US 10,097,579 B2 · Event driven route control

Abstract

Embodiments provide system and methods for a DDoS service using a mix of mitigation systems (also called scrubbing centers) and non-mitigation systems. The non-mitigation systems are less expensive and thus can be placed at or near a customer's network resource (e.g., a computer, cluster of computers, or entire network). Under normal conditions, traffic for a customer's resource can go through a mitigation system or a non-mitigation system. When an attack is detected, traffic that would have otherwise gone through a non-mitigation system is re-routed to a mitigation system. Thus, the non-mitigation systems can be used to reduce latency and provide more efficient access to the customer's network resource during normal conditions. Since the non-mitigation servers are not equipped to respond to an attack, the non-mitigation systems are not used during an attack, thereby still providing protection to the customer network resource using the mitigation systems.

Drawings

Drawings are temporarily unavailable. Open the PDF at USPTO

Drawings

Claims9

Dependent claims

A method comprising:

providing a mitigation network comprising one or more mitigation systems:
by the mitigation network:
detecting an attack event targeting a customer network resource;
determining a routing scheme that routes network traffic to one or more mitigation systems of the mitigation network;
and
communicating the routing scheme to one or more routing devices;
by the one or more mitigation systems:
receiving the network traffic;
and
initiating scrubbing of the network traffic according to one or more mitigation rules,
wherein communicating the routing scheme to one or more routing devices comprises:
communicating one or more routing updates using a routing protocol, wherein the routing scheme is a Domain Name Service (DNS) entry and the one or more routing devices comprises a DNS resolver, wherein the one or more routing updates comprises a DNS zone transfer, and
wherein communicating one or more routing updates comprises:
causing a DNS resolver to update from a non-mitigation DNS zone associated with a non-mitigation system of the mitigation network to a mitigation DNS zone associated with the mitigation system.

11 more elements

Dependencies are inferred from the claim text.

Description5,299 words

Summary563 words

#In a distributed network like the Internet, different computers and computer networks may be virtually connected and accessible via various routes. When a computer or computer network is under attack, e.g., a distributed denial of service (DDoS) attack, responses to the attack must be made in order to maintain the network's accessibility to other networks and computers. The solution of typical systems is to always route malicious traffic through scrubbing centers that are designed to respond to an attack. As the scrubbing centers always receive the traffic, they can respond to an attack.

#But such a solution has some undesirable properties. The scrubbing centers are very expensive. Thus, there is a lack of scrubbing centers throughout a network, due to the high cost. Having to route all traffic through too few of scrubbing centers would typically require routing through remote locations, introducing latency due to traversing data over long distances.

#Embodiments of the invention address these and other problems, individually and collectively.

Brief description of the drawings6 figures

#FIG. 1 shows the state transition between mitigation and non-mitigation for the EDRC system according to embodiments of the present invention.

#FIG. 2 shows the state “Normal Traffic Pass-through” according to embodiments of the present invention.

#FIG. 3 shows the state “Mitigation in Progress” according to embodiments of the present invention.

Detailed description4,630 words

#I. Networks, Routing, and BGP

#The Internet is a collection of connected autonomous systems, the systems under the control of one or more network operators. On the Internet, an autonomous system is a collection of connected IP routing prefixes that presents a common, clearly defined routing policy to the Internet. In a distributed network like the Internet, different computers and computer networks may be virtually connected and accessible via various routes.

#The way that the systems are connected to each other comprises the routing of the Internet. The Border Gateway Protocol (BGP) is a standardized exterior gateway protocol designed to exchange routing and reachability information between the autonomous systems on the Internet, allowing the creation of a loop-free routing topology among autonomous systems. BGP can also be used for routing within an autonomous system. Once peer machines have been configured to exchange routing information, they will form a TCP connection and can begin communicating in BGP.

Facts

Application

15/707,772Filed 18 Sep 2017 · continuation

Priority

12 Sep 2014

Published

US 2018/0007086 A14 Jan 2018

Granted

9 Oct 2018

Term ends

12 Sep 2035

Estimated · how

20 years from earliest known nonprovisional domestic filing plus recorded patent term adjustment. Maintenance-fee lapses, terminal disclaimers and statutory extensions have not been checked. The continuity chain may be incomplete; this is not an enforceability determination.

Classification3 codes

H04L 63/1458
Countermeasures against malicious traffic: denial of Service
H04L 63/20
Network architectures or network communication protocols for network security: for managing network security; network security policies in general
H04L
Digital communication

Family

Application62/050,000Us provisional application · filed 12 Sep 2014

Application14/852,518Parent of this continuation · filed 12 Sep 2015

US 2018/0007086 A1Pre-grant publication · published 4 Jan 2018

US 9,769,202 B2Parent of this continuation

US 2016/0080412 A1Published application

US 10,097,579 B2This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

12 Sep 2014Priority claimedParent application 62/050,000
18 Sep 2017Application filedUS 15/707,772
19 Sep 2017Assigned to Level 3 Communications, LLCassignment of assignor's interest
19 Sep 2017Assigned to Level 3 Communications, LLCassignment of assignor's interest
4 Jan 2018PublishedUS 2018/0007086 A1
9 Oct 2018GrantedUS 10,097,579 B2
4 Nov 2024Assigned to Wilmington Trust, National Association, AS Collateral Agentnotice of grant of security interest in intellectual property (second lien)
4 Nov 2024Assigned to Wilmington Trust, National Association, AS Collateral Agentnotice of grant of security interest in intellectual property (first lien)
12 Jun 2026Assigned to U.S. Bank Trust Company, National Association, AS Successor Collateral Agentassignment of first lien security interest in patent collateral recorded at r/f 069295/0858
12 Oct 2026TodayWithin its term
12 Sep 2035Term endsEstimated

Event driven route control

Life of this patent

Event driven route control

Life of this patent

Life of this patent

Abstract

Drawings

Drawings

Claims9

Description5,299 words

Drawings

Classification3 codes

Life of this patent

Description5,299 words