System and method for providing data storage redundancy for a protected network

• US 9,628,510 B2
• Filed: 05/12/2015
• Issued: 04/18/2017
• Est. Priority Date: 05/12/2015
• Status: Active Grant

• Current Assignee: Arbor Networks Incorporated (NetScout Systems Incorporated)
• Original Assignee: Arbor Networks Incorporated (NetScout Systems Incorporated)
• Inventors: O'Hara, Sean
• Primary Examiner(s): ZAIDI, SYED A
• Application Number:
  US14/710,270
• Publication Number:
  US 20160337396A1
• Time in Patent Office: 707 Days
• Field of Search: 726 23
• CPC Class Codes: G06F 11/00 Error detection; Error correction; Monitoring error detection, correction or monitoring in information storage based on relative movement between record carrier and transducer G11B20/18; monitoring, i.e. supervising the progress of recording or reproducing G11B27/36; in static stores G11C29/00
• CPC Class Codes: G06F 11/2035 without idle spare hardware
• CPC Class Codes: G06F 11/2048 where the redundant components share neither address space nor persistent storage
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

A system and method for providing redundancy with remote scrubbing center devices. The system includes an edge detection device and a plurality of scrubbing center devices in a telecommunications network for providing redundant scrubbing center functionality for the edge detection device. The edge detection device maintains a network connection with more than one of the plurality of scrubbing center devices whereby each of the more than one of the plurality of scrubbing center devices sends and receives a synchronization signal with each of the one or more edge detection devices as if it was the only remote scrubbing center device coupled to the edge detection device.

Claims

1. A system for providing redundancy with remote scrubbing center devices, comprising:

one or more edge detection devices provided in a protected network;

a plurality of scrubbing center devices provided in a telecommunications network for providing redundant scrubbing center functionality for one or more edge detection devices in the protected network; and

a data traffic monitoring device for monitoring data traffic from the telecommunications network to the one or more client devices in the protected network, wherein the data traffic monitoring device is configured and operable to maintain a network connection with more than one of the plurality of scrubbing center devices such that data associated with at least one of the client devices is transmitted to each of the more than one of the plurality of scrubbing center devices whereby each of the more than one of the plurality of scrubbing center devices sends and receives a synchronization signal with each of the one or more edge detection devices.

2. The system as recited in claim 1, wherein each synchronization signal is a heartbeat protocol signal configured to negotiate and monitor the availability of a resource between a coupled server device and client device.

3. The system as recited in claim 2, wherein the data traffic monitoring device is further configured and operable to parse each heartbeat protocol signal so as to discard a duplicate message sent from each of the more than one of the plurality of server devices to scrubbing center.

4. The system as recited in claim 2, wherein the data traffic monitoring device is further configured and operable to detect malicious data sent from the telecommunications network to the one or more client devices in the protected network.

5. The system as recited in claim 4, wherein the data traffic monitoring device is configured and operable to detect a denial of service attack.

6. The system as recited in claim 4, wherein the data traffic monitoring device is further configured and operable to initiate one or more countermeasures against the detected malicious data.

7. The system as recited in claim 1, wherein the protected network is provided with a client edge (CE) router device.

8. The system as recited in claim 7, wherein the CE router device is coupled intermediate the data traffic monitoring device and the protected network.

9. The system as recited in claim 1, wherein the protected network is provided with a firewall device that controls network traffic in the protected network based upon a prescribed rule set.

10. An apparatus for providing redundancy of external server functionality with one or more edge detection devices provided with a plurality of scrubbing center devices provided in a telecommunications network, the apparatus comprising logic integrated with and/or executable by a processor, the logic being adapted to:

monitor data traffic from the telecommunications network to the one or more client devices in the protected network;

maintain a network connection with more than one of the plurality of scrubbing center devices such that data associated with at least one of the edge detection devices is distributed with each of the more than one of the plurality of scrubbing center devices; and

enable each of the more than one of the plurality of scrubbing center devices to send and receive a synchronization signal with each of the one or more edge detection devices.

11. The apparatus as recited in claim 10, wherein each synchronization signal is a heartbeat protocol signal configured to monitor the availability of a resource between a coupled scrubbing center device and edge detection device.

12. The apparatus recited in claim 11, wherein the logic is further adapted to parse each heartbeat protocol signal so as to discard a duplicate message sent from each of the more than one of the plurality of scrubbing center devices to a edge detection device.

13. The apparatus as recited in claim 11, wherein the logic is further adapted to detect malicious data sent from the telecommunications network to the one or more client devices in the protected network.

14. The apparatus as recited in claim 13, wherein the logic is further adapted to detect a denial of service attack.

15. The apparatus as recited in claim 13, wherein the logic is further adapted to initiate one or more countermeasures against the detected malicious data.

16. An apparatus for providing redundancy of scrubbing center functionality with one or more edge detection devices in a protected network with a plurality of external scrubbing center devices provided in a telecommunications network, the apparatus comprising logic integrated with and/or executable by a processor, the logic being adapted to:

monitor data traffic from the telecommunications network to the one or more client devices in the protected network;

maintain a network connection with more than one of the plurality of external scrubbing center devices such that data associated with at least one of the edge detection devices is transmitted to each of the more than one of the plurality of scrubbing center devices;

enable each of the more than one of the plurality of scrubbing center devices to send and receive a synchronization signal with each of the one or more edge detection devices; and

detect a denial of service attack against the one or more client devices in the protected network.

17. The apparatus as recited in claim 16, wherein each synchronization signal is a heartbeat protocol signal configured to negotiate and monitor the availability of a resource between a coupled scrubbing center device and edge detection device.

18. The apparatus recited in claim 17, wherein the logic is further adapted to parse each heartbeat protocol signal so as to discard a duplicate message sent from each of the more than one of the plurality of server devices to a client device.

19. The apparatus as recited in claim 16, wherein the protected network is provided with a client edge (CE) router device.