Protection against rule map update attacks

A method to manage replacement of routing rules that are usable by a network device, the method comprising:

• determining a number of active rule replacements for the network device within a time window, wherein the network device is configured to route packets within a network according to active rules stored within a memory of the network device;
• determining that the number of active rule replacements within the time window exceeds a threshold;
• denying a request to replace one or more of the active rules stored within the memory of the network device for a period of time until the network device is determined to be capable to process the request to replace the one or more of the active rules;
• storing data related to a payment-based service level for the network device, wherein the threshold is based at least on the payment-based service level for the network device;
• and
• determining whether to confirm, deny, or delay replacement of the one or more of the active rules in response to the request based at least on the threshold, the time window, and the payment-based service level for the network device.

A method to manage replacement of routing rules that are usable by a network device, the method comprising:

• determining a number of active rule replacements for the network device within a time window, wherein the network device is configured to route packets within a network according to active rules stored within a memory of the network device;
• determining that the number of active rule replacements within the time window exceeds a threshold;
• denying a request to replace one or more of the active rules stored within the memory of the network device for a period of time until the network device is determined to be capable to process the request to replace the one or more of the active rules;
• counting a respective number of active rule replacements within the time window for each of a plurality of users of the network device;
• and
• in response to a determination that the number of active rule replacements within the time window exceeds the threshold for a user of the plurality of users, denying a request to replace the one or more of the active rules stored within the memory of the network device for that user for at least a period of time,
• wherein the threshold includes a maximum number of active rule replacements by the user within the time window.

A method to manage replacement of routing rules usable by a network device, the method comprising:

• determining a number of active rule replacements for the network device within a time window, wherein the network device is configured to route packets within a network according to active rules stored within a memory of the network device;
• determining that the number of active rule replacements within the time window exceeds a threshold;
• denying a request to replace one or more of the active rules stored within the memory of the network device for a period of time until the network device is determined to be capable to process the request to replace the one or more of the active rules;
• counting the number of active rule replacements for the network device within the time window for a plurality of users of the network device;
• and
• in response to a determination that the number of active rule replacements within the time window exceeds the threshold, denying a request to replace the one or more of the active rules stored within the memory of the network device for at least a period of time,
• wherein the threshold includes a maximum number of active rule replacements by all users of the plurality of users within the time window relative to a number of the active rules.

A system, comprising:

• a network device configured to route packets within a network based at least, in part, on active rules stored within a memory of the network device;
• a monitor device coupled to the network device, wherein the monitor device is configured to:
• determine a number of active rule replacements for the network device within a time window;
• determine that the number of active rule replacements within the time window exceeds a threshold;
• and
• deny a request to replace one or more of the active rules stored within the memory of the network device for a period of time until the network device is determined to be capable to process the request to replace the one or more of the active rules;
• a ditherer configured to adjust the time window;
• a quality of service (QoS) purchase data storage configured to store data of payment-based service levels for respective users of the network device;
• and
• a command changer, coupled to the ditherer, the QoS purchase data storage, and a plurality of counters, wherein the command changer is configured to:
• change a rule update command based at least on a current time window, a service level for a current user, and a value of a counter associated with the current user.

A non-transitory computer-readable medium that includes computer-executable instructions which, in response to execution by a computing device, cause the computing device to perform or control performance of operations comprising:

• identify a request to replace one or more active rules in a network device with one or more stored rules, wherein each of the one or more active rules and each of the one or more stored rules provide a routing rule that specifies how to route packets within a network, and wherein the one or more stored rules are not actively being used by the network device to route the packets;
• determine a number of active rule replacements for the network device within a time window;
• dither the time window;
• determine that the number of the active rule replacements exceeds a threshold;
• and
• deny the request to replace the one or more active rules in the network device for a period of time until the network device is determined to be capable to process the request to replace the one or more active rules.