Method and system for overcoming denial of service attacks

• US 7,020,783 B2
• Filed: 04/16/2001
• Issued: 03/28/2006
• Est. Priority Date: 04/17/2000
• Status: Expired due to Term

• Current Assignee: Sons of Innovation LLC
• Original Assignee: Circadence Corporation
• Inventors: Plumb, Marc, Vange, Mark, Blumberg, Kevin
• Primary Examiner(s): Song, Hosuk
• Application Number:
  US09/835,938
• Publication Number:
  US 20020002686A1
• Time in Patent Office: 1,807 Days
• Field of Search: 713200-201, 709/200, 709217-221, 709223-226, 709228-229
• US Class Current: 726/5
• CPC Class Codes: G06F 2209/5021 Priority
• CPC Class Codes: G06F 9/5027 the resource being a machine, e.g. CPUs, Servers, Terminals
• CPC Class Codes: G06F 9/505 considering the load
• CPC Class Codes: G06F 9/5055 considering software capabilities, i.e. software resources associated or available to the machine
• CPC Class Codes: G06F 9/5088 involving task migration
• CPC Class Codes: H04L 45/14 Routing performance; Theoretical aspects
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/193 at the transport layer, e.g. TCP related
• CPC Class Codes: H04L 47/24 Traffic characterised by specific attributes, e.g. priority or QoS
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/10015 Access to distributed or replicated servers, e.g. using brokers
• CPC Class Codes: H04L 67/1008 based on parameters of servers, e.g. available memory or workload monitoring of computer activity G06F11/30
• CPC Class Codes: H04L 67/101 : based on network conditions
• CPC Class Codes: H04L 67/1021 : based on client or server locations
• CPC Class Codes: H04L 67/1029 : using data related to the state of servers by a load balancer
• CPC Class Codes: H04L 67/1031 : Controlling of the operation of servers by a load balancer, e.g. adding or removing servers that serve requests
• CPC Class Codes: H04L 67/1034 : Reaction to server failures by a load balancer
• CPC Class Codes: H04L 67/142 : Managing session states for stateless protocols; Signalling session states; State transitions; Keeping-state mechanisms
• CPC Class Codes: H04L 67/303 : Terminal profiles
• CPC Class Codes: H04L 67/561 : Adding application-functional data or data for application control, e.g. adding metadata
• CPC Class Codes: H04L 67/563 : Data redirection of data network streams
• CPC Class Codes: H04L 67/564 : Enhancement of application control based on intercepted application data
• CPC Class Codes: H04L 67/565 : Conversion or adaptation of application format or content adding application control or application functional data H04L67/561
• CPC Class Codes: H04L 67/568 : Storing data temporarily at an intermediate stage, e.g. caching
• CPC Class Codes: H04L 67/5681 : Pre-fetching or pre-delivering data based on network characteristics
• CPC Class Codes: H04L 67/5682 : Policies or rules for updating, deleting or replacing the stored data
• CPC Class Codes: H04L 67/61 : taking into account QoS or priority requirements
• CPC Class Codes: H04L 69/16 : Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/329 : in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 : Network security protocols
• CPC Class Codes: H04W 8/04 : Registration at HLR or HSS [Home Subscriber Server]
• CPC Class Codes: Y10S 707/99944 : Object-oriented database structure
• CPC Class Codes: Y10S 707/99945 : Object-oriented database structure processing

Abstract

A system for handling denial of service attacks on behalf of a shared network resource. A request processing component deployed within a network, the request processing component having an interface configured to receive requests on behalf of the shared network resource. A rate control component coupled to the request processing component, the rate control component comprising program and data structures operable to selectively forward received requests to the shared network resource at a rate selected to prevent the shared network resource from crashing or becoming undesirably busy. Preferably, the system includes a denial of service attack detection component coupled to the request processing component and the rate control component and operable to monitor request metrics from the request processing component and provide configuration information to the rate control component.

Claims

1. A security service for a shared network server comprising:

providing a network and a shared network server coupled to the network, the shared network server having a fixed quantity of resources for responding to network requests;

providing a constellation of front-end servers within the network;

using the front-end servers to receive requests destined for the shared network server;

forwarding the received requests from the front-end servers to the shared network server at a governed rate;

coupling a management server to each of the front-end servers;

communicating metrics between the front-end servers and the management server;

using the metrics to detect a denial of service attack targeted at the shared network server;

using the metrics to determine configuration parameters for the front-end servers; and

communicating the configuration parameters from the management server to the front-end servers.

