Method for distributed denial-of-service attack mitigation by selective black-holing in MPLS VPNS
A system and method for aiding the handling of DDoS attacks in which VPN traffic entering an ISP network at some points will be black-holed, while VPN traffic entering the ISP network at other points will be routed, as it should be, to the system-under-attack. Thus, the system-under-attack is made available to some of the user community and made unavailable to suspect portions of the user community. Furthermore, the number of entry points where black-holing of VPN traffic occurs can be selected and changed in real-time during a DDoS attack.
1. An internet service provider virtual private network comprising:
a plurality of edge routers;
a plurality of core routers for allowing communication between the plurality of edge routers;
a virtual private network application in communication with the plurality of edge routers, the virtual private network application having a first internet protocol address; and
a black-hole router in communication with the plurality of core routers, wherein virtual private network traffic received by the black-hole router is black-holed, the black-hole router for injecting a second internet protocol address into the internet service provider virtual private network, the second internet protocol address comprising:
a same internet protocol address as the first internet protocol address;
a higher preference value than the first internet protocol address; and
a community value such that when the second internet protocol address is injected, a selected first number of edge routers of the plurality of edge routers directs virtual private network traffic addressed for the first internet protocol address to the virtual private network application and a selected second number of edge routers of the plurality of edge routers directs virtual private network traffic addressed for the second internet protocol address to the black-hole router.
2. The internet service provider virtual private network of claim 1 , wherein the internet service provider virtual private network is a multiprotocol label switching virtual private network.
3. The internet service provider virtual private network of claim 1 , wherein the black-hole router injects the second internet protocol address in response to a distributed denial of service attack on the virtual private network application.
4. The internet service provider virtual private network of claim 1 , wherein the community value is changed by the black-hole router.
5. The internet service provider virtual private network of claim 1 , wherein the internet service provider virtual private network utilizes a plurality of dynamic routing protocols in combination with a community-based route filtering to propagate the injected second internet protocol address to the plurality of edge routers.
6. The internet service provider virtual private network of claim 1 wherein when the selected second number of edge routers directs virtual private network traffic, addressed for the first internet protocol address, to the black-hole router, the black-hole router is for receiving such virtual private network traffic as black-holed-traffic, the black-hole router for analyzing the black-holed traffic in order to determine a ratio of attack traffic to legitimate traffic.
7. The internet service provider virtual private network of claim 1 , further comprising a route reflector, the route reflector being connected to a different set of edge routers from the plurality of edge routers, the route reflector for updating the plurality of edge routers with route instructions, such route instructions including the injected second internet protocol address.
8. An internet service provider network comprising:
a plurality of edge routers;
an application in communication with the plurality of edge routers;
the application having a first internet protocol address such that virtual private network traffic addressed for the first internet protocol address and entering the internet service provider network at any one of the plurality of edge routers, is routed to the application;
a black-hole router, wherein virtual private network traffic received by the black-hole router is black-holed; and
a router for injecting an instruction into the internet service provider network, such that a select edge router of the plurality of edge routers redirects virtual private network traffic, which is addressed to the first internet protocol address, to the black-hole router, wherein the instruction that is injected comprises a routing instruction having a same internet protocol address as the first internet protocol address, but with a higher preference value than the first internet protocol address and having a community value such that when the routing instruction is injected, a selected first number of edge routers of the plurality of edge routers directs virtual private network traffic addressed for the first internet protocol address to the application.
9. The internet service provider network of claim 8 , wherein the internet service provider network is a multiprotocol label switching virtual private network.
10. The internet service provider network of claim 8 , wherein the router and the black-hole router are the same device.
11. The internet service provider network of claim 8 , wherein the routing instruction is a border gateway protocol routing instruction.
12. The internet service provider network of claim 8 , wherein the black-hole router is for receiving redirected traffic from the select edge router and to determine a ratio of attack virtual private network traffic to legitimate virtual private network traffic found in the redirected traffic.
13. The internet service provider network of claim 8 , wherein the router injects the routing instruction when the application is experiencing a distributed denial of service attack.
14. A method of managing a distributed denial of service attack on an application within an internet service provider network, the application having a first internet protocol address, the method comprising:
injecting a border gateway protocol routing instruction into the internet service provider network when the distributed denial of service attack is occurring, the border gateway protocol routing instruction comprising a second internet protocol address having a same internet protocol address as the first internet protocol address, but with a higher preference value than the first internet protocol address and having a community value;
redirecting, at a selected edge router, virtual private network traffic addressed for the second internet protocol address to a black-hole router, wherein the virtual private network traffic received by the black-hole router is black-holed; and
directing, at another edge router, virtual private network traffic addressed for the first internet protocol address to the application that is experiencing the distributed denial of service attack.
15. The method of claim 14 , wherein the internet service provider network is a multiprotocol label switching virtual private network.
16. The method of claim 14 , further comprising:
receiving, at the black-hole router, the redirected virtual private network traffic; and
determining an amount of attack traffic.
17. The method of claim 14 , further comprising changing, a number of selected edge routers that is redirected.
18. The method of claim 14 , wherein the injecting the border gateway protocol routing instruction into the internet service provider network is done by providing the border gateway protocol routing instruction to a route-reflector for disseminating the border gateway protocol routing instruction to other route reflectors within the internet service provider network.