US 12,603,917 B2Granted

Systems and methods for IP spoofing security

AssigneeCenturyLink Intellectual Property LLC

InventorsDean Ballew, John R.B. Woodworth, John A. Schiel

Life of this patent

Estimating the term…

Loading patent…

Abstract

Examples of the present disclosure describe systems and methods for providing security against IP spoofing. In aspects, network traffic associated with one or more data requests may be received by a device in a computing environment. The network traffic may be evaluated using one or more automated logic systems or algorithms to identify suspicious or malicious behavior. The automated logic systems or algorithms may implement one or more analyses, such as asymmetric routing analysis, hardware device analysis, user and/or network behavior analysis, etc. Upon identifying suspicious or malicious behavior, the automated logic systems or algorithms may apply a filter to one or more computing devices. For example, a filter for blocking network traffic associated with the suspicious or malicious behavior may be applied to a computing device that is in close geographic and/or logical proximity to an attacking computing device.

Claims19

Dependent claims

A system comprising:

at least one processor;
and
memory coupled to the at least one processor, the memory comprising computer executable instructions that, when executed by the at least one processor, cause the system to perform a method, the method comprising:
receiving, at a receiving device, network traffic information from a sending device, wherein the network traffic information comprises a source IP address;
evaluating the network traffic information to determine the source IP address is being used illegitimately;
in response to determining the source IP address is being used illegitimately:
identifying at least one ingress router of a network receiving network traffic that identifies the source IP address;
determining at least one transmission path within the network for the network traffic;
ranking multiple devices along the transmission path based on closest proximity of the filter device to the ingress router, wherein the closest proximity is a combination of geographical proximity to the receiving device and logical proximity to the receiving device;
and
identifying a filter device based at least on the ranking;
and
applying a filter to the filter device, wherein the filter is configured to block at least a portion of the network traffic information from the sending device.

10 more elements

Dependencies are inferred from the claim text.

Facts

Application: 17/657,381Filed 31 Mar 2022 · us provisional application
Priority: 9 Apr 2021
Published: US 2022/0329625 A113 Oct 2022
Granted: 14 Apr 2026
Term ends: Not estimatedThe source records don’t support an estimate.

Classification4 codes

H04L 63/1483
Countermeasures against malicious traffic: service impersonation, e.g. phishing, pharming or web spoofing
H04L 63/0236
Filtering policies: filtering by address, protocol, port number or service, e.g. IP-address or URL
H04L 63/1425
By monitoring network traffic: traffic logging, e.g. anomaly detection
H04L
Digital communication

Family

Application63/172,974Us provisional application · filed 9 Apr 2021
US 2022/0329625 A1Pre-grant publication · published 13 Oct 2022
US 12,603,917 B2This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key