Method for defending against or mitigating DDoS attacks on IT infrastructures
AssigneeDE-CIX Management GmbH
InventorsMatthias Wichtlhuber, Christoph Dietzel, Thomas King
Life of this patent
Estimating the term…
Abstract
The disclosure relates to computer-based communication systems, such as the Internet, and in particular systems and methods for defending against DoS attacks (denial of service attacks) on Internet servers.
Claims7
A computer-implemented method for defending against or mitigating distributed denial of service (DDoS) attacks on information technology (IT) infrastructures, comprising the following steps:
- a) receiving user-generated filter rules sent by users affected by a DDoS attack via Border Gateway Protocol (BGP) signals to a route server of an Internet node or to a programming interface provided by the Internet node;
- b) calculating, in a controller system, a desired overall system state from an aggregate of the user-generated filter rules and deriving a stream of hardware-independent configuration changes;
- c) forwarding the user-generated filter rules to a management system in which a status of the stream of hardware-independent configuration changes generated in step b) is managed, wherein the management system, using a syntax specified by a respective manufacturer and taking into account manufacturer-specific features, translates exactly the user-generated filter rules into hardware-specific configurations that correspond to capabilities of a respective hardware;
- d) activating options available in the respective hardware for setting up network traffic filters, by means of which filtering and blocking mechanisms on the respective hardware are activated;
- e) filtering data traffic according to the filtering user-generated rules forwarded in step c);
- and
- f) blocking or bandwidth limiting the data traffic filtered in step e).
A system for executing a computer-implemented method for defending against or mitigating distributed denial of service (DDoS) attacks on information technology (IT) infrastructures, the system comprising:
- a route server computer of an Internet node or to a programming interface provided by the Internet node configured to receive user-generated filter rules sent by users affected by a DDoS attack via Border Gateway Protocol (BGP) signals;
- a controller configured to calculate a desired overall system state from an aggregate of the user-generated filter rules and to derive a stream of hardware-independent configuration changes;
- a network manager to which the user-generated filter rules are forwarded and in which a status of the stream of hardware-independent configuration changes generated by the controller is managed, wherein the network manager, using a syntax specified by a respective manufacturer and taking into account manufacturer-specific features, translates exactly the user-generated filter rules into hardware-specific configurations that correspond to capabilities of a respective hardware;
- wherein the respective hardware makes available activating options for setting up network traffic filters, by means of which filtering and blocking mechanisms on the respective hardware are activated;
- wherein data traffic is filtered according to the filtering user-generated rules forwarded to the network manager;
- and
- wherein the filtered data traffic is blocked or bandwidth limited.
Dependencies are inferred from the claim text.