Network denial of service defense method and system
Systems and methods are described for protecting a device from a denial of service (DOS) attack. The method comprises receiving, by the device, a connection request from a third-party device, determining, by the device, that the third-party device is malicious. Switching a mode of operation of the device from a first mode to a second mode, in response to determining that the third-party device is malicious, and broadcasting in the second mode, a message configured to be decoded only by a credentialed device.
1. A method for protecting a device from a denial of service (DOS) attack, the method comprising:
receiving, by the device, a connection request from a third-party device over a short-range wireless protocol;
determining, by the device, that the third-party device is malicious;
switching a mode of operation of the device from a first mode to a second mode, in response to determining that the third-party device is malicious, wherein in the second mode of operation the device is not wirelessly accessible; and
broadcasting, by the device in the second mode, an encrypted message configured to be decrypted by a credentialed device, and is not decryptable by the third-party device wherein the credentialed device is configured to regain access to the device based on the credentialed device decrypting the encrypted message.
2. The method of claim 1 , wherein determining that the third-party device is malicious further comprises:
determining, by the device, whether the connection request from the third-party device initiates a legitimate authentication; and
dropping, by the device, a connection with the third-party device in response to determining that the connection request does not initiate the legitimate authentication.
3. The method of claim 2 , further comprising:
determining, by the device, that a number of connection attempts by the third-party device has exceeded a threshold; and
determining that the third-party device is malicious, when the number of connection attempts has exceeded the threshold.
4. The method of claim 1 , wherein the device is accessible in the first mode of operation over a personal area network implemented over one of a short-range wireless protocol, an infrared protocol, or a combination thereof.
5. The method of claim 4 , wherein in the second mode of operation the device is not accessible over the personal area network and is configured to broadcast only the encrypted message.
6. The method of claim 1 , wherein the device is an internet-of-things (IOT) device.
7. The method of claim 6 , wherein the IOT device is an access control device configured to control access to a building.
8. The method of claim 1 , wherein the credentialed device is a mobile device configured to receive credentials from the device to enable the credentialed device to provide access to a building.
9. A system for protecting devices from denial of service attacks, the system comprising:
a device of the devices comprising a wireless transceiver and a wireless transmitter configured to:
receive a connection request from a third-party device over a short-range wireless protocol;
determine that the third-party device is malicious;
switch from a first mode of operation to a second mode of operation, in response to determining that the third-party device is malicious, wherein in the second mode of operation the device is not wirelessly accessible; and
broadcast, in the second mode, an encrypted message to one or more credentialed devices, the encrypted message configured to be decryptable by the one or more credentialed devices, and is not decryptable by the third-party device; and
a credentialed device of the one or more credentialed devices is configured to decrypt the encrypted message from the device, and wherein the credentialed device is configured to regain access to the device based on the credentialed device decrypting the encrypted message.
10. The system of claim 9 , wherein the device is further configured to:
determine whether the connection request from the third-party device initiates a legitimate authentication; and
drop a connection with the third-party device in response to determining that the connection request does not initiate the legitimate authentication.
11. The system of claim 10 , wherein the device is further configured to:
determine that a number of connection attempts by the third-party device has exceeded a threshold; and
determine that the third-party device is malicious, when the number of connection attempts has exceeded the threshold.
12. The system of claim 9 , wherein the device is accessible in the first mode of operation over a personal area network implemented over one of the short-range wireless protocol, an infrared protocol, or a combination thereof, and wherein in the second mode of operation the device is not accessible over the personal area network and is configured to broadcast only the encrypted message.
13. The system of claim 9 , wherein the credentialed device is configured to:
decrypt the encrypted message; and
send an indication of a denial of service attack to a server based on information in the encrypted message.
14. The system of claim 9 , wherein the device is an internet-of-things (IOT) device.
15. The system of claim 14 , wherein the TOT device is an access control device, that is used to control access to a building.
16. The system of claim 9 , wherein the device is further configured to send credentials to the credentialed device to enable the credentialed device to provide access to a building.
17. A device, comprising a wireless transceiver and a wireless transmitter configured to:
receive a connection request from a third-party device over a short-range wireless protocol;
determine that the third-party device is malicious;
switch from a first mode of operation to a second mode of operation, in response to determining that the third-party device is malicious, wherein in the second mode of operation the device is not wirelessly accessible; and
broadcast, in the second mode, an encrypted message configured to be decrypted by a credentialed device, the encrypted message comprising an indication the third-party device is malicious, and wherein the credentialed device is configured to regain access to the device based on the credentialed device decrypting the encrypted message.
18. The device of claim 17 , wherein the device is further configured to:
determine whether the connection request from the third-party device initiates a legitimate authentication; and
drop a connection with the third-party device in response to determining that the connection request does not initiate the legitimate authentication.
19. The device of claim 18 , wherein the device is further configured to:
determine that a number of connection attempts by the third-party device has exceeded a threshold; and
determine that the third-party device is malicious, when the number of connection attempts has exceeded the threshold.
20. The device of claim 17 , wherein the device is accessible in the first mode of operation over a personal area network implemented over one of the short-range wireless protocol, an infrared protocol, or a combination thereof and wherein in the second mode of operation the device is not accessible over the personal area network and is configured to broadcast only the encrypted message.