Protecting computing assets from resource intensive querying attacks
AssigneeArbor Networks, Inc.
InventorsEllis Roland Dobbins, Alexandru G. Bardas, Marc R. Eisenbarth
Life of this patent
Estimating the term…
Abstract
A method and system for managing data traffic and protecting computing assets. The method and system includes intercepting queries and messages, such as EDNS0 queries, and sending probe queries and reply queries to the originating computing device to determine whether the originating computing device may be sufficiently validated so as to justify forwarding resource-intensive queries and messages to the targeted computing device.
Claims20
A computer-implemented method of defending against a Denial of Service (DoS) attack comprising:
- receiving an initial message at a proxy, the initial message being sent from a first node to a destination node;
- sending a probe message from the proxy to the first node;
- determining a security posture of the first node based on the first node's response to the probe message;
- and
- based upon the first node's security posture, selecting a security protocol from the group consisting of:
- allowing higher-capability messages from the first node to reach the destination node;
- blocking all messages from the first node to the destination node;
- and
- allowing only lower-capability messages from the first node to the destination node, wherein this security protocol includes the step of representing to the first node that the second node is only capable of receiving and processing lower-capability messages.
A non-transitory computer readable storage medium and a computer program embedded therein, the computer program comprising instructions, which when executed by the computer system cause the computer system to:
- receive an initial message at a proxy, the initial message being sent from a first node to a destination node;
- send a probe message from the proxy to the first node;
- determine a security posture of the first node based on the first node's response to the probe message.
A non-transitory computer readable storage medium and a computer program embedded therein, the computer program comprising instructions, which when executed by the computer system cause the computer system to:
- receive a first query, at a proxy, for the IP address of a first domain, the first query being sent from a first node to a destination node, wherein the destination node is an authoritative name server for the first domain, and wherein the first query is an EDNS0 query;
- send a probe query to a the first node, and wherein the probe query comprises an IP address query regarding a domain that the destination node is an authoritative name server for;
- and
- determine a status of the first node based on the first node's response to the probe query.
Dependencies are inferred from the claim text.