Back to results
US 10,567,426 B2Granted
Methods and apparatus for detecting and/or dealing with denial of service attacks
AssigneeRibbon Communications Operating Company, Inc.
InventorsShiping Li, Toru Mike Yamanishi, Kevin Pilotte
Life of this patent
Estimating the term…
Abstract
Methods and apparatus for detecting and minimizing the effects of Denial Of Service (DOS) attacks in high-speed networks in which packet processing is carried out by multiple processing cores. In one embodiment of the invention a communications method and apparatus detects and deletes denial of service attack packets in a multi-core distributed packet processing system using a lightweight DOS attack packet detection and deletion process.
Claims20
A semiconductor chip comprising:
- receiver circuitry that receives a plurality of packets;
- a plurality of packet processing cores;
- packet value generation circuitry that generates for each received packet of the plurality of received packets, a packet value from packet header information included in the received packet to which the generated value corresponds, said generated packet value having fewer bits than said packet header information from which it is generated, said generated packet value being a hash value or CRC value generated from packet header information that uniquely identifies a packet flow and a source of the packet flow to which the packet belongs;
- time stamp generation circuitry that generates for each received packet of the plurality of received packets, a time value corresponding to the time the packet was received by the receiver circuitry;
- a memory for storing the generated packet values and generated time values corresponding to each received packet of the plurality of received packets;
- congestion monitoring circuitry that determines a level of packet processing congestion;
- a processor configured to control denial of service protection circuitry to switch between operating in a normal mode of operation or a congestion mode of operation based on the level of packet processing congestion determined by said congestion monitoring circuitry, wherein operating in said normal mode of operation includes passing received packets to a first packet processing core of the plurality of packet processing cores without regard to said packet value generated from the packets being passed and wherein operating in said congestion mode of operation is performed when said monitoring indicates a level of packet processing congestion over a threshold, said operating in said congestion mode of operation including dropping received packets based on both:
- (i) the packet value generated from the packets to be dropped matching at least one previously generated packet value stored in said memory and (ii) the packets to be dropped generated received time value, said processor controlling said denial of service protection circuitry to operate in said normal mode of operation when it is not operating in said congestion mode of operation;
- and
- wherein the threshold is based upon a depth of an input packet queue to the denial of service protection circuitry or a depth of an input packet queue to one or more of said plurality of packet processing cores, said plurality of packet processing cores being downstream from said denial of service protection circuitry.
7 more elements
A session border controller device comprising:
- receiver circuitry that receives a plurality of packets;
- a plurality of packet processing cores;
- packet value generation circuitry that generates for each received packet of the plurality of received packets, a packet value from packet header information included in the received packet to which the generated value corresponds, said generated packet value having fewer bits than said packet header information from which it is generated, said generated packet value being a hash value or CRC value generated from packet header information that uniquely identifies a packet flow and a source of the packet flow to which the packet belongs;
- time stamp generation circuitry that generates for each received packet of the plurality of received packets, a time value corresponding to the time the packet was received by the receiver circuitry;
- a memory for storing the generated packet values and generated time values corresponding to each received packet of the plurality of received packets;
- congestion monitoring circuitry that determines a level of packet processing congestion;
- a processor configured to control denial of service protection circuitry to switch between operating in a normal mode of operation or a congestion mode of operation based on the level of packet processing congestion determined by said congestion monitoring circuitry, wherein operating in said normal mode of operation includes passing received packets to a first packet processing core of the plurality of packet processing cores without regard to said packet value generated from the packets being passed and wherein operating in said congestion mode of operation is performed when said monitoring indicates a level of packet processing congestion over a threshold, said operating in said congestion mode of operation including dropping received packets based on both:
- (i) the packet value generated from the packets to be dropped matching at least one previously generated packet value stored in said memory and (ii) the packets to be dropped generated received time value, said processor controlling said denial of service protection circuitry to operate in said normal mode of operation when it is not operating in said congestion mode of operation;
- and
- wherein the threshold is based upon a depth of an input packet queue to the denial of service protection circuitry or a depth of an input packet queue to one or more of said plurality of packet processing cores, said plurality of packet processing cores being downstream from said denial of service protection circuitry.
7 more elements
A method of operating a semiconductor chip comprising:
- receiving a plurality of packets at receiver circuitry of the semiconductor chip;
- generating by the semiconductor chip for each received packet of the plurality of received packets, a packet value from packet header information included in the received packet to which the generated value corresponds, said generated packet value having fewer bits than said packet header information from which it is generated, said generated packet value being a hash value or CRC value generated from packet header information that uniquely identifies a packet flow and a source of the packet flow to which the packet belongs;
- generating, by time stamp generation circuitry of the semiconductor chip, for each received packet of the plurality of received packets, a time value corresponding to the time the packet was received by the receiver circuitry;
- storing in memory the generated packet values and generated time values corresponding to each received packet of the plurality of received packets;
- determining by the semiconductor chip a level of packet processing congestion;
- operating the semiconductor chip in a normal mode of operation or a congestion mode of operation based on the level of packet processing congestion determined by said semiconductor chip, wherein operating in said normal mode of operation includes passing received packets to a first packet processing core of the plurality of packet processing cores without regard to said packet value generated from the packets being passed and wherein operating in said congestion mode of operation is performed when said monitoring indicates a level of packet processing congestion over a threshold, said operating in said congestion mode of operation including dropping received packets based on both:
- (i) the packet value generated from the packets to be dropped matching at least one previously generated packet value stored in said memory and (ii) the packets to be dropped generated received time value, said processor controlling said denial of service protection circuitry to operate in said normal mode of operation when it is not operating in said congestion mode of operation;
- and
- wherein the threshold is based upon a depth of an input packet queue to the denial of service protection circuitry or a depth of an input packet queue to one or more of said plurality of packet processing cores, said plurality of packet processing cores being downstream from said denial of service protection circuitry.
6 more elements
Dependencies are inferred from the claim text.