# US 11,122,076 B2 · Method for defending against or mitigating DDoS attacks on IT infrastructures

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,122,076 B2
- Document ID: US11122076B2
- Status: Granted
- Kind: B2
- Application number: 16/698,999
- Filed: 2019-11-28
- Published: 2020-06-04
- Granted: 2021-09-14
- Earliest claimed: 2018-11-30
- Assignees: DE-CIX Management GmbH
- Applicants: DE-CIX Management GmbH
- Inventors: Matthias Wichtlhuber; Christoph Dietzel; Thomas King
- Web page: https://patentgrep.com/patent/US11122076B2

## CPC

- H04L 63/1458: {Denial of Service}
- H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL}
- H04L 63/14: {for detecting or protecting against malicious traffic}
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 2463/143: Denial of service attacks involving systematic or selective dropping of packets
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

The disclosure relates to computer-based communication systems, such as the Internet, and in particular systems and methods for defending against DoS attacks (denial of service attacks) on Internet servers.

## Claims

### Claim 1

A computer-implemented method for defending against or mitigating distributed denial of service (DDoS) attacks on information technology (IT) infrastructures, comprising the following steps:
a) receiving user-generated filter rules sent by users affected by a DDoS attack via Border Gateway Protocol (BGP) signals to a route server of an Internet node or to a programming interface provided by the Internet node;
b) calculating, in a controller system, a desired overall system state from an aggregate of the user-generated filter rules and deriving a stream of hardware-independent configuration changes;
c) forwarding the user-generated filter rules to a management system in which a status of the stream of hardware-independent configuration changes generated in step b) is managed, wherein the management system, using a syntax specified by a respective manufacturer and taking into account manufacturer-specific features, translates exactly the user-generated filter rules into hardware-specific configurations that correspond to capabilities of a respective hardware;
d) activating options available in the respective hardware for setting up network traffic filters, by means of which filtering and blocking mechanisms on the respective hardware are activated;
e) filtering data traffic according to the filtering user-generated rules forwarded in step c); and
f) blocking or bandwidth limiting the data traffic filtered in step e).

### Claim 2 (depends on 1)

The method according to claim 1, wherein the filtering the data traffic takes place at an output port assigned to one of the users.

### Claim 3 (depends on 1)

The method according to claim 1, wherein the method uses a standard programming interfaces provided in a firmware of the respective hardware to set up and configure the user-generated filter rules.

### Claim 4 (depends on 1)

The method according to claim 1, wherein the method is implemented in form of software running on a plurality of servers of the Internet node.

### Claim 5 (depends on 4)

The method according to claim 4, wherein an architecture of the software is divided into a signaling level, a management level and a filtering level.

### Claim 6 (depends on 5)

The method according to claim 5, wherein the management level consists of two components, namely
a controller, which is responsible for tracking the user-generated filter rules and their changes as signaled by the route server or via a programming interface on behalf of the users, and
a network manager, which implements the changes of the filter rules by calculating the hardware-specific configuration changes.

### Claim 7

A system for executing a computer-implemented method for defending against or mitigating distributed denial of service (DDoS) attacks on information technology (IT) infrastructures, the system comprising:
a route server computer of an Internet node or to a programming interface provided by the Internet node configured to receive user-generated filter rules sent by users affected by a DDoS attack via Border Gateway Protocol (BGP) signals;
a controller configured to calculate a desired overall system state from an aggregate of the user-generated filter rules and to derive a stream of hardware-independent configuration changes;
a network manager to which the user-generated filter rules are forwarded and in which a status of the stream of hardware-independent configuration changes generated by the controller is managed, wherein the network manager, using a syntax specified by a respective manufacturer and taking into account manufacturer-specific features, translates exactly the user-generated filter rules into hardware-specific configurations that correspond to capabilities of a respective hardware;
wherein the respective hardware makes available activating options for setting up network traffic filters, by means of which filtering and blocking mechanisms on the respective hardware are activated;
wherein data traffic is filtered according to the filtering user-generated rules forwarded to the network manager; and
wherein the filtered data traffic is blocked or bandwidth limited.