Securing an access provider

• US 8,108,531 B2
• Filed: 05/07/2010
• Issued: 01/31/2012
• Est. Priority Date: 08/24/2000
• Status: Expired due to Term

• Current Assignee: AOL Inc. (Apollo Global Management, Inc.), Avago Technologies International Sales Pte Limited (Broadcom, Inc.)
• Original Assignee: AOL Inc. (Apollo Global Management, Inc.), Foundry Networks Incorporated (Broadcom, Inc.)
• Inventors: Wright, Christopher J., Hufford, Patrick, Rolon, Terry, Robertson, Jonathan K., Stehnach, Thomas, Jalan, Rajkumar
• Primary Examiner(s): Shingles, Kristie
• Application Number:
  US12/775,783
• Publication Number:
  US 20100217863A1
• Time in Patent Office: 634 Days
• Field of Search: 709/224, 709/227, 709/217, 709/225, 709/232
• US Class Current: 709/227
• CPC Class Codes: H04L 45/50 using label swapping, e.g. multi-protocol label switch [MPLS]
• CPC Class Codes: H04L 47/822 Collecting or measuring resource availability data
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

To secure an access provider, communications to/from the access provider are monitored for a partially-completed connection transaction. Detected partially-completed connection transactions are terminated when they remain in existence for a period of time that exceeds a threshold period of time. The monitoring may include detecting partially-completed connection transactions initiated by an access requestor, measuring the period of time that a partially-completed connection transaction remains in existence, comparing the period of time with the threshold period of time, and resetting a communication port located on the access provider.

Claims

1. A method of handling connection transactions, the method comprising:

detecting, at an intermediary device, a partially-completed connection transaction in which a time out condition is reached prior to receipt of an acknowledgement corresponding to an access request submitted by a requestor device to an access providing host; and

despite detecting the partially-completed connection transaction in which the time out condition is reached, delaying termination of the partially-completed connection transaction to allow the intermediary device to continue monitoring for additional access requests submitted by the requestor device to the access providing host as well as other access providing hosts while the partially-completed connection transaction remains pending.

2. The method of claim 1, further comprising blocking, at the intermediary device, the access request.

3. The method of claim 1, wherein the intermediary device is a switch capable of performing load balancing for the access providing host as well as the other access providing hosts.

4. The method of claim 1, wherein delaying termination of the partially-completed connection transaction to allow the intermediary device to continue monitoring for additional access requests submitted by the requestor device to the access providing host as well as other access providing hosts comprises monitoring, at the intermediary device, access requests across multiple access providing hosts.

5. The method of claim 4, wherein monitoring access requests across multiple access providing hosts comprises measuring, at the intermediary device, timing of access requests across multiple access providing hosts.

6. The method of claim 1, further comprising terminating the partially-completed connection transaction.

7. The method of claim 1, further comprising, in response to detecting the partially-completed connection transaction, adding the requestor device to information identifying requestor devices that previously submitted a partially-completed connection transaction to enable blocking of future access requests received from the requestor device.

8. The method of claim 1, further comprising blocking, at the intermediary device, the access request in response to a determination that a return address included in the access request differs from an actual return address of the requestor device.

9. A networking device comprising:

a processor; and

a memory encoded with machine readable instructions that, when executed by the processor, operate to cause the processor to perform operations comprising;

detecting a partially-completed connection transaction in which a time out condition is reached prior to receipt of an acknowledgement corresponding to an access request submitted by a requestor device to an access providing host; and

despite detecting the partially-completed connection transaction in which the time out condition is reached, delaying termination of the partially-completed connection transaction to allow the networking device to continue monitoring for additional access requests submitted by the requestor device to the access providing host as well as other access providing hosts while the partially-completed connection transaction remains pending.

10. The networking device of claim 9, wherein the operations further comprise blocking the access request.

11. The networking device of claim 9, wherein the networking device is a switch capable of performing load balancing for the access providing host as well as the other access providing hosts.

12. The networking device of claim 9, wherein delaying termination of the partially-completed connection transaction to allow the networking device to continue monitoring for additional access requests submitted by the requestor device to the access providing host as well as other access providing hosts comprises monitoring access requests across multiple access providing hosts.

13. The networking device of claim 12, wherein monitoring access requests across multiple access providing hosts comprises measuring timing of access requests across multiple access providing hosts.

14. The networking device of claim 9, wherein the operations further comprise terminating the partially-completed connection transaction.

15. The networking device of claim 9, wherein the operations further comprise, in response to detecting the partially-completed connection transaction, adding the requestor device to information identifying requestor devices that previously submitted a partially-completed connection transaction to enable blocking of future access requests received from the requestor device.

16. The networking device of claim 9, wherein the operations further comprise blocking the access request in response to a determination that a return address included in the access request differs from an actual return address of the requestor device.

17. A non-transitory storage medium encoded with instructions that, when executed by a processing device, operate to cause the processing device to perform operations comprising:

detecting, at an intermediary device, a partially-completed connection transaction in which a time out condition is reached prior to receipt of an acknowledgement corresponding to an access request submitted by a requestor device to an access providing host; and

despite detecting the partially-completed connection transaction in which the time out condition is reached, delaying termination of the partially-completed connection transaction to allow the intermediary device to continue monitoring for additional access requests submitted by the requestor device to the access providing host as well as other access providing hosts while the partially-completed connection transaction remains pending.

18. The storage medium of claim 17, wherein the intermediary device is a switch capable of performing load balancing for the access providing host as well as the other access providing hosts.

19. The storage medium of claim 17, wherein delaying termination of the partially-completed connection transaction to allow the intermediary device to continue monitoring for additional access requests submitted by the requestor device to the access providing host as well as other access providing hosts comprises monitoring, at the intermediary device, access requests across multiple access providing hosts.

20. The storage medium of claim 19, wherein monitoring access requests across multiple access providing hosts comprises measuring, at the intermediary device, timing of access requests across multiple access providing hosts.