Securing an accessible computer system

• US 7,711,790 B1
• Filed: 09/20/2000
• Issued: 05/04/2010
• Est. Priority Date: 08/24/2000
• Status: Expired due to Fees

• Current Assignee: Avago Technologies International Sales Pte Limited (Broadcom, Inc.)
• Original Assignee: AOL Inc. (Apollo Global Management, Inc.), Foundry Networks Incorporated (Broadcom, Inc.)
• Inventors: Barrett, Joseph G., Blake, Victor R., Jalan, Rajkumar, Wright, Christopher J., Stehnach, Thomas
• Primary Examiner(s): Bates; Kevin
• Assistant Examiner(s): Nguyen; Van Kim T.
• Application Number:
  US09/666,140
• Time in Patent Office: 3,513 Days
• Field of Search: 709/225, 709/226, 709/229, 709/223, 709/224, 709/217, 709/218, 709/219, 709/227, 709/228, 713/201
• US Class Current: 709/217
• CPC Class Codes: H04L 45/50 using label swapping, e.g. multi-protocol label switch [MPLS]
• CPC Class Codes: H04L 47/822 Collecting or measuring resource availability data
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

To secure an accessible computer system, the computer system is monitored for connection transactions. An access requestor is denied access to the computer system when the access requestor initiates a number of connection transactions that exceed a configurable threshold number during a first configurable period of time. The monitoring may include detecting connection transactions initiated by the access requestor, counting the number of connection transactions initiated by the access requestor during the first configurable period of time, and comparing the number of connection transactions initiated by the access requester during the first configurable period of time to the configurable threshold number.

Claims

1. A method for securing an accessible computer system, the method comprising:

monitoring for connection transactions between multiple access requesters and an access provider at a switch that is connected to the access provider and that transfers data to and from the access provider;

when the monitoring reveals that one of the multiple access requestors is an attacking access requestor, denying, at the switch, access by the attacking access requestor to the access provider for a time out period during which the attacking access requestor is denied access to the access provider; and

in response to detecting a new connection transaction initiated by the attacking access requestor during the time out period, starting a new time out period and continuing to deny access by the attacking access requestor during the new time out period.

2. The method of claim 1 wherein the monitoring comprises monitoring for connection transactions between multiple access requestors and access providers at a switch that is connected to the access providers and that transfers data to and from the access providers, further comprising:

based on the monitoring, determining, by the switch, whether a cumulative number of connection transactions initiated to more than one of the access providers by the attacking access requestor during a first period of time exceeds a threshold number.

3. The method as in claim 2, wherein the monitoring further includes counting, using the switch, the number of connection transactions initiated by the access requestors to any of the access providers through the switch during the first period of time.

4. The method as in claim 3, wherein the counting further comprises counting, using the switch, a cumulative number of connection transactions for all of the access providers connected to the switch initiated by each of the access requestors during the first period of time.

5. The method as in claim 2, wherein:

the determining further includes comparing, using the switch, the number of connection transactions initiated by the access requestors through the switch during the first period of time to the threshold number.

6. The method as in claim 2, wherein the monitoring further includes counting, using the switch, the cumulative number of connection transactions initiated to any of the access providers by the attacking access requestor during the first period of time such that the cumulative number of connection transactions reflects connection transactions initiated to all of the access providers by the attacking access requestor.

7. The method as in claim 6, wherein the determining further includes comparing, using the switch, the cumulative number of connection transactions initiated by the attacking access requestor during the first period of time to the threshold number, and

denying access by the attacking access requestor to the access providers includes denying, using the switch, access by the attacking access requestor to all of the access providers connected to the switch when the comparison results indicate that the cumulative number of connection transactions initiated by the attacking access requestor during the first period of time exceeds the threshold number.

8. The method as in claim 6, wherein the monitoring includes monitoring a computer system for connection transactions made using TCP.

9. The method of claim 2 wherein denying access by the attacking access requestor to the access providers comprises denying, using the switch, access by the attacking access requestor to all of the access providers connected to the switch irrespective of which of the access providers to which the attacking access requestor initiated connection transactions to exceed the threshold.

10. The method of claim 2 wherein the monitoring includes monitoring, using a switch configured to establish communication links between access requestors and access providers, for attempts, by the attacking access requestor, to establish a communication link with any of the access providers.

