Techniques for preventing attacks on computer systems and networks
AssigneeFoundry Networks, Inc.
InventorsSheng-Yih Wang, Ron Talmor
Life of this patent
Estimating the term…
Abstract
Techniques for detecting and responding to attacks on computer and network systems including denial-of-service (DoS) attacks. A packet is classified as potentially being an attack packet if it matches an access control list (ACL) specifying one or more conditions. One or more actions may be performed responsive to packets identified as potential attack packets. These actions may include dropping packets identified as potential attack packets for a period of time, rate limiting a port over which the potential attack packets are received for a period of time, and other actions.
Claims20
A method comprising:
- identifying, by a system, an access control list from a set of access control lists;
- determining, by the system, a first threshold data rate associated with the identified access control list;
- determining if a rate of receipt, by the system of packets that match the access control list exceeds the first threshold data rate;
- in response to determining that the rate of receipt exceeds the first threshold data rate, rate-limiting a port, on which packets that match the access control list are received, to a preconfigured data rate for a preconfigured period of time;
- and
- after rate-limiting, for the preconfigured period of time, the port on which the packets that match the access control list are received, allowing packets that match the access control list to be processed through the port at a full data rate that exceeds the preconfigured data rate.
A system comprising:
- a memory configurable to store a set of access control lists;
- and
- a prevention module configurable to:
- identify an access control list from the set of access control lists;
- determine a first threshold data rate associated with the identified access control list;
- determine if a rate of receipt, by the system, of packets that match the access control list exceeds the first threshold data rate;
- in response to determining that the rate of receipt exceeds the first threshold data rate, rate-limit a port, on which packets that match the access control list are received, to a preconfigured data rate for a preconfigured period of time;
- and
- after rate-limiting, for the preconfigured period of time, the port on which the packets that match the access control list are received, allowing packets that match the access control list to be processed through the port at a full data rate that exceeds the preconfigured data rate.
A router comprising:
- an input port;
- a content addressable memory (CAM) configurable to store a set of access control lists;
- and
- a prevention module configurable to:
- for a packet received via the input port, perform a lookup in the CAM to identify an access control list from the set of access control lists;
- determine a first threshold data rate associated with the identified access control list;
- determine if a rate of receipt, by the system, of packets that match the access control list exceeds the first threshold data rate;
- upon in response to determining that the rate of receipt exceeds the first threshold data rate but does not exceed the second threshold data rate, rate-limit the input port rate at which packets that match the access control list are received over the input port to a preconfigured data rate for a preconfigured period of time;
- and
- after rate-limiting the input port for the preconfigured period of time, allowing packets that match the access control list to be processed through the input port at a full data rate that exceeds the preconfigured data rate.
Dependencies are inferred from the claim text.