Method and apparatus for security management in a networked environment
View Patent ↗In a networked environment, where multiple Internet Service Providers and multi-vendor equipment are involved in e-Business services and applications offering, the risk of overloading the Internet devices are real and security management is a challenge. Internet device traffic overloads could result from spoof attacks, (Denial-of-Service (DoS) or Distributed DoS (DDoS) attacks), device failures, special events, or widespread loads above engineered levels. To solve the problem of Internet security management for integrated optical and wireless devices, a new apparatus and functions running on IP devices are defined in this invention. Each Internet device includes counters and thresholding feature to manage the security attacks and prevent failure of the device being attacked.
1. A device for communicating with a network, the device storing content accessible by other devices communicating with the network, the device including:
a first counter associated with a first content identifier, the first content identifier associated with a first type of content used to adversely affecting the performance of the device;
a first threshold value associated with the first counter;
a second counter associated with a second content identifier, the second content identifier being associated with a second type of content, the second type of content being general content, and a request for the general content being a legitimate request;
a second threshold value associated with the second counter, wherein the second threshold is determined by monitoring traffic to identify an expected number of legitimate requests for the general content, and wherein the second threshold value is higher than the expected number of requests;
means for incrementing the first counter in response to receipt of a threatening request including the first content identifier and for incrementing the second counter in response to receipt of a legitimate request including the second content identifier;
means for discarding the threatening request in response to the value of the first counter exceeding the first threshold value; and
means for discarding the legitimate request in response to the value of the second counter exceeding the second threshold value.
2. The device of claim 1 , wherein the first threshold value and second threshold value are different.
3. The device of claim 1 , further comprising a threshold indicator flag for each of the first and second threshold values, for indicating when the respective count has exceeded the associated threshold value.
4. The device of claim 1 , wherein the device is a wireless device.
5. The device of claim 1 , wherein the device is an IP device.
6. The device of claim 1 , wherein the content is e-business content.
7. A method for preventing traffic congestion at a device communicating with a network, the method comprising the steps of:
monitoring requests for content at the device, the requests including threatening requests for a first type of content used to adversely affecting the performance of the device and legitimate requests for a second type of content comprising general content;
for each request,
incrementing a counter associated with a content identifier of the each request;
discarding requests for the content when the counter associated with the content identifier exceeds a pre-determined value, wherein the predetermined value is related to whether the content identifier is associated with a first type of content or a second type of content and is determined by monitoring traffic at the device for an expected number of requests for the content and wherein the predetermined value is greater than the expected number of requests.
8. A network comprising:
at least two devices, communicating with each other via the network, each of the devices storing a plurality of content accessible by the other device each content of the plurality of content referenced by a content identifier associated with a type of the content, at least one of the devices including:
a counter associated with the content identifier and a threshold value associated with the content identifier, wherein the threshold value is determined by monitoring traffic in the network to identify an expected number of requests for the content, and wherein the threshold exceeds the expected number of requests;
means for incrementing the counter associated with the content in response to a request for the content that includes the content identifier; and
means for discarding requests to the content in response to a value of the counter exceeding the threshold and the content being used to adversely affect the performance of the device.
9. The network of claim 8 , wherein the network is an integrated optical and wireless network.
10. The network of claim 8 , further including means for re-directing the request to another one of the at least two devices in the network, and wherein the at least two devices are load-sharing devices.