Systems and methods for increased security using client address manipulation
In a network system in which a server receives packets each including a source address, and in which the server ordinarily responds to each packet, Distributed Denial of Service attacks may be launched by malicious actors controlling a plurality of network devices. In such an attack, the attacking devices may spoof the IP address of a legitimate device, e.g., they may include, in each packet, the source address of the legitimate device. As such, systems and methods for increased security using client address manipulation are provided.
1 . A method, comprising:
receiving, by a first network device, a first packet, at a first destination address, the first packet including a source address; and
sending, by the first network device, a message to the source address, the message including a second destination address and instructions, the second destination address being unpublished, the instructions instructing the recipient of the message to send subsequent packets to the second destination address,
wherein the instructions are transmitted within the network layer of a second packet.
2 . The method of claim 1 , wherein the first network device is an authoritative name server.
3 . The method of claim 1 , wherein the first network device is a Domain Name System (DNS) resolver.
4 . The method of claim 1 , wherein the first packet is a User Datagram Protocol (UDP) packet.
5 . The method of claim 1 , wherein the instructions further instruct the recipient to, after a set time interval, cease sending subsequent packets to the second destination address and resume sending packets to the first destination address.
6 . The method of claim 1 , wherein the second packet is an Internet Protocol packet.
7 . The method of claim 1 , wherein the instructions are transmitted within the transport layer of a second packet.
8 . The method of claim 1 , further comprising disregarding, by the first network device, a subsequent packet sent to the first destination address.
9 . The method of claim 1 , further comprising disregarding, by a second network device, a subsequent packet sent to the first destination address, the second network device being connected to the first network device and configured to route packets to the first network device.
10 . The method of claim 1 , wherein:
the first destination address includes a first Internet Protocol address and a first port number;
the second destination address includes a second Internet Protocol address and a second port number; and
(i) the first Internet Protocol address differs from the second Internet Protocol address; or
(ii) the first port number differs from the second port number.
11 . A network device, comprising:
a processing circuit; and
memory, operatively connected to the processing circuit and storing instructions that, when executed by the processing circuit, cause the network device to perform a method, the method comprising:
receiving, by the network device, a first packet, at a first destination address, the first packet including a source address;
receiving notification of a denial of service attack associated with the source address;
sending, by the network device, a message to the source address, the message including a second destination address and instructions, the instructions instructing the recipient of the message to send subsequent packets to the second destination address; and
sending, by the network device, a message to a network routing device, to drop subsequent packets addressed from the source address and to the first destination address,
wherein the instructions are transmitted within the network layer of a second packet.
12 . The network device of claim 11 , wherein the network device is an authoritative name server.
13 . The network device of claim 11 , wherein the network device is a Domain Name System (DNS) resolver.
14 . The network device of claim 11 , wherein the first packet is a User Datagram Protocol (UDP) packet.
15 . The network device of claim 11 , wherein the instructions further instruct the recipient to, after a set time interval, cease sending subsequent packets to the second destination address and resume sending packets to the first destination address.
16 . The network device of claim 11 , wherein the second packet is an Internet Protocol packet.
17 . The network device of claim 11 , wherein the instructions are transmitted within the transport layer of the second packet.