Methods and apparatus for detecting and/or dealing with denial of service attacks
Methods and apparatus for detecting and minimizing the effects of Denial Of Service (DOS) attacks in high-speed networks in which packet processing is carried out by multiple processing cores. In one embodiment of the invention a communications method and apparatus detects and deletes denial of service attack packets in a multi-core distributed packet processing system using a lightweight DOS attack packet detection and deletion process.
1. A semiconductor chip comprising:
receiver circuitry that receives a plurality of packets;
a plurality of packet processing cores;
packet value generation circuitry that generates for each received packet of the plurality of received packets, a packet value from packet header information included in the received packet to which the generated value corresponds, said generated packet value having fewer bits than said packet header information from which it is generated, said generated packet value being a hash value or CRC value generated from packet header information that uniquely identifies a packet flow and a source of the packet flow to which the packet belongs;
time stamp generation circuitry that generates for each received packet of the plurality of received packets, a time value corresponding to the time the packet was received by the receiver circuitry;
a memory for storing the generated packet values and generated time values corresponding to each received packet of the plurality of received packets;
congestion monitoring circuitry that determines a level of packet processing congestion;
a processor configured to control denial of service protection circuitry to switch between operating in a normal mode of operation or a congestion mode of operation based on the level of packet processing congestion determined by said congestion monitoring circuitry, wherein operating in said normal mode of operation includes passing received packets to a first packet processing core of the plurality of packet processing cores without regard to said packet value generated from the packets being passed and wherein operating in said congestion mode of operation is performed when said monitoring indicates a level of packet processing congestion over a threshold, said operating in said congestion mode of operation including dropping received packets based on both: (i) the packet value generated from the packets to be dropped matching at least one previously generated packet value stored in said memory and (ii) the packets to be dropped generated received time value, said processor controlling said denial of service protection circuitry to operate in said normal mode of operation when it is not operating in said congestion mode of operation; and
wherein the threshold is based upon a depth of an input packet queue to the denial of service protection circuitry or a depth of an input packet queue to one or more of said plurality of packet processing cores, said plurality of packet processing cores being downstream from said denial of service protection circuitry.
2. The semiconductor chip of claim 1 , wherein said processor is configured to switch said denial of service protection circuitry from said normal mode of operation to said congestion mode of operation in response to said monitoring circuitry detecting a level of congestion over the threshold.
3. The semiconductor chip of claim 2 , wherein the first packet processing core performs packet policing or packet classification.
4. The semiconductor chip of claim 2 , wherein the threshold is a data flow rate of packets over a predetermined limit.
5. The semiconductor chip of claim 4 , wherein the predetermined limit is a function of a packet processing speed of the first packet processing core.
6. The semiconductor chip of claim 5 , wherein said processor is further configured to control the denial of service protection circuitry, while operating in the congestion mode of operation, to perform the steps of:
receiving a first additional packet;
determining if a packet value corresponding to the first additional received packet is stored more than a threshold number of times in said memory during a predetermined time interval; and
dropping the first additional received packet when it is determined that the packet value corresponding to the first additional received packet is stored more than said threshold number of times in said memory during the predetermined time interval.
7. The semiconductor chip of claim 6 , further comprising:
packet drop list maintenance circuitry that adds the packet value corresponding to the first additional received packet to a packet drop list when it is determined that said packet value corresponding to the first additional received packet is included more than said threshold number of times in said memory within said predetermined time interval.
8. The semiconductor chip of claim 7 , wherein said processor is further configured to control the denial of service protection circuitry, while operating in said congestion mode of operation, to:
receive a second additional packet;
drop said second additional packet if a packet value corresponding to the second additional packet is on said drop list;
check, if said packet value corresponding to the second additional packet is not on said drop list, if said packet value corresponding to the second additional packet appears more than said threshold number of times in said memory during said predetermined time interval;
drop said second additional packet if said packet value corresponding to the second additional packet appears more than said threshold number of times in said memory during said predetermined time interval; and
otherwise pass said second additional packet.
9. The semiconductor chip of claim 8 , wherein passing said second additional packet includes passing said second additional packet to a packet policer with a packet flow classification based on Internet Protocol and UDP header information or Internet Protocol and TCP header information of said second additional packet.
10. The semiconductor chip of claim 9 , wherein the packet policer applies a bandwidth constraint to a flow to which said second additional packet corresponds but which does not block the flow entirely.
11. The semiconductor chip of claim 8 , wherein passing the second additional packet includes passing the second additional packet to a packet policer with a packet flow classification based on the payload of said second additional packet.
