Distributed denial of service attack protection for internet of things devices

A device comprising:

• an interface unit configured to enable network communications;
• a memory;
• and
• one or more processors coupled to the interface unit and the memory, and configured to:
• receive from an authorization server cryptographic material sufficient to validate and decrypt tokens carried in packets;
• detect a denial of service attack that employs packets containing invalid tokens;
• in response to a detection of the denial of service attack, signal a remediation server for assistance to remediate the denial of service attack, and send to the remediation server the cryptographic material such that, subsequent to detection of the denial of service attack, the remediation server, using the cryptographic material, validates and decrypts tokens carried in packets that are destined for the device and that originate from a device other than the remediation server;
• and
• receive, via the remediation server, packets each containing a valid token.

A device comprising:

• an interface unit configured to enable network communications;
• a memory;
• and
• one or more processors coupled to the interface unit and the memory, and configured to:
• discover a network device;
• receive cryptographic material sufficient to validate and decrypt tokens carried in packets destined for the network device;
• receive a given packet destined for the network device;
• determine whether the given packet contains a valid token, and when the given packet contains a valid token, forward the given packet to the network device, and when the given packet contains an invalid token, drop the given packet such that the given packet does not reach the network device;
• determine that a denial of service attack employing invalid tokens is occurring against the network device and the denial of service attack exceeds remediation capabilities of the device;
• signal a remediation server for assistance to remediate the denial of service attack;
• and
• send to the remediation server the cryptographic material, such that the network device thereafter receives packets each containing a valid token.