2. The service of claim 1 wherein the governed rate is selected to present requests at a rate that will prevent overwhelming the fixed quantity of resources within the shared network server.

3. The service of claim 1 further comprising dynamically altering the number of front-end servers in the constellation.

4. The service of claim 1 further comprising detecting a denial of service attack targeted at the shared network server;

and

preventing the act of forwarding the received requests in response to detecting the DoS attack.

5. A system for handling denial of service attacks on behalf of a shared network resource, the system comprising:

a request processing component deployed within a network, the request processing component having an interface configured to receive requests on behalf of the shared network server;

a rate control component coupled to the request processing component, the rate control component comprising program and data structures operable to selectively forward received requests to the shared network server at a rate selected to prevent the shared network server from crashing or becoming undesirably busy; and

a DoS attack detection component coupled to the request processing component and the rate control component and operable to monitor request metrics from the request processing component and provide configuration information to the rate control component, wherein the rate control component comprises mechanisms for preferentially forwarding requests not related to the DoS attack in favor of request related to the DoS attack to the shared network resource.

6. The system of claim 5 further comprising:

a plurality of front-end servers deployed throughout a network, wherein the front-end servers are configured to implement the request processing component and the rate control component;

a management server coupled to each of the front-end servers, the management server including mechanisms to send configuration information to the front-end servers, and receive request processing metrics from the request processing component.

7. The system of claim 5 wherein the request processing component is configured to handle a greater volume of requests than the shared network resource.

8. The system of claim 5 further comprising mechanisms within the front-end servers operable to detect a denial of service attack.

9. A system for handling denial of service attacks on behalf of a shared network resource, the system comprising:

a request processing component deployed within a network, the request processing component having an interface configured to receive requests on behalf of the shared network server;

a rate control component coupled to the request processing component, the rate control component comprising program and data structures operable to selectively forward received requests to the shared network server at a rate selected to prevent the shared network server from crashing or becoming undesirably busy;

a plurality of front-end servers deployed throughout a network, wherein the front-end servers are configured to implement the request processing component and the rate control component;

a management server coupled to each of the front-end servers, the management server including mechanisms to send configuration information to the front-end servers, and receive request processing metrics from the request processing component;

a back-end server coupled to receive the forwarded requests from the front-end servers; and

a rate governor within the back-end server for selectively forwarding received requests to the shared network resource at a rate selected to prevent the shared network resource from crashing becoming undesirably busy.

10. A method for mitigating a denial of service attack comprising the acts of:

providing a shared network resource coupled to a public network and receiving requests from the public network;

providing a plurality of front-end servers, each having a unique network address and coupled to the shared network resource;

assigning a plurality of front-end servers to the shared network resource, wherein the aggregate request processing capacity of the assigned front-end servers is greater than the request handling capacity of the shared network resource;

causing requests for the shared network resource to be redirected through one of the front-end servers; and

forwarding the requests from the front-end server to the shared network resource at a rate selected to inhibit a likelihood of a crash or an undesirable level of business;

detecting a condition in which the number of requests is greater than the request capacity of the shared network resource; and

generating a response to the requests from the front-end servers instead of forwarding the requests to the shared network resource,

wherein the act of detecting comprises distinguishing requests associated with a DoS attach from legitimate requests and the step of generating a response comprises generating a response only to requests associated with the DoS attack while forwarding legitimate requests to the shared network resource.

11. The method of claim 10 further comprising:

in event of a denial of service attack comprising a plurality of malicious requests involving the shared network resource, causing at least some of the malicious requests to be delayed in the front-end servers before reaching the shared network resource.

12. The method of claim 11 further comprising:

in event of a denial of service attack comprising a plurality of malicious requests involving the shared network resource, causing at least some of the malicious requests to be ignored in the front-end servers before reaching the shared network resource.

13. The method of claim 10 further comprising:

in event of a denial of service attack comprising a plurality of malicious requests involving the shared network resource, causing at least some of the malicious requests to be ignored by the front-end servers.

14. The method of claim 10 further comprising:

sending request processing metrics from each of the front-end servers to a centralized management server; and

using the centralized management server to analyze the request processing metrics to detect a denial of service attack.

15. The method of claim 10 further comprising:

sending configuration information from the centralized management server to some or all of the front-end servers in response to detecting a DoS attack, the configuration information including an identification of address domains associated with the DoS attack; and

using the configuration information in the front-end server to selectively drop requests from the address domain identified in the configuration information.