Method for protecting a firewall load balancer from a denial of service attack

• US 7,131,140 B1
• Filed: 02/19/2001
• Issued: 10/31/2006
• Est. Priority Date: 12/29/2000
• Status: Expired due to Fees

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Albert, Mark, O'Rourke, Chris, Gray, Richard, Tsang, Tzu-Ming, Batz, Robert M, Menditto, Louis F, Shah, Gaurang K, Sutton, Michael S, Hull, Sean W, Tiwari, Pranav K
• Primary Examiner(s): Vu, Kim
• Assistant Examiner(s): TRUONG, THANHNGA B
• Application Number:
  US09/788,690
• Time in Patent Office: 2,080 Days
• Field of Search: 713/200, 713/201, 713/154, 709/227, 709/240, 709/239, 709/242, 709/243, 709223-225, 709/226, 707/1, 707/5, 726/3, 726 11- 13
• US Class Current: 726/11
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/1036 Load balancing of requests to servers for services different from user content provisioning, e.g. load balancing across domain name servers

Abstract

A method for protecting firewall load balancers from a denial of service attack is provided. Packets are received by the firewall load balancer. Each packet has a source and a destination. The firewall load balancer is equipped with a connection database that can contain entries about the packets. Upon receipt of a packet, the connection database is queried to determine whether or not there is an entry for the received packet. If an entry is found in the database, the packet is forwarded to its destination. Otherwise, if the packet was received from a firewall, then a new connection entry for the packet is built and is saved to the connection database and the packet is forwarded on to its destination. If the packet does not have an entry (match) in the connection database and the packet was not received from a firewall, then the packet is forwarded to a firewall.

Claims

1. A method comprising:

receiving a packet at an outbound firewall load balancer;

determining whether the packet is associated with an open connection such that resources are being consumed as reflected by an entry in an outbound connection database, wherein if the entry is not present in the outbound connection database then a new entry is not recorded for the outbound firewall load balancer; and

forwarding the packet to a selected one of a plurality of firewalls coupled to the outbound firewall load balancer in the case where the entry is present in the outbound connection database, wherein the packet may be received by the selected firewall and then communicated to an inbound firewall load balancer, wherein the inbound firewall load balancer is operable to generate a new entry for the packet once it has received it from the selected firewall, the new entry being provided in an inbound connection database such that resources for the inbound firewall load balancer are then being consumed for an open flow associated with the packet.

2. The method of claim 1, wherein the selected firewall is operable to determine if the packet is associated with malicious traffic and to discard the packet such that it is not communicated to the inbound firewall load balancer in a case where the packet is associated with malicious traffic.

3. The method of claim 1, wherein the outbound firewall load balancer is coupled to one or more servers that are operable to deliver content to the outbound firewall load balancer.

4. The method of claim 1, wherein the inbound firewall load balancer is operable to deliver the packet to a computer that is operable to respond to the packet and that is associated with the open connection.

5. The method of claim 1, wherein if the packet is not associated with an open connection, the outbound firewall load balancer is operable to select one of the firewalls to direct the packet to based on a hash algorithm.

6. The method of claim 1, wherein the inbound firewall load balancer is operable to receive an additional packet from one or more computers that are coupled to the inbound firewall load balancer, the inbound firewall load balancer being coupled to an inbound connection database.

7. The method of claim 6, wherein the inbound firewall load balancer is operable to access the inbound connection database in order to see if there is an open connection associated with the additional packet, and wherein if there is not an open connection for the additional packet then a new entry in the inbound connection database is not made.

8. A method comprising:

receiving a packet at an inbound firewall load balancer, the packet being generated by a client computer;

determining whether the packet is associated with an open connection such that resources are being consumed as reflected by an entry in an inbound connection database, wherein if the entry is not present in the inbound connection database then a new entry is not recorded for the inbound firewall load balancer; and

forwarding the packet to a selected one of a plurality of firewalls coupled to the inbound firewall load balancer in the case where the entry is present in the inbound connection database, wherein the packet may be received by the selected firewall and then communicated to an outbound firewall load balancer, wherein the outbound firewall load balancer is operable to generate a new entry for the packet once it has received it from the selected firewall, the new entry being provided in an outbound connection database such that resources for the outbound firewall load balancer are then being consumed for an open flow associated with the packet.

9. The method of claim 8, wherein the selected firewall is operable to determine if the packet is associated with malicious traffic and to discard the packet such that it is not communicated to the outbound firewall load balancer in a case where the packet is associated with malicious traffic.

10. The method of claim 8, wherein the outbound firewall load balancer is coupled to one or more servers that are operable to deliver content to the outbound firewall load balancer.

11. The method of claim 8, wherein if the packet is not associated with an open connection, the inbound firewall load balancer is operable to select one of the firewalls to direct the packet to based on a hash algorithm.

12. The method of claim 8, wherein the outbound firewall load balancer is operable to receive an additional packet from one or more servers that are coupled to the outbound firewall load balancer, the outbound firewall load balancer being operable to access an outbound connection database in order to see if there is an open connection associated with the additional packet, and wherein if there is not an open connection for the additional packet then a new entry in the outbound connection database is not made.