11. The method of claim 10 wherein monitoring for attempts, by the attacking access requestor, to establish a communication link with any of the access providers includes monitoring for attempts, by the attacking access requestor, to establish a communication link with any of the access providers, the establishment of a communication link between the attacking access requestor and one of the access providers involving exchange of more than two electronic messages.

12. The method of claim 2 wherein:

the access providers include a first access provider and a second access provider that is different from the first access provider, and

the monitoring takes into account interactions of the attacking access requestor with both the first access provider and second access provider.

13. The method of claim 2 wherein the monitoring includes detecting connection transactions between multiple Internet protocol addresses and the access providers with the switch.

14. The method as in claim 13, wherein the detecting includes identifying the Internet protocol addresses through the use of a header attached to a message representing a connection transaction being detected.

15. The method of claim 2 wherein determining, by the switch, whether the cumulative number of connection transactions initiated to more than one of the access providers by the attacking access requestor during the first period of time exceeds the threshold number comprises determining, by the switch, whether a cumulative number of connection transactions initiated to more than one of the access providers by the attacking access requestor during a first configurable period of time exceeds a configurable threshold number.

16. The method of claim 2 wherein determining, by the switch, whether the cumulative number of connection transactions initiated to more than one of the access providers by the attacking access requestor during the first period of time exceeds the threshold number comprises determining, by the switch, whether a total number of connection transactions initiated to all of the access providers by the attacking access requestor during the first period of time exceeds the threshold number.

17. The method of claim 2 wherein determining, by the switch, whether the cumulative number of connection transactions initiated to more than one of the access providers by the attacking access requestor during the first period of time exceeds the threshold number comprises determining that the cumulative number of connection transactions exceeds the threshold number despite a number of connection transaction initiated to each of the more than one of the access providers individually being less than the threshold number.

18. The method of claim 1 wherein starting the new time out period and continuing to deny access by the attacking access requestor during the new time out period comprises resetting a timer that is measuring the time out period during which the attacking access requestor is denied access to the access provider.

19. The method as in claim 1, wherein the denying of access includes denying access to the access provider through the switch by the attacking access requestor for a second configurable period of time.

20. The method as in claim 1, wherein the denying of access includes denying access to the access provider through the switch by the affacking access requestor for a second configurable period of time after detecting a most recent connection transaction initiated by the attacking access requestor through the switch.

21. The method as in claim 1, wherein the access requestors are clients and the access provider is a host such that the monitoring includes detecting connection transactions through the switch between multiple clients and the host.

22. A system for securing an accessible computer system, comprising:

a switch that is connected to an access provider and that includes at least one hardware component configured to;

monitor for connection transactions between multiple access requestors and the access provider;

when the monitoring reveals that one of the multiple access requestors is an attacking access requestor, deny, at the switch, access by the attacking access requestor to the access provider for a time out period during which the attacking access requestor is denied access to the access provider; and

in response to detecting a new connection transaction initiated by the attacking access requestor during the time out period, start a new time out period and continue to deny access by the attacking access requestor during the new time out period.

23. The system of claim 22 wherein the at least one hardware component is configured to monitor for connection transactions between multiple access requestors and access providers and, based on the monitoring, determine whether a cumulative number of connection transactions initiated to more than one of the access providers by the attacking access requestor during a first period of time exceeds a threshold number.

24. The system of claim 23, wherein the switch comprises:

a detection component that is structured and arranged to detect connection transactions initiated by the access requestors through the switch;

a counting component that is structured and arranged to count the number of connection transactions initiated by the access requestors to any of the access providers through the switch during the first period of time;

a comparing component that is structured and arranged to compare the number of connection transactions initiated by the access requestors through the switch during the first period of time to the threshold number; and

the switch is configured to deny access by the attacking access requestor to all of the access providers when the comparison results indicate that the number of connection transactions initiated by the attacking access requestor during the first period of time exceeds the threshold number.

25. The system of claim 24, wherein the counting component further comprises counting a cumulative number of connection transactions for all of the access providers connected to the switch initiated by each of the access requestors during the first period of time.

26. The system of claim 23, wherein the switch comprises:

a counting component that is structured and arranged to count the cumulative number of connection transactions to any of the access providers initiated through the switch by the attacking access requestor during the first period of time such that the cumulative number of connection transactions reflects connection transactions initiated to all of the access providers by the attacking access requestor;

a comparing component that is structured and affanged to compare the cumulative number of connection transactions initiated through the switch by the attacking access requestor during the first period of time to the threshold number; and

the switch is configured to deny access by the attacking access requestor to all of the access providers when the comparison results indicate that the cumulative number of connection transactions initiated by the attacking access requestor during the first period of time exceeds the threshold number.

