Detecting and isolating an attack directed at an IP address associated with a digital certificate bound with multiple domains
An attack is detected on a first IP address and a determination is made that the first IP address is associated with a primary digital certificate that is bound with multiple different domains. For each of these domains, a secondary certificate is accessed that is bound only to that domain and that secondary certificate is associated with a unique IP address such that each of the different domains has a unique IP address associated with its secondary certificate respectively. The attack is isolated to the domain the attack follows.
1. A method, comprising:
detecting an attack on a first IP address;
determining that the first IP address is associated with a primary digital certificate that is bound with a plurality of different domains;
for each of the plurality of different domains,
accessing a secondary certificate that is bound only to that domain, and
associating that secondary certificate with a unique IP address such that each of the plurality of different domains has a unique IP address associated with its secondary certificate respectively; and
isolating the attack to one of the plurality of different domains the attack follows.
2. The method of claim 1 , further comprising:
taking corrective action for the isolated attack including throttling traffic directed to that IP address.
3. The method of claim 1 , further comprising:
taking corrective action for the isolated attack including routing traffic directed to that IP address to dedicated hardware to mitigate the attack.
4. The method of claim 1 , further comprising:
taking corrective action for the isolated attack including dropping traffic directed to that IP address.
5. The method of claim 1 , wherein detecting the attack on the first IP address includes determining that a denial of service attack is directed to the first IP address.
6. The method of claim 1 , further comprising:
transmitting a domain name system (DNS) update to a DNS system to announce the unique IP addresses that resolve to the domains bound in the secondary certificates.
7. A non-transitory computer-readable storage medium that provides instructions that, when executed by a processor, causes said processor to perform operations comprising:
detecting an attack on a first IP address;
determining that the first IP address is associated with a primary digital certificate that is bound with a plurality of different domains;
for each of the plurality of different domains,
accessing a secondary certificate that is bound only to that domain, and
associating that secondary certificate with a unique IP address such that each of the plurality of different domains has a unique IP address associated with its secondary certificate respectively; and
isolating the attack to one of the plurality of different domains the attack follows.
8. The non-transitory computer-readable storage medium of claim 7 , wherein the operations further comprise:
taking corrective action for the isolated attack including throttling traffic directed to that IP address.
9. The non-transitory computer-readable storage medium of claim 7 , wherein the operations further comprise:
taking corrective action for the isolated attack including routing traffic directed to that IP address to dedicated hardware to mitigate the attack.
10. The non-transitory computer-readable storage medium of claim 7 , wherein the operations further comprise:
taking corrective action for the isolated attack including dropping traffic directed to that IP address.
11. The non-transitory computer-readable storage medium of claim 7 , wherein detecting the attack on the first IP address includes determining that a denial of service attack is directed to the first IP address.
12. The non-transitory computer-readable storage medium of claim 7 , wherein the operations further comprise:
transmitting a domain name system (DNS) update to a DNS system to announce the unique IP addresses that resolve to the domains bound in the secondary certificates.
13. An apparatus, comprising:
a set of one or more processors; and
a set of one or more non-transitory computer-readable storage mediums storing instructions, that when executed by the set of processors, cause the apparatus to perform the following operations:
detecting an attack on a first IP address;
determining that the first IP address is associated with a primary digital certificate that is bound with a plurality of different domains;
for each of the plurality of different domains,
accessing a secondary certificate that is bound only to that domain, and
associating that secondary certificate with a unique IP address such that each of the plurality of different domains has a unique IP address associated with its secondary certificate respectively; and
isolating the attack to one of the plurality of different domains the attack follows.
14. The apparatus of claim 13 , wherein the operations further comprise:
taking corrective action for the isolated attack including throttling traffic directed to that IP address.
15. The apparatus of claim 13 , wherein the operations further comprise:
taking corrective action for the isolated attack including routing traffic directed to that IP address to dedicated hardware to mitigate the attack.
16. The apparatus of claim 13 , wherein the operations further comprise:
taking corrective action for the isolated attack including dropping traffic directed to that IP address.
17. The apparatus of claim 13 , wherein detecting the attack on the first IP address includes determining that a denial of service attack is directed to the first IP address.
18. The apparatus of claim 13 , wherein the operations further comprise:
transmitting a domain name system (DNS) update to a DNS system to announce the unique IP addresses that resolve to the domains bound in the secondary certificates.