Dynamic denial of service mitigation system
AssigneeAT&T Intellectual Property I, L.P.
InventorsHui Tong, Adrian Cepleanu, Dimitri Krinos, Eric Mueller
Life of this patent
Estimating the term…
Abstract
A dynamic denial of service (DDoS) mitigation system comprising a BGP address family exchange connected to at least one DDoS mitigation route reflector, and at least one DDoS mitigation route reflector being an address family identifier specific route reflector, where each DDoS mitigation route reflector advertises BGP content in a first address family to the BGP family exchange. The BGP address family exchange translates the BGP content from the first address family to a destination address family and announces the translated content to a destination route reflector, and wherein the destination address family includes a flow specification diversion route.
Claims20
A network device comprising a processor, an input/output device coupled to the processor, and a memory coupled with the processor, the memory comprising executable instructions that when executed by the processor cause the processor to effectuate operations comprising:
- instantiating a border gateway protocol (BGP) address family exchange (BAFX) in a network;
- connecting a BAFX to an address family specific dynamic denial of service function (DDoS) mitigation service route reflector;
- connecting the BAFX to a destination route reflector using a flow specification address family;
- instantiating a first virtual private network transport tunnel extending from an ingress virtual provider edge router (vPE) to a head-end and a provider edge (HE-PE);
- and
- instantiating a second network transport tunnel extending from the HE-PE to an egress vPE;
- wherein the BAFX translates at least one diversion route from the DDoS mitigation service route reflector to a flow specification diversion route,
- wherein the BAFX maps a diversion address to a flow specification format during the translation,
- wherein the diversion address comprises affinity information corresponding to a forwarding action or a redirecting action to a specific location, and
- wherein the flow specification diversion route diverts dirty traffic from the ingress vPE toward a scrubber via a first virtual private network transport tunnel, and wherein clean traffic from the scrubber is directed to the egress vPE via a second virtual private network transport tunnel.
A computer-implemented method comprising:
- instantiating a border gateway protocol (BGP) address family exchange (BAFX) in a network;
- connecting a BAFX to an address family specific dynamic denial of service function (DDoS) mitigation service route reflector;
- connecting the BAFX to a destination route reflector using a flow specification address family;
- instantiating a first virtual private network transport tunnel extending from an ingress virtual provider edge router (vPE) to a head-end and a provider edge (HE-PE);
- and
- instantiating a second network transport tunnel extending from the HE-PE to an egress vPE;
- wherein the BAFX translates at least one diversion route from the DDoS mitigation service route reflector to a flow specification diversion route,
- wherein the BAFX maps a diversion address to a flow specification format during the translation,
- wherein the diversion address comprises affinity information corresponding to a forwarding action or a redirecting action to a specific location, and
- wherein the flow specification diversion route diverts dirty traffic from the ingress PE toward a scrubber via a first virtual private network transport tunnel, and wherein clean traffic from the scrubber is directed to the egress vPE via a second virtual private network transport tunnel.
A non-transitory computer-readable storage medium storing executable instructions that when executed by a processor causes said processor to effectuate operations comprising:
- instantiating a border gateway protocol (BGP) address family exchange (BAFX) in a network;
- connecting a BAFX to an address family specific dynamic denial of service function (DDoS) mitigation service route reflector;
- connecting the BAFX to a destination route reflector using a flow specification address family;
- instantiating a first virtual private network transport tunnel extending from an ingress virtual provider edge router (vPE) to a head-end and a provider edge (HE-PE);
- and
- instantiating a second network transport tunnel extending from the HE-PE to an egress vPE;
- wherein the BAFX translates at least one diversion route from the DDoS mitigation service route reflector to a flow specification diversion route,
- wherein the BAFX maps a diversion address to a flow specification format during the translation,
- wherein the diversion address comprises affinity information corresponding to a forwarding action or a redirecting action to a specific location, and
- wherein the flow specification diversion route diverts dirty traffic from the ingress vPE toward a scrubber via a first virtual private network transport tunnel, and wherein clean traffic from the scrubber is directed to the egress vPE via a second virtual private network transport tunnel.
Dependencies are inferred from the claim text.