Method and apparatus for protecting electronic commerce from distributed denial-of-service attacks
View Patent ↗An Internet Service Provider (ISP), in consideration of being remunerated in some manner by an e-merchant, carries the packets of a designated subset of that e-merchant's clients, designated as VIPs, in a privileged class of service as compared to an unprivileged class of service that is used to carry the packets of the e-merchant's other regular clients. In this way, the adverse effects on performance due to congestion in the unprivileged class of service, whether due to an ongoing denial-of-service attack or not, will not affect the performance of packets sent by and to VIPs using the privileged class of service. An e-merchant may select its VIPs from among those clients that bring in a majority of the e-merchant's revenues. An e-merchant turns a regular client into a VIP by granting it a VIP right. VIP gates, preferable implemented in an ISP's access gateways, monitor the packets sent by clients and mark for the privileged class of service those packets whose source has an active VIP right issued by the packet's destination.
1. A method of limiting the effect upon certain users that access an e-merchant's server from a denial-of-service attack against the e-merchant's server, the method comprising:
marking a packet addressed to the e-merchant's server for forwarding in a privileged class of service when the source of the packet is a computer whose user is a VIP user who has been designated by the e-merchant as being within a predetermined subset of users who transact business online with the e-merchant through the e-merchant's server, where a determination that the computer's user is a VIP user is made through the VIP user's activation of a VIP right that was granted to the VIP user by the e-merchant and the attachment of that VIP right to the VIP user's computer, the VIP right granted by the e-merchant to the VIP user automatically expiring at the end of a specified term and/or after a specified maximum number of packets or bytes have been forwarded to the e-merchant's server by the VIP user's computer client-in the privileged class of service.
2. The method of claim 1 further comprising:
marking a packet addressed to the e-merchant's server for forwarding in an unprivileged class of service when the source of the packet is a computer whose user has not been designated as a VIP user by the e-merchant, is a VIP user whose VIP right has either expired or has previously forwarded the specified maximum number of packets or bytes to the e-merchant's server in the privileged class of service, or is a VIP user who has not activated and attached his VIP right to his computer.
3. The method of claim 1 wherein the VIP user can dynamically activate or deactivate a VIP right granted to it by the e-merchant such that packets originating from the VIP user's computer and addressed to the e-merchant's server are marked for forwarding in the privileged class of service only when the respective VIP right is unexpired and has been activated, and are marked for forwarding in the unprivileged class of service otherwise.
4. Apparatus for limiting the effect upon certain users that access an e-merchant's server from a denial-of-service attack against the e-merchant's server comprising:
means for storing a VIP right for at least one user who has been designated by the e-merchant as a VIP user who is within a predetermined subset of users that transact business online with the e-merchant through the e-merchant's server, the VIP right being granted individually by the e-merchant to the at least one VIP user and having a specified term and/or specified packet or byte usage limits; and
a computer program or application that performs a method of marking a packet addressed to the e-merchant's server for forwarding in a privileged class of service when the source of the packet is a computer whose user has been designated as a VIP user by the e-merchant, where a determination that the computer's user is a VIP user is made through the VIP user's activation of the VIP right and the attachment of that VIP right to the VIP user's computer, and the specified term of the VIP right granted to that user that is stored in the storing means has neither expired nor have the number of packets or bytes that have been already forwarded from that client to the e-merchant's server in the privileged class of service exceeded the specified packet or byte usage limits of that user's VIP right.
5. The apparatus of claim 4 wherein the computer program or application further marks a packet addressed to the e-merchant's server for forwarding in an unprivileged class when the source of the packet is a computer whose user has not been designated as a VIP user by the e-merchant, is a VIP user whose VIP right has either expired or has previously forwarded the specified maximum number of packets or bytes to the e-merchant in the privileged class of service, or is a VIP user who has not activated and attached his VIP right to his computer.
6. The apparatus of claim 5 wherein the computer program marks a packet addressed to the e-merchant's server for forwarding in the privileged class of service only when the source of the packet is a computer whose user is an active VIP user of the e-merchant, and marks a packet for forwarding a packet addressed to the e-merchant's server in the unprivileged class of service if the source of the packet is a computer whose user is an inactive VIP user of the e-merchant.