Flowspec message processing apparatus and method
A method and apparatus for processing flow specification (Flowspec) messages to one or more of a plurality of customer networks by a controller device coupled to the plurality of customer networks. Preferably a network controller monitors network traffic flowing through each of the customer networks for detecting a network attack in one of the plurality of customer networks, via monitoring of the network traffic. Upon detection of a network attack, a Flowspec message is generated for the customer network detected to be under network attack wherein the Flowspec message is configured specifically for that customer network. The generated Flowspec message is transmitted to the customer network detected to be under network attack for implementation by the customer network for mitigation of the detected network attack.
1. A method for processing flow specification (FlowSpec) messages to one or more customer networks of a plurality of customer networks by a controller device coupled to the plurality of customer networks, comprising:
monitoring, by the controller device, a plurality of Internet Protocol (IP) packets flowing through the one or more customer networks of the plurality of customer networks;
detecting, by the controller device, based on one or more first attributes of an IP packet of the plurality of IP packets, a network attack in a first customer network of the plurality of customer networks;
retrieving, by the controller device, responsive to detecting the network attack, from a database comprising a stack of pre-existing Flowspec messages, a first Flowspec message associated with the one or more first attributes of the IP packet;
generating, by the controller device, responsive to retrieving the first Flowspec message, a second Flowspec message for the first customer network by adjusting one or more aspects of the first Flowspec message, the second Flowspec message generated based on a match between one or more characteristics of the first customer network and one or more second attributes of the first Flowspec message, the one or more characteristics of the first customer network determined by a network service provider connected to the one or more customer networks and the controller device;
transmitting, by the controller device, the second Flowspec message to cause the first customer network to implement one or more actions specific to the first customer network to mitigate the network attack in the first customer network; and
storing, by the controller device, the second Flowspec message in the stack of pre-existing Flowspec messages, wherein the second Flowspec message is adaptable to be selected for use by the controller device for a second customer network of the plurality of customer networks, contingent upon the second Flowspec message being reconfigured in view of specific criteria for the second customer network.
2. The method as recited in claim 1 , wherein the controller device is provided in the network service provider, and wherein the network service provider provides Internet service to the plurality of customer networks.
3. The method as recited in claim 2 , comprising:
transmitting, by the controller device, the second Flowspec message to one or more router devices in the network service provider such that the one or more router devices in the network service provider are also enabled to perform mitigation of the network attack upon first network traffic flowing through the first customer network while not affecting second network traffic flowing through one or more second customer networks of the plurality of customer networks.
4. The method as recited in claim 3 , wherein retrieving the first Flowspec message includes:
selecting, by the controller device, the first Flowspec message from the stack of pre-existing Flowspec messages.
5. The method as recited in claim 3 , wherein generating the second Flowspec message includes:
generating, by the controller device, a BGP Flowspec for port 53/UDP for an edge router device in the first customer network and the one or more router devices in the network service provider.
6. The method as recited in claim 5 , wherein the second Flowspec message is an n-tuple consisting of several matching criteria to be applied to IP traffic in the edge router device of the first customer network and the one or more router devices in the network service provider.
7. The method as recited in claim 6 , wherein the second Flowspec message is distributed as a BGP NLRI in a BGP announcement message.
8. The method as recited in claim 7 , wherein the second Flowspec message implements a filter for mitigation of a DDOS network attack in the edge router device in the first customer network and one or more edge router devices in the network service provider.
9. A network controller device coupled to a plurality of customer networks for processing flow specification (Flowspec) messages to one or more customer networks of the plurality of customer networks, comprising:
one or more databases having memory configured to store instructions; and
a processor disposed in communication with the memory, wherein the processor upon execution of the instructions is configured to:
monitor a plurality of Internet Protocol (IP) packets flowing through the one or more customer networks of the plurality of customer networks;
detect, based on one or more first attributes of an IP packet of the plurality of IP packets, a network attack in a first customer network of the plurality of customer networks;
retrieve, responsive to detection of the network attack, from a database comprising a stack of pre-existing Flowspec messages, a first Flowspec message associated with the one or more first attributes of the IP packet;
generate, responsive to retrieval of the first Flowspec message, a second Flowspec message for the first customer network by adjusting one or more aspects of the first Flowspec message, the second Flowspec message generated based on a match between one or more characteristics of the first customer network and one or more second attributes of the first Flowspec message, the one or more characteristics of the first customer network determined by a network service provider connected to the one or more customer networks and the network controller device;
transmit the second FlowSpec message to cause the first customer network to implement one or more actions specific to the first customer network to mitigate the network attack in the first customer network; and
store the second Flowspec message in the stack of pre-existing Flowspec messages, wherein the second Flowspec message is adaptable to be selected for use by the network controller device for a second customer network of the plurality of customer networks, contingent upon the second Flowspec message being reconfigured in view of specific criteria for the second customer network.
10. The network controller device as recited in claim 9 , wherein the network controller device is provided in the network service provider, and wherein the network service provider provides Internet service to the plurality of customer networks.
11. The network controller device as recited in claim 10 , wherein the processor is configured to:
transmit the second Flowspec message to one or more router devices in the network service provider such that the one or more router devices in the network service provider are also enabled to perform mitigation of the network attack upon first network traffic flowing through the first customer network while not affecting second network traffic flowing through one or more second customer networks of the plurality of customer networks.
12. The network controller device as recited in claim 11 , the processor configured to retrieve the first Flowspec message for the first customer network by:
selecting the first Flowspec message from the stack of pre-existing Flowspec messages.
13. The network controller device as recited in claim 11 , the processor configured to generate the second Flowspec message by:
generating a BGP Flowspec for port 53/UDP for an edge router device in the first customer network and the one or more router devices in the network service provider and wherein the second Flowspec message is distributed as a BGP NLRI in a BGP announcement message.
14. The network controller device as recited in claim 13 , wherein the second Flowspec message is an n-tuple consisting of several matching criteria to be applied to IP traffic in the edge router device of the first customer network and one or more edge router devices in the network service provider and wherein the second Flowspec message implements a filter for mitigation of a DDOS network attack in the edge router device of the first customer network and the one or more edge router devices in the network service provider.