Back to results
US 9,755,943 B2Granted
Location based technique for detecting devices employing multiple addresses
AssigneeCisco Technology, Inc.
InventorsMark Krischer, Tom Koenig, Nancy Cam-Winget
Life of this patent
Estimating the term…
Abstract
In an example embodiment, there is described herein a location based detection technique that determines whether multiple requests from different addresses, such as a Layer 2 MAC (Media Access Control) address and/or layer 3 IP (Internet Protocol) address are being sent form a single device. In particular embodiments, if the device sends more than a predefined threshold number of requests, those requests can be ignored and/or denied.
Claims21
A non-transitory computer-readable medium containing a program to mitigate impact of resource starvation attacks, the program executable to perform an operation comprising:
- responsive to receiving, from a first device having a first media access control (MAC) address, a first Internet Protocol (IP) address assignment request specifying to assign the first device a first IP address previously offered to the first device, assigning the first IP address to the first device, wherein the first IP address is removed from a pool of available IP addresses when assigned to the first device;
- receiving, from a second device having a second MAC address different from the first MAC address, a second IP address assignment request specifying to assign the second device a second IP address previously offered to the second device;
- analyzing location data of the first and second devices based on a predefined positioning scheme and in order to determine a measure of geographical proximity of the first and second devices;
- upon determining, based on the measure of geographical proximity, that the first and second devices are suggestive of being a single device notwithstanding the first and second MAC addresses being different MAC addresses, identifying the first and second IP address assignment requests as a resource starvation attack, by operation of one or more computer processors when executing the program;
- and
- performing one or more corrective actions in order to mitigate impact of the resource starvation attack, the one or more corrective actions including capping an aggregate bandwidth consumed using the first and second IP addresses.
3 more elements
An apparatus to mitigate impact of resource starvation attacks, the apparatus comprising:
- one or more computer processors;
- an interface;
- detection logic operably connected with the interface and operable by the one or more computer processors to perform an operation comprising:
- responsive to receiving, via the interface and from a first device having a first media access control (MAC) address, a first Internet Protocol (IP) address assignment request specifying to assign the first device a first IP address previously offered to the first device, assigning the first IP address to the first device, wherein the first IP address is removed from a pool of available IP addresses when assigned to the first device;
- receiving, via the interface and from a second device having a second MAC address different from the first MAC address, a second IP address assignment request specifying to assign the second device a second IP address previously offered to the second device;
- analyzing location data of the first and second devices based on a predefined positioning scheme and in order to determine a measure of geographical proximity of the first and second devices;
- upon determining, based on the measure of geographical proximity, that the first and second devices are suggestive of being a single device notwithstanding the first and second MAC addresses being different MAC addresses, identifying the first and second IP address assignment requests as a resource starvation attack by the single device;
- and
- performing one or more corrective actions in order to mitigate impact of the resource starvation attack, the one or more corrective actions including capping an aggregate bandwidth consumed using the first and second IP addresses.
6 more elements
A computer-implemented method to mitigate impact of resource starvation attacks, the computer-implemented method comprising:
- responsive to receiving, from a first device having a first media access control (MAC) address, a first Internet Protocol (IP) address assignment request specifying to assigning the first device a first IP address previously offered to the first device, assigning the first IP address to the first device, wherein the first IP address is removed from a pool of available IP addresses when assigned to the first device;
- receiving, from a second device having a second MAC address different from the first MAC address, a second IP address assignment request specifying to assign the second device a second IP address previously offered to the second device;
- analyzing location data of the first and second devices based on a predefined positioning scheme and in order to determine a measure of geographical proximity of the first and second devices;
- upon determining, based on the measure of geographical proximity, that the first and second devices are suggestive of being a single device notwithstanding the first and second MAC addresses being different MAC addresses, identifying the first and second IP address assignment requests as a resource starvation attack, by operation of one or more computer processors;
- and
- performing one or more corrective actions in order to mitigate impact of the resource starvation attack, the one or more corrective actions including capping an aggregate bandwidth consumed using the first and second IP addresses.
3 more elements
Dependencies are inferred from the claim text.