Front-end protocol for server protection
AssigneeInternational Business Machines Corporation
InventorsClark Debs Jeffries, Mohammad Peyravian
Life of this patent
Estimating the term…
Abstract
The present invention provides for protecting against denial of service attacks. A request is sent by a client, the request comprises client indicia. The request is received at a server. A request count is incremented by the server. A sequence number is assigned as a function of the client indicia. A problem is selected by the server. The problem is sent by the server to the client. A solution to the problem is sent to the server. It is determined if the solution by client is correct. If the solution is correct, a session is performed. If the solution is not correct, the request is discarded. This can substantially decrease the amount of attacks performed by a rogue client, as the session set-up time can be substantial.
Claims16
1-12. (canceled)
A method for protecting a server against denial of service attacks, comprising:
- maintaining, by a server having a processing unit, a window over a sequence number space, the sequence number space including sequence numbers that are sequentially assigned by the server to respective challenge messages issued by the server for verifying legitimate requests for service, the window comprising a leading edge sequence number and a trailing edge sequence number;
- receiving a request;
- determining a challenge message should be sent;
- selecting the leading edge sequence number as a challenge sequence number;
- assigning the challenge sequence number to a challenge message;
- assigning a problem to the challenge message;
- sending the challenge message, wherein the challenge message comprises the problem and the challenge sequence number;
- receiving a response message, wherein the response message comprises a solution to the problem and the challenge sequence number;
- discarding the response message if the challenge sequence number is not within the window;
- discarding the response message if the solution is not correct;
- and
- performing a session if the response message is not discarded.
A computer program product for protecting against a denial of service attacks, the computer program product embodied on a computer readable storage medium, the computer program product comprising:
- computer code for maintaining a window over a sequence number space, the sequence number space including sequence numbers that are sequentially assigned by a server to respective challenge messages issued by the server for verifying legitimate requests for service, the window comprising a leading edge sequence number and a trailing edge sequence number;
- computer code for receiving a request;
- computer code for selecting a challenge sequence number from the sequence number space;
- computer code for assigning the challenge sequence number to a challenge message;
- computer code for assigning a problem to the challenge message;
- computer code for sending the challenge message, wherein the challenge message comprises the problem and the challenge sequence number;
- computer code for receiving a response message, wherein the response message comprises a solution to the problem and the challenge sequence number;
- computer code for discarding the response message if the challenge sequence number is not within the window;
- computer code for discarding the response message if the solution is not correct;
- and
- computer code for performing a session if the response message is not discarded.
A system for protecting against a denial of service attacks in a computer system, the system comprising a processor coupled to a tangible memory storing a computer program, the computer program comprising:
- computer code for maintaining a window over a sequence number space, the sequence number space including sequence numbers that are sequentially assigned by a server to respective challenge messages issued by the server for verifying legitimate requests for service, the window comprising a leading edge sequence number and a trailing edge sequence number;
- computer code for receiving a request;
- computer code for selecting a challenge sequence number from the sequence number space;
- computer code for assigning the challenge sequence number to a challenge message;
- computer code for assigning a problem to the challenge message;
- computer code for sending the challenge message, wherein the challenge message comprises the problem and the challenge sequence number;
- computer code for receiving a response message, wherein the response message comprises a solution to the problem and the challenge sequence number;
- computer code for discarding the response message if the challenge sequence number is not within the window;
- computer code for discarding the response message if the solution is not correct;
- and
- computer code for performing a session if the response message is not discarded.
Dependencies are inferred from the claim text.