System for controlling client-server connection requests

• US 20040250127A1
• Filed: 06/03/2003
• Published: 12/09/2004
• Est. Priority Date: 06/03/2003
• Status: Active Grant

• Current Assignee: HTC Corporation
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Scoredos, Eric C., Lin, David Hsing, Talgery, Hrishikesh
• Granted Patent: US 7,404,205 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 63/0254 Stateful filtering

Abstract

A method for controlling connections from an IP entity to a server. Initially, a limit count, representing a number of concurrently allowable connections between the IP entity and the server, is determined. When an incoming IP packet is received, the packet is processed to determine the source and destination IP addresses for the packet. An entry is then created in a limit table for the IP entity, if no entry for that IP entity exists in the table. A determination is made as to whether a pending connection should be allowed for the packet, by referring to the limit count and the entry in the limit table. The connection is allowed, and the limit count for the entry is incremented, if the attempted connection would not exceed the limit count for the IP entity; otherwise, the packet is blocked if the attempted connection would exceed the limit count for the IP entity.

Claims

1. A method for controlling connections from an IP entity, having a source IP address, to a server comprising the steps of:

configuring a limit count representing a number of concurrently allowable connections between the IP entity and the server;

receiving an incoming IP packet;

processing the packet to determine said source IP address and a destination IP address for the packet;

creating an entry in a limit table for the IP entity, if no entry for that IP entity exists in the table;

determining, by reference to the limit count and the entry in the limit table, whether a pending connection should be allowed for the packet;

allowing the connection, and incrementing the limit count for the entry if the attempted connection would not exceed the limit count for the IP entity; and

blocking the packet if the attempted connection would exceed the limit count for the IP entity.

2. The method of claim 1, wherein the IP entity is a client.

3. The method of claim 1, wherein the IP entity is a subnet.

4. The method of claim 1, wherein the incoming packet is a TCP/IP packet.

5. The method of claim 1, wherein the pending connection is determined by the destination IP address for the packet.

6. The method of claim 1, wherein the pending connection is determined by the destination TCP port for the packet.

7. The method of claim 1, wherein the packet is blocked by issuing a reset for the packet.

8. The method of claim 1, wherein the determining step further comprises:

entering, into a rule table, a set of rules specifying a range of source and destination addresses and destination ports, and a maximum number of said concurrently allowable connections between a particular source IP address and a destination server IP address;

determining which one of the rules in the rule table the incoming packet matches; and

applying, to the incoming packet, the one of the rules that matches the incoming packet.

9. The method of claim 8, wherein the set of rules includes a default rule that identifies all other clients not identified by any other said rules in the set of rules;

and

wherein the default rule subjects said other clients to a pre-configured limit count.

10. The method of claim 1, wherein the limit count is stored in the rule by individual IP address;

11. The method of claim 1, wherein the limit count is stored in the rule by IP subnet range;

wherein each IP entity address has an individual limit configured to the subnet; and

wherein all addresses in the subnet range share a cumulative limit.

12. The method of claim 1, wherein each pending packet that exceeds the limit count is considered to be an over-limit connection, for which indicia of the pending packet is stored in a logging record in a logging file when there are no more active connections associated with the IP entity;

generating a summary logging record indicating a total of the number of connection attempts, by said IP entity, that exceed said limit count;

writing each said summary logging record to a summary logging file; and

collating the summary logging records in the summary logging file.

13. The method of claim 12, wherein said indicia are stored in the logging record when an entry in the limit table is deallocated.

14. The method of claim 12, wherein the summary logging record indicates when the first attempt was made to establish said over-limit connection.

15. The method of claim 12, wherein:

a frequency count is configured to determine the frequency with which an alarm logging record is generated; and

wherein the alarm logging record is generated on the first over-limit connection attempt and on every number of said over-limit connection attempts corresponding to the frequency count.

16. A method for filtering packets sent from e-mail clients to an SMTP server comprising the step of:

limiting the number of concurrently active connections between a particular one of the clients and a TCP port for a specific said SMTP server, by restricting the number of concurrent connections from specific ones of the clients to a pre-configured limit count.

17. The method of claim 16, wherein the limit count is determined by reference to a rule table containing rules indicating a maximum number of concurrently allowable connections between certain said clients and the server.

18. The method of claim 17, wherein one of the rules configures the limit count for a specific subnet, and a connection request is rejected if the connection requested would cause the limit count for the subnet to be exceeded.

