Network Amplification Attack Mitigation
AssigneeMicrosoft Corporation
InventorDinan S. Gunawardena
Life of this patent
Estimating the term…
Abstract
An improved network protocol for mitigating network amplification attacks is provided. The absolute network load that any transient distributed attack can cause is bounded based on a resource crediting scheme. The protocol accumulates “credit” upon reception and detection of candidate attack request packets, and draws against that credit when transmitting responsive packets. In some implementations, the time frame of such an attack is also bounded using time limits applied to a resource crediting scheme. Other resources may also be bounded by the resource crediting scheme, including without limitation CPU utilization, storage capacity, power, etc.
Claims21
1-25. (canceled)
A method comprising:
- evaluating whether a packet received by an intermediary node is a trusted packet or a candidate attack request packet;
- accessing an account associated with a source of the candidate attack request packet, wherein the account is credited based upon properties of packets received by the intermediary node from the source, and wherein credits are removed from the account when resources are expended by the intermediary node on behalf of the source;
- and
- authorizing resource expenditure by the intermediary node based upon a balance of the account.
One or more computer readable storage devices comprising computer-readable instructions that, when executed by one or more computers, cause the one or more computers to perform:
- determining a source of a received packet, wherein the received packet requests that one or more other packets be sent on behalf of the source to a destination;
- accessing a balance that reflects a number of packets received from the source and a number of packets sent on behalf of the source to the destination;
- and,
- sending the one or more other packets to the destination, on behalf of the source, so long as the balance is positive.
A system comprising:
- an intermediary node configured to:
- receive incoming traffic from a controller node, the incoming traffic requesting that the intermediary node send outgoing traffic to an end system on behalf of the controller node;
- accumulate credit in a credit counter as the incoming traffic is received from the controller node by the intermediary node;
- draw credit from the credit counter as the outgoing traffic is sent from the intermediary node to the end system;
- determine whether enough credit is in the credit counter to continue sending the outgoing traffic from the intermediary node to the end system;
- and
- in an instance when there is not enough credit in the credit counter, stop or delay sending the outgoing traffic from the intermediary node to the end system on behalf of the controller node.
Dependencies are inferred from the claim text.