Method for protecting a firewall load balancer from a denial of service attack

• US 7,770,215 B2
• Filed: 10/30/2006
• Issued: 08/03/2010
• Est. Priority Date: 12/29/2000
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Sutton, Michael S., Tiwari, Pranav K., Gray, Richard, Hull, Sean W., Shah, Gaurang K., Albert, Mark, O'Rourke, Chris, Menditto, Louis F., Batz, Robert M., Tsang, Tzu-Ming
• Primary Examiner(s): Truong; Thanhnga B
• Application Number:
  US11/554,081
• Publication Number:
  US 20080028456A1
• Time in Patent Office: 1,373 Days
• Field of Search: 726 11- 13, 726/3, 709223-225
• US Class Current: 726/11
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/1036 Load balancing of requests to servers for services different from user content provisioning, e.g. load balancing across domain name servers

Abstract

A method for protecting firewall load balancers from a denial of service attack is provided. Packets are received by the firewall load balancer. Each packet has a source and a destination. The firewall load balancer is equipped with a connection database that can contain entries about the packets. Upon receipt of a packet, the connection database is queried to determine whether or not there is an entry for the received packet. If an entry is found in the database, the packet is forwarded to its destination. Otherwise, if the packet was received from a firewall, then a new connection entry for the packet is built and is saved to the connection database and the packet is forwarded on to its destination. If the packet does not have an entry (match) in the connection database and the packet was not received from a firewall, then the packet is forwarded to a firewall.

Claims

1. An apparatus, comprising:

an outbound firewall load balancer that is operable to receive a packet and to determine whether the packet is associated with an open connection such that resources are being consumed as reflected by an entry in an outbound connection database, wherein if the entry is not present in the outbound connection database then a new entry is not recorded for the outbound firewall load balancer, and wherein the packet is forwarded to a selected one of a plurality of firewalls coupled to the outbound firewall load balancer in the case where the entry is present in the outbound connection database, the packet being received by the selected firewall and then communicated to an inbound firewall load balancer, the inbound firewall load balancer being further operable to generate a new entry for the packet once it has received it from the selected firewall, the new entry being provided in an inbound connection database such that resources for the inbound firewall load balancer are then being consumed for an open flow associated with the packet.

2. The apparatus of claim 1, wherein the selected firewall is operable to determine if the packet is associated with malicious traffic and to discard the packet such that it is not communicated to the inbound firewall load balancer in a case where the packet is associated with malicious traffic.

3. The apparatus of claim 1, wherein the outbound firewall load balancer is coupled to one or more servers that are operable to deliver content to the outbound firewall load balancer.

4. The apparatus of claim 1, wherein the inbound firewall load balancer is operable to deliver the packet to a computer that is operable to respond to the packet and that is associated with the open connection.

5. The apparatus of claim 1, wherein if the packet is not associated with an open connection, the outbound firewall load balancer is operable to select one of the firewalls to direct the packet to based on a hash algorithm.

6. The apparatus of claim 1, wherein the inbound firewall load balancer is operable to receive an additional packet from one or more computers that are coupled to the inbound firewall load balancer, the inbound firewall load balancer being coupled to an inbound connection database.

7. The apparatus of claim 6, wherein the inbound firewall load balancer is operable to access the inbound connection database in order to see if there is an open connection associated with the additional packet, and wherein if there is not an open connection for the additional packet then a new entry in the inbound connection database is not made.

8. A method for enlisting one or more end users in a network environment in which loadbalancing occurs, comprising:

enlisting one or more end users in a billing plan associated with network communications;

generating a bill associated with one or more of the end users, the bill being based on the billing plan; and

facilitating network communications for one or more of the end users in response to the end users being enlisted in the billing plan, whereby the network communications includes a protocol that comprises;

receiving a packet at an outbound firewall load balancer;

determining whether the packet is associated with an open connection such that resources are being consumed as reflected by an entry in an outbound connection database, wherein if the entry is not present in the outbound connection database then a new entry is not recorded for the outbound firewall load balancer; and

forwarding the packet to a selected one of a plurality of firewalls coupled to the outbound firewall load balancer in the case where the entry is present in the outbound connection database, wherein the packet may be received by the selected firewall and then communicated to an inbound firewall load balancer, wherein the inbound firewall load balancer is operable to generate a new entry for the packet once it has received it from the selected firewall, the new entry being provided in an inbound connection database such that resources for the inbound firewall load balancer are then being consumed for an open flow associated with the packet.

9. The method of claim 8, wherein the selected firewall is operable to determine if the packet is associated with malicious traffic and to discard the packet such that it is not communicated to the inbound firewall load balancer in a case where the packet is associated with malicious traffic.

10. The method of claim 8, wherein the outbound firewall load balancer is coupled to one or more servers that are operable to deliver content to the outbound firewall load balancer.

11. The method of claim 8, wherein the inbound firewall load balancer is operable to deliver the packet to a computer that is operable to respond to the packet and that is associated with the open connection.

12. The method of claim 8, wherein if the packet is not associated with an open connection, the outbound firewall load balancer is operable to select one of the firewalls to direct the packet to based on a hash algorithm.

13. The method of claim 8, wherein the inbound firewall load balancer is operable to receive an additional packet from one or more computers that are coupled to the inbound firewall load balancer, the inbound firewall load balancer being coupled to an inbound connection database.

14. The method of claim 13, wherein the inbound firewall load balancer is operable to access the inbound connection database in order to see if there is an open connection associated with the additional packet, and wherein if there is not an open connection for the additional packet then a new entry in the inbound connection database is not made.

15. A computer readable medium storing software comprising computer code that is executed by a processor in order to:

receive a packet at an outbound firewall load balancer;

determine whether the packet is associated with an open connection such that resources are being consumed as reflected by an entry in an outbound connection database, wherein if the entry is not present in the outbound connection database then a new entry is not recorded for the outbound firewall load balancer; and

forward the packet to a selected one of a plurality of firewalls coupled to the outbound firewall load balancer in the case where the entry is present in the outbound connection database, wherein the packet may be received by the selected firewall and then communicated to an inbound firewall load balancer, wherein the inbound firewall load balancer is operable to generate a new entry for the packet once it has received it from the selected firewall, the new entry being provided in an inbound connection database such that resources for the inbound firewall load balancer are then being consumed for an open flow associated with the packet.

16. The medium of claim 15, wherein the code operates to determine if the packet is associated with malicious traffic and to discard the packet such that it is not communicated to the inbound firewall load balancer in a case where the packet is associated with malicious traffic.

17. The medium of claim 15, wherein the outbound firewall load balancer is coupled to one or more servers that operate to deliver content to the outbound firewall load balancer.

18. The medium of claim 15, wherein the code operates to deliver the packet to a computer that operates to respond to the packet and that is associated with the open connection.

19. The medium of claim 15, wherein if the packet is not associated with an open connection, the code operates to select one of the firewalls to direct the packet to based on a hash algorithm.

20. The medium of claim 15, wherein the code operates to receive an additional packet from one or more computers that are coupled to the inbound firewall load balancer, the inbound firewall load balancer being coupled to an inbound connection database.

21. The medium of claim 20, wherein the code operates to access the inbound connection database in order to see if there is an open connection associated with the additional packet, and wherein if there is not an open connection for the additional packet then a new entry in the inbound connection database is not made.