Dong Lin

US Patent:

7219228, May 15, 2007

Filed:

Sep 29, 2003

Appl. No.:

10/674208

Inventors:

Dong Lin - Fort Lee NJ, US

Assignee:

Lucent Technologies Inc. - Murray Hill NJ

International Classification:

G06F 9/00

US Classification:

713160, 713161, 713165, 713166

Abstract:

A SYN packet bandwidth Distributed Denial-of-Service (DDoS) attack is defended against by intercepting and identifying SYN packets in a “DDoS gateway” advantageously positioned at the edge of the network to be protected (e. g. , one hop upstream from the protected link), and by queuing these intercepted SYN packets in a separate queue from other TCP packet queues. Edge per-flow queuing is employed to provide isolation among individual TCP connections sharing the link. A fair scheduling algorithm such as round robin scheduling is used to ensure that SYN packets (such as those generated as part of a SYN bandwidth attack) cannot overwhelm the egress link in the presence of other TCP packets.

US Patent:

7404210, Jul 22, 2008

Filed:

Sep 23, 2003

Appl. No.:

10/668952

Inventors:

Dong Lin - Fort Lee NJ, US

Assignee:

Lucent Technologies Inc. - Murray Hill NJ

International Classification:

G06F 11/00

US Classification:

726 22, 370392, 713188

Abstract:

A Distributed Denial-of-Service (DDoS) attack by a TCP stateless hog is defeated with use of an enhancement to the keep-alive mechanism provided by RFC 1122. A TCP server receives a new TCP connection request from a possible attacker and sends a keep-alive probe packet back thereto using an “invalid” sequence number. Illustratively, this “invalid” sequence number comprises a random number selected to be reasonably distant from the actual current sequence number. When a responsive packet is received from the potential attacker, the TCP server verifies the accuracy of the acknowledgement number in the received packet, thereby determining whether the potential attacker may be a TCP stateless hog.