Method for distributed denial-of-service attack mitigation by selective black-holing in MPLS VPNS
AssigneeAT&T Intellectual Property II, L.P.
InventorsThusitha Jayawardena, Luis E. Morales
Life of this patent
Estimating the term…
Abstract
A system and method for aiding the handling of DDoS attacks in which VPN traffic entering an ISP network at some points will be black-holed, while VPN traffic entering the ISP network at other points will be routed, as it should be, to the system-under-attack. Thus, the system-under-attack is made available to some of the user community and made unavailable to suspect portions of the user community. Furthermore, the number of entry points where black-holing of VPN traffic occurs can be selected and changed in real-time during a DDoS attack.
Claims18
An internet service provider virtual private network comprising:
- a plurality of edge routers;
- a plurality of core routers for allowing communication between the plurality of edge routers;
- a virtual private network application in communication with the plurality of edge routers, the virtual private network application having a first internet protocol address;
- and
- a black-hole router in communication with the plurality of core routers, wherein virtual private network traffic received by the black-hole router is black-holed, the black-hole router for injecting a second internet protocol address into the internet service provider virtual private network, the second internet protocol address comprising:
- a same internet protocol address as the first internet protocol address;
- a higher preference value than the first internet protocol address;
- and
- a community value such that when the second internet protocol address is injected, a selected first number of edge routers of the plurality of edge routers directs virtual private network traffic addressed for the first internet protocol address to the virtual private network application and a selected second number of edge routers of the plurality of edge routers directs virtual private network traffic addressed for the second internet protocol address to the black-hole router.
An internet service provider network comprising:
- a plurality of edge routers;
- an application in communication with the plurality of edge routers;
- the application having a first internet protocol address such that virtual private network traffic addressed for the first internet protocol address and entering the internet service provider network at any one of the plurality of edge routers, is routed to the application;
- a black-hole router, wherein virtual private network traffic received by the black-hole router is black-holed;
- and
- a router for injecting an instruction into the internet service provider network, such that a select edge router of the plurality of edge routers redirects virtual private network traffic, which is addressed to the first internet protocol address, to the black-hole router, wherein the instruction that is injected comprises a routing instruction having a same internet protocol address as the first internet protocol address, but with a higher preference value than the first internet protocol address and having a community value such that when the routing instruction is injected, a selected first number of edge routers of the plurality of edge routers directs virtual private network traffic addressed for the first internet protocol address to the application.
A method of managing a distributed denial of service attack on an application within an internet service provider network, the application having a first internet protocol address, the method comprising:
- injecting a border gateway protocol routing instruction into the internet service provider network when the distributed denial of service attack is occurring, the border gateway protocol routing instruction comprising a second internet protocol address having a same internet protocol address as the first internet protocol address, but with a higher preference value than the first internet protocol address and having a community value;
- redirecting, at a selected edge router, virtual private network traffic addressed for the second internet protocol address to a black-hole router, wherein the virtual private network traffic received by the black-hole router is black-holed;
- and
- directing, at another edge router, virtual private network traffic addressed for the first internet protocol address to the application that is experiencing the distributed denial of service attack.
Dependencies are inferred from the claim text.