US 2006/0041667 A1 · Method and apparatus for protecting legitimate traffic from dos and ddos attacks

Abstract

An apparatus for protecting legitimate traffic from DoS and DDoS attacks has a high-priority (505) and a low-priority (506) queue. Besides, a queue information table (402) has STT (Source-based Traffic Trunk) service queue information of a specific packet. A queue coordinator (502) updates the queue information table (502) based on a load of a provided STT and a load of the high-priority queue (505). A packet classifier (504) receives a packet from the network access unit (508), investigates an STT service queue of the packet from the queue information table (502), selectively transfers the packet to the high-priority (505) or the low-priority (506) queue and provides information on the packet to the queue coordinator (503). A buffer (507) buffers outputs of the high-priority (505) and the low-priority (506) queue and provides outputs to the network (509) to be protected.

Claims15

Dependent claims

An apparatus connected between a network access unit and a network to be protected, for protecting legitimate traffic from DoS and DDoS attacks, comprising:

a high-priority queue;
a low-priority queue;
a queue information table having specific STT service queue information of a specific packet;
a queue coordinator for updating the queue information table based on a load of a provided STT and a load of the high-priority queue;
a packet classifier for receiving a packet from the network access unit, investigating an STT service queue of the received packet from the queue information table, selectively transferring the received packet to the high-priority queue or the low-priority queue in accordance with an investigation result and providing information on the received packet to the queue coordinator;
and
a buffer for buffering outputs of the high-priority queue and the low-priority queue and providing buffered outputs to the network to be protected.

4 more elements

A method for protecting legitimate traffic from DoS and DDoS attacks in an apparatus therefor, wherein the apparatus is connected between a network access unit and a network to be protected and includes a queue information table having specific STT service queue information of a specific packet, a queue coordinator for updating the queue information table based on a load of a provided STT and a load of a high-priority queue and a packet classifier for receiving a packet from the network access unit, investigating an STT service queue of a received packet from the queue information table, selectively transferring the received packet to the high-priority queue or the low-priority queue in accordance with an investigation result and providing information on the received packet to the queue coordinator, the method comprising the steps of:

(a) obtaining an STT ID based on a source IP address of the packet received from the network access unit;
(b) investigating a service queue corresponding to the searched STT ID from the queue information table and checking whether the service queue is the high-priority queue or the low-priority queue;
(c) transferring the received packet to the high-priority queue if the service queue is the high-priority queue in the step (b);
(d) transferring the received packet to the low-priority queue if the service queue is the low-priority queue in the step (b);
and
(e) transferring the received packet information to the queue coordinator.

3 more elements

Dependencies are inferred from the claim text.

Method and apparatus for protecting legitimate traffic from dos and ddos attacks

Life of this patent

Method and apparatus for protecting legitimate traffic from dos and ddos attacks

Life of this patent

Abstract

Claims15