comprising the steps of;

remembering certain parameters of data passing said particular point; and

preventing selected data from passing said particular point when the data handling capability associated with that point reaches a preset limit, said preventing step relying, in part, on said remembered parameters pertaining to data previously passing said particular point.

38. The method of claim 37 wherein said preventing step includes the step of storing said selected data for a period of time.

39. The method of claim 38 further including the step of selectively sending at least portions of said stored data to pass through said particular point.

40. The method of claim 37 wherein said preset limit is selected from the list of:

prior trouble causing addresses;

a notice of potential trouble addresses;

an amount of data transmitted from a particular address in a period of time;

number of data packets arriving in a period of time;

number of data packets arriving in a period of time from a particular sending address;

identified questionable changes in a specific sender address.

41. The method of claim 37 further including the step of sending messages to an external location indicating the steps of data flow through said particular point.