System and method for mitigating a denial of service attack in a subscriber network
AssigneeTime Warner Cable Inc.
InventorsTushar A. Nakhre, Shan Huang, Michael S. Kelsen
Life of this patent
Estimating the term…
Abstract
A system and method for mitigating a denial of service attack in a subscriber network. A traffic monitor monitors bandwidth usage of a subscriber network that is directed to a particular port. The traffic monitor detects excessive traffic based on preset thresholds or algorithms. When excessive traffic is detected, the traffic monitor may obtain the source IP address from headers in the packet stream and identify the device or devices from which the packets were delivered to the network. Using the IP addresses of affected devices, a policy may be implemented to throttle packets originating from those devices that are directed to the particular port.
Claims14
A method for mitigating a denial of service attack in a subscriber network comprising:
- monitoring upstream packets in a region of the subscriber network using a traffic monitor;
- detecting excess upstream packets directed to a port in the region of the subscriber network using the traffic monitor, wherein the port is identified by a port number;
- obtaining by the traffic monitor an identifier of a subscriber device identified as a source of the excess upstream packets, wherein the subscriber device is connected to the subscriber network via one of a plurality of regional cable modem termination systems (CMTSs);
- reporting the subscriber device identifier to a national policy server;
- applying by the national policy server a policy to the identifier of the subscriber device, wherein the policy limits the upstream bandwidth for upstream packets originating from the subscriber device directed to the port number;
- reporting the policy, the port number and the identifier of the subscriber device to regional policy server, wherein the regional policy server is in communication with the plurality of regional CMTSs;
- identifying by the regional policy server the one of the plurality of regional CMTSs to which the subscriber device identified by the identifier is connected;
- reporting by the regional policy server the policy to the identified one of the plurality of regional CMTSs:
- and
- enforcing by the one of the plurality of regional CMTSs the policy against the identifier of the subscriber device.
A system for mitigating a denial of service attack in a subscriber network comprising:
- the subscriber network, wherein the subscriber network comprises regions;
- a traffic monitor comprising a first processor, wherein the first processor is configured with executable instructions to cause the traffic monitor to perform operations comprising:
- monitoring upstream packets in a region of the subscriber network;
- detecting excess upstream packets directed to a port in the region of the subscriber network, wherein the port is identified by a port number;
- obtaining an identifier of a subscriber device identified as a source of the excess upstream packets, wherein the subscriber device is connected to the subscriber network via one of a plurality of regional cable modem termination systems (CMTSs);
- and
- reporting the identifier to a national policy server;
- the national policy server, wherein the national policy server comprises a second processor, wherein the second processor is configured with executable instructions to cause the national policy server to perform operations comprising:
- applying a policy to the identifier of the subscriber device, wherein the policy limits the upstream bandwidth for upstream packets originating from the subscriber device directed to the port number;
- reporting the policy, the port number and the identifier of the subscriber device to a regional policy server, wherein the regional policy server is in communication with the plurality of regional CMTSs;
- and
- the regional policy server, wherein the regional policy server comprises a third processor, wherein the third processor is configured with executable instructions to cause the regional policy server to perform operations comprising:
- identifying by the regional policy server the one of the plurality of regional CMTSs to which the subscriber device identified by the identifier is connected;
- reporting by the regional policy server the policy to the identified one of the plurality of regional CMTSs,
- wherein the identified one of the plurality of regional CMTSs comprises a fourth processor and wherein the fourth processor is configured with executable instructions to cause the identified one of the plurality of regional CMTSs to perform operations comprising enforcing the policy against the identifier of the subscriber device.
Dependencies are inferred from the claim text.