DOS attack mitigation using upstream router suggested remedies
AssigneeAlcatel
InventorScott David D'Souza
Life of this patent
Estimating the term…
Abstract
Systems and methods of mitigating DOS attacks on a victim node in a computer based communication system are presented. According to the methods a node such as a router upstream from the victim analyzes traffic flow directed to the victim node and if a pattern indicating a possible attack is detected a notification to the effect is sent to the victim node. The victim can either ignore the notification or chose to suggest or request attack mitigation measures be implemented by the upstream router. Alternatively the upstream router can implement attack mitigation measures without waiting for input from the victim node.
Claims14
A method of mitigating a Denial of Service (DOS) attack on a first node in a computer-based communications network comprising the steps of:
- a) detecting at a second node located upstream of the first node a traffic pattern indicating a possible DOS attack on the first node;
- b) sending from the second node to the first node a notification of the possible attack;
- c) implementing, at the second node, attack mitigation measures to mitigate the attack on the first node;
- and
- d) wherein the notification from the second node includes a random nonce or other authentication information with which to verify the response of the first node.
A method of mitigating a Denial of Service (DOS) attack on a first node in a computer-based communications network comprising the steps of:
- a) detecting at a second node located upstream of the first node a traffic pattern indicating a possible DOS attack on the first node;
- b) sending from the second node to the first node a notification of the possible attack;
- c) receiving at the first node the notification and determining whether attack mitigating measures should be implemented;
- d) if attack mitigation measures are to be implemented sending from the first node instruction to the second node to implement the measures;
- e) implementing the attack mitigation measures at the second node;
- and
- f) wherein the notification from the second node includes a random nonce or other authentication information with which to verify the response of the first node.
A system for mitigating a Denial of Service (DOS) attack on a first node in a computer-based communications network comprising:
- a second node located upstream of the first node for detecting a traffic pattern indicating a possible DOS attack on the first node;
- means for sending from the second node to the first node a notification of the possible attack;
- means in the second node to implement an attack mitigation measure to mitigate a DOS attack on the first node;
- and
- wherein the notification from the second node includes a random nonce or other authentication information with which to verify the response of the first node.
A system for mitigating a Denial of Service (DOS) attack on a first node in a computer-based communications network comprising:
- means in the first node for receiving information from a second node located upstream of the first node indicating a possible DOS attack on the first node;
- means in the first node for determining whether the information is valid;
- means for responding to the second node;
- and
- wherein the notification from the second node includes a random nonce or other authentication information, with which to verify the response of the first node.
Dependencies are inferred from the claim text.