Method for minimizing denial of service attacks on network servers
View Patent ↗A method for providing communications network security can include receiving a round-trip network latency for a client specifying an open port duration. A port can be opened to receive a request from the client. The port can be closed when an amount of time at least as great as the open port duration has passed since the opening of the port.
1. A method of providing communications network security on a server, comprising:
prior to initiating a communications session between a client and said server, securely communicating to said client an address of an initial port of said server available for initial client-server synchronization and an open port duration for said initial port;
sending an acknowledgement from said server to said client in response to a client request received at said initial port, the acknowledgement containing a random seed to generate a random port address based upon a random pattern generator shared by said server and said client;
determining a dynamically-variable open port duration based upon a computed round-trip latency between said client and said server, and sending said open port duration to said server at said initial port;
closing said initial port and opening a second port of said server corresponding to said random port address; and
if a session is not complete when said open port duration elapses, closing said second port and opening another port at another randomly generated port address.
2. The method of claim 1 , further comprising:
scaling said open port duration by a predetermined value.
3. The method of claim 1 , wherein said round-trip latency specifies a time said client sends a request and a time said client receives a response to said request from said server.
4. The method of claim 1 , further comprising:
replacing said open port duration with a second open port duration.
5. The method of claim 1 , further comprising:
determining an updated open port duration from a subsequent round-trip latency; and
providing said updated open port duration to said client to synchronize said client and said server.
6. The method of claim 5 , further comprising:
scaling said updated open port duration by a predetermined value.
7. A method of providing communications network security, comprising:
prior to initiating a communications session between a client and said server, securely communicating to said client an address of an initial port of said server available for initial client-server synchronization and an open port duration for said initial port;
determining a dynamically-variable open port duration based upon a computed one-way latency between said client and said server;
opening said initial port of said server corresponding to said initial port address;
sending an acknowledgement from said server to said client, the acknowledgement containing a random seed to generate a random port address based upon a random pattern generator shared by said server and said client; and
closing said initial port and opening a second port of said server corresponding to said random port address.
8. The method of claim 7 , further comprising:
scaling said open port duration by a predetermined value.
9. The method of claim 7 , said step of determining an open port duration using a one-way latency comprising:
receiving from a client a packet that is time stamped with a send time;
noting a receive time when said packet is received; and
calculating a difference between said send time and said receive time.
10. The method of claim 7 , further comprising the step:
replacing said open port duration with a second open port duration.
11. The method of claim 7 , further comprising:
determining an updated open port duration from a subsequent one-way latency; and
providing said updated open port duration to said client to synchronize said client and said server.
12. The method of claim 11 , further comprising:
scaling said updated open port duration by a predetermined value.