System and method for protecting a computer network against denial of service attacks

1. A method for determining whether a sender seeking to send a message to a receiving computer system via a network is an authorized sender, comprising:

receiving from the sender a request to communicate;

selecting a number N 1 ;

calculating a hash value for the number N 1 using a predetermined cryptographic hash function;

sending the hash value to the sender;

receiving from the sender a second number N 2 ;

calculating a hash value for the number N 2 using the predetermined cryptographic hash function;

comparing the hash value for the number N 1 with the hash value for the number N 2 ; and

processing a message received from the sender if at least a prescribed nonzero number of bits of the hash value for the number N 1 match the corresponding bits of the hash value for the number N 2 ;

wherein the number N 2 is determined by an authorized sender by using the predetermined cryptographic hash function to search for a number (N 2 ) such that at least the prescribed nonzero number of bits of the hash value for the number N 2 match the corresponding bits of the hash value for the number N 1 .

2. The method of claim 1 , wherein the hash values are each Y bits long and the requirement that at least a prescribed nonzero number of bits of the hash value for the number N 1 match the corresponding bits of the hash value for the number N 2 is considered to be satisfied if the first X bits of the hash value for number N 1 are the same as the first X bits of the hash value for number N 2 .

3. The method of claim 1 , further comprising not processing a message from the sender it is not the case that at least a prescribed nonzero number of bits of the hash value for the number N 1 match the corresponding bits of the hash value for the number N 2 .

4. The method of claim 1 , wherein the number N 1 is a random number.

5. The method of claim 1 , wherein the number N 1 is a random number generated by a pseudo random number generator.

6. The method of claim 1 , wherein the cryptographic hash function is the Secure Hash Algorithm (SHA-1).

7. The method of claim 1 , further comprising the sender finding the second number N 2 .

8. A method for determining whether a sender seeking to send a message to a receiving computer system via a network is an authorized sender, comprising:

receiving from the sender a request to communicate, the request to communicate comprising a number N and a timestamp T;

calculating a hash value for the number N and a hash value for the timestamp T using a predetermined cryptographic hash function; and

determining whether at least a prescribed nonzero number of bits of the hash value for the number N match the corresponding bits of the hash value for the timestamp T;

wherein the number N is determined by an authorized sender by using the predetermined cryptographic hash function to search for a number (N) such that at least a prescribed nonzero number of bits of the hash value for the number N match the corresponding bits of the hash value for the timestamp T.

9. The method of claim 8 , further comprising processing a message received from the sender if at least a prescribed nonzero number of bits of the hash value for the number N matches the corresponding bits of the hash value for the timestamp T.

10. The method of claim 8 , further comprising determining whether the timestamp T is within a prescribed interval of the current time.

11. The method of claim 8 , further comprising ignoring a message received from the sender if the timestamp T is not within a prescribed interval of the current time.

12. The method of claim 8 , further comprising determining whether the number N has been used in any prior request to communicate.

13. The method of claim 12 , further comprising ignoring a message received from the sender if the number N has been used in any prior request to communicate.

14. A system for determining whether a sender seeking to send a message to a receiving computer system via a network is an authorized sender, comprising:

a computer associated with the network configured to:

receive from the sender a request to communicate;

select a number N 1 ;

calculate a hash value for the number N 1 using a pre-determined cryptographic hash function;

send the hash value calculated for the number N 1 to the sender;

receive from the sender a second number N 2 ;

calculate a hash value for the number N 2 using the pre-determined cryptographic hash function;

compare the hash value for the number N 1 with the hash value for the number N 2 ; and

process a message received from the sender if at least a prescribed nonzero number of bits of the hash value for the number N 1 match the corresponding bits of the hash value for the number N 2 ;

wherein the number N 2 is determined by an authorized sender by using the predetermined cryptographic hash function to search for a number (N 2 ) such that at least the prescribed nonzero number of bits of the hash value for the number N 2 match the corresponding bits of the hash value for the number N 1 .

15. A computer program product for determining whether a sender seeking to send a message to a receiving computer system via a network is an authorized sender, the computer program product being embodied in a computer readable medium and comprising computer instructions for:

receiving from the sender a request to communicate;

selecting a number N 1 ;

calculating a hash value for the number N 1 using a predetermined cryptographic hash function;

sending the hash value to the sender;

receiving from the sender a second number N 2 ;

calculating a hash value for the number N 2 using the predetermined cryptographic hash function;

comparing the hash value for the number N 1 with the hash value for the number N 2 ; and

processing a message received from the sender if at least a prescribed nonzero number of bits of the hash value for the number N 1 match the corresponding bits of the hash value for the number N 2 ;

wherein the number N 2 is determined by an authorized sender by using the predetermined cryptographic hash function to search for a number (N 2 ) such that at least the prescribed nonzero number of bits of the hash value for the number N 2 match the corresponding bits of the hash value for the number N 1 .