System, method and apparatus that employ virtual private networks to resist IP QoS denial of service attacks

• US 9,009,812 B2
• Filed: 06/24/2013
• Issued: 04/14/2015
• Est. Priority Date: 03/20/2001
• Status: Expired due to Fees

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Inventors: McDysan, David E.
• Primary Examiner(s): Hirl, Joseph P.
• Assistant Examiner(s): GYORFI, THOMAS A
• Application Number:
  US13/925,384
• Publication Number:
  US 20130283379A1
• Time in Patent Office: 659 Days
• Field of Search: 726/15, 726/22, 726/23
• US Class Current: 726/15
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

An approach provides a communication network that supports one or more network-based Virtual Private Networks (VPNs) to resist Denial of Service (DoS) attacks. A first boundary router is configured to provide a Virtual Private Network (VPN) that supports quality of service levels, and interfaces an access network via a Customer Premise Equipment (CPE) edge router and a physical access link. A second boundary router is coupled to a public network. The access network connects to the first boundary router, and wherein the first boundary router and the second boundary router are connected by a separate logical connection to prevent denial of service attacks on the physical access link originating from sources outside the VPN.

Claims

1. A system comprising:

a Differentiated Services (Diffserv)-enabled Internet Protocol (IP) Virtual Private Network (VPN) network, including at least a first boundary router;

an IP public network, including at least a second boundary router;

a plurality of Customer Local Area Networks (LANs), the LANs each including one or more hosts that function as a transmitter and/or receiver of packets communicated over one or both of the Diffserv-enabled VPN network and IP public network;

a plurality of access networks, each access network coupled, via a Customer Premise Equipment (CPE) edge router and a physical access link, to a respective LAN;

wherein the access network has a first logical connection to the at least first boundary router in the Diffserv-enabled VPN network and a separate, second logical connection to the at least second boundary router in the IP public network to prevent denial of service attacks on the physical access link originating from sources outside the VPN, the CPE edge router routing only packets with IP address prefixes belonging to the IP VPN via the Diffserv-enabled IP VPN network and routing all other traffic via the IP public network.

2. The system of claim 1, wherein intra-VPN traffic destined for the VPN and extra-VPN traffic destined for the public network are both routed through the at least one first boundary router.

3. The system of claim 1, wherein the at least one first boundary router comprises:

a plurality of physical ports for connection to a plurality of network core routers.

4. The system of claim 3, wherein the VPN comprises a plurality of logical ports coupled to respective access networks.

5. The system of claim 4, wherein the plurality of logical ports are coupled to the respective access networks by a forwarding function for incoming packets.

6. The system of claim 4, wherein the plurality of logical ports are coupled to the respective access networks by a scheduler for outgoing packets.

7. The system of claim 5, wherein the forwarding function forwards packets between the logical ports and the physical ports.

8. A method comprising:

interfacing a virtual private network (VPN) to a respective access network via a Customer Premise Equipment (CPE) edge router and a physical access link;

connecting each of the access networks to at least one first boundary router within the VPN; and

connecting the at least one first boundary router to at least one second boundary router within a public network by a logical connection, the logical connection being separate from the physical access link, such that denial of service attacks on the physical access link originating from sources outside the VPN can be prevented, wherein the CPE edge router routes only packets with IP address prefixes belonging to the VPN via a Diffserv-enabled IP VPN network and routes all other traffic via the public network.

9. The method of claim 8, further comprising:

routing both intra-VPN traffic destined for the VPN and extra-VPN traffic destined for the public network through the at least one first boundary router.

10. The method of claim 8, further comprising:

connecting a plurality of physical ports in the at least one first boundary router to a plurality of network core routers.

11. The method of claim 10, further comprising:

coupling a plurality of logical ports in the VPN to respective access networks.

12. The method of claim 11, further comprising:

coupling the plurality of logical ports to the respective access networks by a forwarding function for incoming packets.

13. The method of claim 11, further comprising:

coupling the plurality of logical ports to the respective access networks by a scheduler for outgoing packets.

14. The method of claim 12, further comprising:

forwarding, by the forwarding function, packets between the logical ports and the physical ports.

15. The method of claim 8, further comprising:

serving each network customer site at the at least one first boundary router by a pair of VPN-enabled logical ports.

16. The method of claim 15, wherein one of the pair of VPN-enabled logical ports corresponds to intra-VPN traffic and the other of the pair of VPN-enabled logical ports corresponds to extra-VPN traffic.

17. The method of claim 11, wherein each of the physical ports of the at least one first boundary router that faces a network core is logically partitioned into a plurality of sub-interfaces.

18. The method of claim 17, further comprising:

implementing the sub-interfaces as logical tunnels.