Methods and systems for automatic denial of service protection in an IP device
View Patent ↗Methods and systems for automatic denial of service protection in an IP device are disclosed. Packets are received at a network interface of an IP device, the packets being addressed to a network address of the network interface. The packets addressed to the network interface of the IP device are forwarded to a processor in the IP device. The processor determines whether the packets violate a rate-based policing policy of the IP device. In response to determining that the packets violate the rate-based policing policy, source identifying information associated with the packets is added to an access control list in the IP device. Packets matching criteria in the access control list are prevented from being forwarded to the processor in the IP device.
1. A method for automatic denial of service protection in a media gateway, the method comprising:
(a) receiving packets at a network interface of a media gateway, the packets being addressed to a network address of the network interface;
(b) forwarding the packets addressed to the network address of the network interface of the media gateway to a processor in the media gateway;
(c) at the processor, determining whether any of the packets addressed to the network address of the network interface violate a rate-based policing policy of the media gateway;
(d) adding source identifying information associated with the packets that are determined to violate the rate-based policing policy to an access control list in the media gateway;
(e) preventing at least some packets matching criteria in the access control list from being forwarded to the processor in the media gateway; and
(f) forwarding a sampling of the packets matching criteria in the access control list to the processor in the media gateway and determining whether to remove an entry from the access control list based on the sampled packets.
2. The method of claim 1 wherein receiving packets at a network interface of media gateway comprises receiving IP packets having a destination IP address matching an IP address of the network interface.
3. The method of claim 1 wherein determining whether the packets violate a rate-based policing policy of the media gateway comprises:
(a) monitoring a traffic rate of packets received from a source;
(b) comparing the monitored traffic rate to a threshold; and
(c) determining based on the comparison whether the rate-based policing policy of the media gateway is violated.
4. The method of claim 3 wherein monitoring a traffic rate of packets received from a source comprises:
(a) determining source identifying information from the received packets; and
(b) tracking a number of packets received over a predetermined time period that have same source identifying information.
5. The method of claim 4 wherein tracking a number of packets received over a predetermined time period comprises:
(a) recording an entry in a source traffic rate database that includes the source identifying information and a time of receipt for each packet received; and
(b) counting a number of entries having same source identifying information and having time of receipt information indicating receipt within the predetermined time period.
6. The method of claim 1 wherein adding source identifying information associated with the packets to an access control list in the media gateway comprises recording an entry in the access control list that includes the source identifying information and corresponding time of recording information.
7. The method of claim 6 comprising removing the recorded entry from the access control list after a predetermined period of time has elapsed beyond a time indicated in the corresponding time of recording information.
8. The method of claim 6 comprising updating the corresponding time of recording information in the recorded entry of the access control list when new packets matching the source identifying information are received.
9. The method of claim 1 wherein preventing packets matching criteria in the access control list from being forwarded to the processor in the media gateway comprises:
(a) determining whether a packet includes source identifying information listed in the access control list in the media gateway; and
(b) in response to determining that the packet includes source identifying information listed in the access control list, discarding the packet.
10. The method of claim 1 wherein preventing packets matching criteria in the access control list from being forwarded to the processor in the media gateway comprises:
(a) determining whether received packets include source identifying information listed in the access control list in the media gateway; and
(b) in response to determining that the packets include source identifying information listed in the access control list, forwarding a sampling of the packets to the processor.
11. The method of claim 1 wherein the access control list in the media gateway is operator-editable.
12. The method of claim 1 further comprising automatically removing the source identifying information associated with the packets from the access control list in the media gateway.
13. The method of claim 6 comprising deriving statistical information from entries in the access control list based on at least one of recorded source identification information and corresponding time of recording information.
14. A system for automatic denial of service protection in a media gateway, the system comprising:
(a) a network interface for receiving packets at media gateway, the packets being addressed to a network address of the network interface;
(b) a processor in the media gateway for receiving the packets from the network interface that are addressed to the network address of the network interface and for determining whether any of the packets that are addressed to the network address of the network interface violate a rate-based policing policy of the media gateway, the processor including logic configured to add source identifying information associated with the packets that are determined to violate the rate based policing policy to an access control list in the media gateway, and
wherein the network interface is adapted to prevent at least some packets matching criteria in the access control list from being forwarded to the processor in the media gateway and to forward a sampling of the packets matching criteria in the access control list to the processor in the media gateway and wherein the processor is configured to determine whether to remove an entry from the access control list based on the sampled packets.
15. The system of claim 14 wherein the network interface of the media gateway comprises logic configured to receive IP packets having a destination IP address matching an IP address of the network interface.
16. The system of claim 14 wherein the media gateway comprises logic configured to:
(a) monitor a traffic rate of packets received from a source;
(b) compare the monitored traffic rate to a threshold;
(c) determine based on the comparison whether the rate-based policing policy of the media gateway is violated.
17. The system of claim 16 wherein the processor comprises logic configured to:
(a) determine source identifying information from the received packets;
(b) track a number of packets received over a predetermined time period that have same source identifying information.
18. The system of claim 17 wherein the media gateway comprises logic configured to:
(a) record an entry in a source traffic rate database that includes the source identifying information and a time of receipt for each packet received;
(b) count the number of entries having same source identifying information and having time of receipt information indicating receipt within the predetermined time period.
19. The system of claim 14 wherein the media gateway comprises logic configured to record an entry in the access control list that includes the source identifying information and corresponding time of recording information.
20. The system of claim 19 wherein the media gateway comprises logic configured to remove the recorded entry from the access control list after a predetermined period of time has elapsed beyond a time indicated in the corresponding time of recording information.
21. The system of claim 19 wherein the media gateway comprises logic configured to update the corresponding time of recording information in the recorded entry of the access control list when new packets matching the source identifying information are received.
22. The system of claim 14 wherein the media gateway comprises logic configured to:
(a) determine whether a packet includes source identifying information listed in the access control list in the media gateway; and
(b) in response to determining that the packet includes source identifying information listed in the access control list, discard the packet.
23. The system of claim 14 wherein the media gateway comprises logic configured to:
(a) determine whether received packets include source identifying information listed in the access control list in the media gateway; and
(b) in response to determining that the packets include source identifying information listed in the access control list, forward a sampling of the packets to the processor.
24. The system of claim 14 wherein the access control list in the media gateway is operator-editable.
25. The system of claim 14 wherein the media gateway comprises logic configured to automatically remove the source identifying information associated with the packets from the access control list in the media gateway.
26. The system of claim 14 comprising logic configured to derive statistical information from the entries in the access control list based on at least one of recorded source identification information and corresponding time of recording information.
27. A media gateway having automatic denial of service protection, the media gateway comprising:
(a) a plurality of network interfaces for receiving packets, the packets being addressed to any of the network interfaces; and
(b) a control manager for receiving the packets addressed to any of the network interfaces from the network interfaces and for determining whether any of the packets addressed to the network interfaces violate a rate-based policing policy of the media gateway, the control manager including logic configured to add source identifying information associated with the packets determined to violate the rate based policy to an access control list in the media gateway, and
wherein the network interfaces are adapted to prevent at least some packets matching criteria in the access control list from being forwarded to the control manager and to forward a sampling of the packets matching criteria in the access control list to the control manager in the media gateway and wherein the control manager is configured to determine whether to remove an entry from the access control list based on the sampled packets.