19. A method for controlling connections from an IP entity to a server comprising the steps of:

configuring a rule table including a set of rules indicating a maximum number of concurrently allowable connections between the IP entity and the server;

receiving an incoming IP packet;

processing the packet to determine the source and destination IP addresses for the packet;

creating an entry in a limit table for the IP entity, if no entry for that IP entity exists in the limit table;

determining whether an incoming packet matches one of the rules in the rule table;

determining, by reference to the rule table and the entry in the limit table, whether a pending connection should be allowed for the packet;

allowing the connection, and incrementing the limit count for the entry if the attempted connection would not exceed the limit count for the IP entity;

blocking the packet if the attempted connection would exceed the maximum number of concurrently allowable connections for the IP entity;

wherein the set of rules includes a default rule that identifies all other clients not identified by any other said rules in the set of rules; and

wherein the default rule subjects said other clients to a pre-configured limit count.

20. The method of claim 19, wherein indicia of each said packet that exceeds the maximum number of concurrently allowable connections is stored in a logging record in a logging file when there are no more active connections associated with the IP entity;

generating a summary logging record indicating a total of the number of connection attempts by said IP entity that exceed said maximum number of concurrently allowable connections;

writing each said summary logging record to a summary logging file; and

collating the summary logging records in the summary logging file.

21. The method of claim 20, wherein the summary logging record indicates when the first said attempted connection was made that exceeded the maximum number of concurrently allowable connections.

22. The method of claim 20, wherein:

a frequency count is configured to determine a frequency with which an alarm logging record is generated for said attempted connections that exceed the maximum number of concurrently allowable connections; and

wherein the alarm logging record is generated on every number of connection attempts that exceed the maximum number of concurrently allowable connections, on a basis corresponding to the frequency count.

23. A system for controlling connections from clients to a server comprising:

a processor and associated memory;

a rule table, stored in said memory, including rules specifying a range of source and destination addresses and destination ports, and a maximum number of concurrently allowable said connections between a particular client source IP address and a destination server IP address;

a limit table, stored in said memory, for storing a number of present connections established between each of the clients and the server; and

a filter, executed on the processor, including a connection limit checking function that uses said rules to determine the maximum number of concurrently allowable said connections for each one of said clients having a pending connection request;

wherein the pending connection request is blocked if the total number of said present connections would exceed the maximum number for the source IP address, if the pending connection request were allowed; and

wherein client IP addresses not having a corresponding rule in the rule table are assigned a default;

individual limit for the maximum number of concurrently allowable connections.

24. The system of claim 23, wherein the maximum number of concurrently allowable said connections can be set to a cumulative count for all said clients that match the rules.

25. The system of claim 23, including a logging file containing a logging record for each packet;

wherein indicia of each said packet that exceeds the maximum number is stored in the logging record when there are no more active connections associated with the client that sent the packet; and

generating a summary logging record indicating a total of the number of connection attempts by said IP entity that exceed said limit count.

26. The system of claim 25, wherein each said summary logging record is automatically written to a summary logging file.

27. The method of claim 25, wherein the maximum number of concurrently allowable said connections is stored in one of the rules by individual IP address;

28. The method of claim 25, wherein the maximum number of concurrently allowable said connections is stored, by IP subnet range, in one of the rules;

wherein each IP entity address has an individual limit associated with the subnet; and

wherein all addresses in the subnet range share a cumulative limit.

29. A system for controlling connections from an IP entity, having an IP address, to a server comprising the steps of:

a rule table containing a set of rules indicating a number of concurrently allowable connections between the IP entity and the server;

means for receiving an incoming IP packet;

means for processing the packet to determine the source and destination IP addresses for the packet;

means for creating an entry in a limit table for the IP entity, if no entry for that IP entity exists in the limit table;

means for determining whether an incoming packet matches one of the rules in the rule table;

means for determining, by reference to the rule table and the entry in the limit table, whether a pending connection should be allowed for the packet;

means for allowing the connection and incrementing the limit count for the entry if the attempted connection would not exceed the limit count for the IP entity;

means for blocking the packet if the attempted connection would exceed the limit count for the IP entity;

wherein the set of rules includes a default rule that identifies all other clients not identified by any other said rules in the set of rules; and

wherein the default rule subjects said other clients to a pre-configured limit count.

30. A software product comprising instructions, stored on computer-readable media, wherein the instructions, when executed by a computer, perform steps for controlling connections from an IP entity to a server, comprising:

configuring a rule table indicating a number of concurrently allowable connections between the IP entity and the server;

receiving an incoming IP packet;

processing the packet to determine the source and destination IP addresses for the packet;

creating an entry in a limit table for the IP entity, if no entry for that IP entity exists in the limit table;

determining whether an incoming packet matches one of the rules in the rule table;

determining, by reference to the rule table and the entry in the limit table, whether a pending connection should be allowed for the packet;

allowing the connection, and incrementing the limit count for the entry if the attempted connection would not exceed the limit count for the IP entity;

blocking the packet if the attempted connection would exceed the limit count for the IP entity;

wherein the set of rules includes a default rule that identifies all other clients not identified by any other said rules in the set of rules; and

wherein the default rule subjects said other clients to a pre-configured limit count.