Mitigating ddos attacks on internet protocol networks

A computer program product for protecting resource availability, the computer program product comprising:

• one or more tangible, nonvolatile storage media;
• and
• machine instructions borne on the one or more tangible, nonvolatile storage media which, when running on one or more computer systems, cause the one or more computer systems to perform method comprising:
• establishing, by a first transistor-based circuitry, a first mapping that associates a first resource with network traffic destined to a public first IP subnet;
• causing, by a second transistor-based circuitry, a stateless first proxy gateway to receive a first IP packet of the network traffic from a first IP packet source destined to the public first IP subnet and after validating the first IP packet of the network traffic destined to the public first IP subnet to proxy the first IP packet to the first resource;
• causing, by a third transistor-based circuitry, a first hash result to be generated by encrypting or otherwise transforming a first digital identifier of the first IP packet source wherein one or more bits of the first hash result are directly or indirectly compared with a bit set of the first IP packet;
• causing, by a fourth transistor-based circuitry, the stateless first proxy gateway to respond to the one or more bits of the first hash result matching with the bit set of the first IP packet by giving the first IP packet a selective first access to the first resource;
• and
• causing, by a fifth transistor-based circuitry, an implementation of the selective first access by modifying at least part of the bit set of the first IP packet, wherein the first IP packet as modified does not contain a valid destination IP packet address and port of the first resource until a substitution protocol restores via the first mapping a valid destination IP packet address and port of the first resource and whereby the first IP packet is redirected to the first resource.

A system for protecting resource availability, the system comprising:

• a first transistor-based circuitry configured to establish a first mapping that associates (at least) a first resource with network traffic destined to a public first IP subnet;
• a second transistor-based circuitry configured to cause a stateless first proxy gateway to receive a first IP packet of the network traffic from a first IP packet source destined to the public first IP subnet and after validating the first IP packet of the network traffic destined to the public first IP subnet to proxy the first IP packet to the first resource;
• a third transistor-based circuitry configured to cause a first hash result to be generated by encrypting or otherwise transforming a first digital identifier of the first IP packet source wherein one or more bits of the first hash result are directly or otherwise compared with a bit set of the first IP packet;
• a fourth transistor-based circuitry configured to cause the stateless first proxy gateway to respond to the one or more bits of the first hash result matching with the bit set of the first IP packet by giving the first IP packet a selective first access to the first resource;
• and
• a fifth transistor-based circuitry configured to cause an implementation of the selective first access by modifying at least part of the bit set of the first IP packet wherein the first IP packet as modified does not contain a valid destination IP packet address and port of the first resource until a substitution protocol restores via the first mapping a valid destination IP packet address and port of the first resource and whereby the first IP packet is redirected to the first resource.