12. The semiconductor chip of claim 8 , further comprising:
history buffer maintenance circuitry that deletes packet values from said memory which have corresponding time values which are more than a predetermined amount of time from a current time.
13. The semiconductor chip of claim 12 , wherein said drop list maintenance circuitry deletes the packet values in said drop list in response to a change from said congestion mode of operation to said normal mode of operation.
14. The semiconductor chip of claim 1 , further comprising memory access control circuitry that stores said packet values and said time values in said memory in a circular buffer.
15. The semiconductor chip of claim 1 , wherein said congestion monitoring circuitry is included in said denial of service protection circuitry and determines a level of packet processing congestion at the denial of service protection circuitry or is included in a packet policer downstream of said denial of service protection circuitry and determines a level of packet processing congestion at the packet policer.
16. A session border controller device comprising:
receiver circuitry that receives a plurality of packets;
a plurality of packet processing cores;
packet value generation circuitry that generates for each received packet of the plurality of received packets, a packet value from packet header information included in the received packet to which the generated value corresponds, said generated packet value having fewer bits than said packet header information from which it is generated, said generated packet value being a hash value or CRC value generated from packet header information that uniquely identifies a packet flow and a source of the packet flow to which the packet belongs;
time stamp generation circuitry that generates for each received packet of the plurality of received packets, a time value corresponding to the time the packet was received by the receiver circuitry;
a memory for storing the generated packet values and generated time values corresponding to each received packet of the plurality of received packets;
congestion monitoring circuitry that determines a level of packet processing congestion;
a processor configured to control denial of service protection circuitry to switch between operating in a normal mode of operation or a congestion mode of operation based on the level of packet processing congestion determined by said congestion monitoring circuitry, wherein operating in said normal mode of operation includes passing received packets to a first packet processing core of the plurality of packet processing cores without regard to said packet value generated from the packets being passed and wherein operating in said congestion mode of operation is performed when said monitoring indicates a level of packet processing congestion over a threshold, said operating in said congestion mode of operation including dropping received packets based on both: (i) the packet value generated from the packets to be dropped matching at least one previously generated packet value stored in said memory and (ii) the packets to be dropped generated received time value, said processor controlling said denial of service protection circuitry to operate in said normal mode of operation when it is not operating in said congestion mode of operation; and
wherein the threshold is based upon a depth of an input packet queue to the denial of service protection circuitry or a depth of an input packet queue to one or more of said plurality of packet processing cores, said plurality of packet processing cores being downstream from said denial of service protection circuitry.
17. The Session Border Controller of claim 16 , wherein the first packet processing core performs packet policing or packet classification.
18. The Session Border Controller of claim 16 , wherein the threshold is a data flow rate of packets over a predetermined limit.
19. A method of operating a semiconductor chip comprising:
receiving a plurality of packets at receiver circuitry of the semiconductor chip;
generating by the semiconductor chip for each received packet of the plurality of received packets, a packet value from packet header information included in the received packet to which the generated value corresponds, said generated packet value having fewer bits than said packet header information from which it is generated, said generated packet value being a hash value or CRC value generated from packet header information that uniquely identifies a packet flow and a source of the packet flow to which the packet belongs;
generating, by time stamp generation circuitry of the semiconductor chip, for each received packet of the plurality of received packets, a time value corresponding to the time the packet was received by the receiver circuitry;
storing in memory the generated packet values and generated time values corresponding to each received packet of the plurality of received packets;
determining by the semiconductor chip a level of packet processing congestion;
operating the semiconductor chip in a normal mode of operation or a congestion mode of operation based on the level of packet processing congestion determined by said semiconductor chip, wherein operating in said normal mode of operation includes passing received packets to a first packet processing core of the plurality of packet processing cores without regard to said packet value generated from the packets being passed and wherein operating in said congestion mode of operation is performed when said monitoring indicates a level of packet processing congestion over a threshold, said operating in said congestion mode of operation including dropping received packets based on both: (i) the packet value generated from the packets to be dropped matching at least one previously generated packet value stored in said memory and (ii) the packets to be dropped generated received time value, said processor controlling said denial of service protection circuitry to operate in said normal mode of operation when it is not operating in said congestion mode of operation; and
wherein the threshold is based upon a depth of an input packet queue to the denial of service protection circuitry or a depth of an input packet queue to one or more of said plurality of packet processing cores, said plurality of packet processing cores being downstream from said denial of service protection circuitry.
20. The method of claim 19 , wherein the first packet processing core performs packet policing or packet classification.