User datagram protocol firewall
AssigneeMicrosoft Technology Licensing, LLC
InventorTimothy James PIERREPONT
Life of this patent
Estimating the term…
Abstract
In a UDP firewall, a flow of packets is received from a public communications network, the flow of packets being sent into a private communications network. The firewall forwards a threshold amount of the flow of packets into the private communications network and validates the flow of packets in response to receiving a packet from the private communications network. In response to the validation failing the firewall blocks the flow of packets. In response to the validation succeeding the firewall allows the flow of packets to continue to be forwarded into the private communications network.
Claims20
A method performed by a firewall for mitigating denial of service attacks in a communications network, the method comprising:
- receiving a flow of packets from a first network directed toward a second network;
- forwarding, by the firewall, an initial portion of the flow of packets into the second network;
- monitoring one or more observable behaviors associated with the forwarded portion of the flow;
- determining, based on the one or more observable behaviors, whether the flow is valid;
- and
- in response to determining that the flow is not valid, blocking subsequent packets of the flow, and in response to determining that the flow is valid, permitting subsequent packets of the flow to pass through the firewall.
A system comprising:
- a plurality of firewall instances disposed between a first network and a second network;
- and
- at least one processor and memory storing instructions that, when executed, cause each firewall instance to:
- receive a flow of packets from the first network toward the second network;
- forward an initial portion of the flow into the second network;
- determine validity of the flow based on behavior observed after forwarding the initial portion;
- and
- selectively block or allow the flow based on the determined validity,
- wherein the firewall instances operate without reliance on shared session state associated with the flows.
A method for validating packet flows through a firewall, the method comprising:
- receiving, at the firewall, a flow of packets from a first network directed toward a second network;
- forwarding an initial portion of the flow toward a node in the second network;
- receiving, from the second network, a validation signal associated with the flow, the validation signal being generated independently of the flow;
- and
- in response to receiving the validation signal, allowing subsequent packets of the flow, and in response to not receiving the validation signal, blocking subsequent packets of the flow.
Dependencies are inferred from the claim text.