Location-aware rate-limiting method for mitigation of denial-of-service attacks
AssigneeCheck Point Software Technologies Ltd.
InventorsTamir Zegman, Ofer Barkai
Life of this patent
Estimating the term…
Abstract
A network component has a set of one or more rules, each of which has a match component and an action component. If an incoming packet maps to the match component of a rule, then the packet is handled according to the rule's action component. If the rule also includes a limit component, then if the packet maps to the rule's match component, a family history of the rule is updated, and the packet is handled according to the rule's action component only if the rule's family history satisfies the rule's limit component.
Claims13
A method of filtering packets at a network component, comprising the steps of:
- (a) providing at least one rule, each said rule including a match component and an action component;
- and
- (b) for each packet and for each said rule:
- if said each packet maps to said match component of said each rule:
- handling said each packet according to said action component of said each rule;
- wherein, if said each rule also includes a limit component, the method also includes the step of:
- (c) if said each packet maps to said match component of said each rule:
- updating a family history of said each rule;
- and said each packet is handled according to said action component of said each rule only if said family history of said each rule satisfies said limit component of said each rule.
A network component comprising:
- (a) at least one input port for receiving packets;
- and
- (b) a filtering module for filtering said packets by steps including:
- for each said packet and for each of at least one rule:
- if said each packet maps to a match component of said each rule:
- handling said each packet according to an action component of said each rule;
- wherein, if said each rule also includes a limit component, said filtering also includes:
- if said each packet maps to said match component of said each rule, updating a family history of said each rule, said each packet being handled according to said action component of said each rule only if said family history of said each rule satisfies said limit component of said each rule.
A network component comprising:
- (a) a non-volatile memory for storing:
- (i) at least one rule for filtering packets, and
- (ii) program code for filtering said packets by steps including:
- for each said packet and each said rule if said each packet maps to a match component of said each rule:
- handling said each packet according to an action component of said each rule,
- wherein, if said each rule also includes a limit component, said filtering also includes, if said each packet maps to said match component of said each rule, updating a family history of said each rule, said each packet being handled according to said action component of said each rule only if said family history of said each rule satisfies said limit component of said each rule;
- and
- (b) a processor for executing said program code.
Dependencies are inferred from the claim text.