27. The system of claim 26, wherein the connection transactions include connections made using TCP.

28. The system of claim 26, further comprising:

an identifying component that is structured and arranged to identify Internet protocol addresses through the use of a header attached to a message representing a connection transaction being detected.

29. The system of claim 22, wherein the switch comprises:

an access preventer that is structured and arranged to deny access to the access provider through the switch by the attacking access requestor for a second configurable period of time.

30. The system of claim 29, wherein the switch further comprises:

a timing component that is structured and arranged to measure the second configurable period of time during which the access preventer denies access to the access provider by the attacking access requestor.

31. The system of claim 22, wherein the switch comprises:

an access preventer that is structured and arranged to deny access to the access provider through the switch by the attacking access requestor for a second configurable period of time after detecting a most recent connection transaction initiated by the access requestor.

32. The system of claim 22, wherein the access requestors are clients and the access provider is a host such that the switch comprises:

a detection component that is structured and arranged to detect connection transactions through the switch between multiple clients and the host.

33. The system of claim 22, wherein a host computer system receives communications from the switch.

34. The system of claim 22, wherein the switch is included in a host computer system.

35. A switch comprising:

a processor; and

a memory encoded with machine readable instructions that, when executed by the processor, operate to cause the processor to perform operations comprising;

transferring data to and from an access provider;

monitoring, at the switch, for connection transactions between multiple access requestors and the access provider;

when the monitoring reveals that one of the multiple access requestors is an attacking access requestor, denying, at the switch, access by the attacking access requestor to the access provider for a time out period during which the attacking access requestor is denied access to the access provider; and

in response to detecting a new connection transaction initiated by the attacking access requestor during the time out period, starting a new time out period and continuing to deny access by the attacking access requestor during the new time out period.

36. The switch of claim 35 wherein the monitoring comprises monitoring for connection transactions between multiple access requestors and access providers and the operations further comprise, based on the monitoring, determining, by the switch, whether a cumulative number of connection transactions initiated to more than one of the access providers by the attacking access requestor during a first period of time exceeds a threshold number.

37. The switch of claim 36, wherein the monitoring further includes counting, using the switch, the cumulative number of connection transactions initiated to any of the access providers by the attacking access requestor during the first period of time such that the cumulative number of connection transactions reflects connection transactions initiated to all of the access providers by the attacking access requestor.

38. The switch of claim 37, wherein the determining further includes comparing, using the switch, the cumulative number of connection transactions initiated by the attacking access requestor during the first period of time to the threshold number, and

denying access by the attacking access requestor to the access providers includes denying, using the switch, access by the attacking access requestor to all of the access providers connected to the switch when the comparison results indicate that the cumulative number of connection transactions initiated by the attacking access requestor during the first period of time exceeds the threshold number.

39. The switch of claim 36 wherein the monitoring includes detecting connection transactions between multiple Internet protocol addresses and the access providers with the switch.

40. The switch of claim 36 wherein determining, by the switch, whether the cumulative number of connection transactions initiated to more than one of the access providers by the attacking access requestor during the first period of time exceeds the threshold number comprises determining, by the switch, whether a cumulative number of connection transactions initiated to more than one of the access providers by the attacking access requestor during a first configurable period of time exceeds a configurable threshold number.

41. The switch of claim 36 wherein determining, by the switch, whether the cumulative number of connection transactions initiated to more than one of the access providers by the attacking access requestor during the first period of time exceeds the threshold number comprises determining, by the switch, whether a total number of connection transactions initiated to all of the access providers by the attacking access requestor during the first period of time exceeds the threshold number.

42. The switch of claim 36 wherein determining, by the switch, whether the cumulative number of connection transactions initiated to more than one of the access providers by the attacking access requestor during the first period of time exceeds the threshold number comprises determining that the cumulative number of connection transactions exceeds the threshold number despite a number of connection transaction initiated to each of the more than one of the access providers individually being less than the threshold number.

43. The switch of claim 35, wherein the denying of access includes denying access to the access provider through the switch by the attacking access requestor for a second configurable period of time.