Patent Application
20170006059
The present invention relates to a distributed denial of service attack defense method and device for protecting devices connected to a network from an attack via that network, as well as to a computer program for this method.
Nowadays, popular web servers can suffer from severe, albeit often only temporarily, server overload due to DDos attacks. Server overload will cause web-browsing performance to degrade in terms of increasing response times or even server unavailability. Controlling web server performance will be essential for companies or institutions having strong reliance on web services. In client-server applications a server handles service requests from a client (e.g. retrieve web page, send command to peripheral device). Usually, client and server communication is handled by a medium, such as a local area network, the internet, or a telecom network. Client-server sessions may be limited to a single service request and response, but may also include many consecutive requests and responses. The perceived quality of service (for example the response time) is affected by a number of factors such as throughput and delay in the communication medium and computing capacity of the server. A large volume of simultaneous requests may result in overloading the capacity of the server and result in late or unanswered requests. In a Distributed denial of service attack (DDos) requests arrive from a large number of clients located at different locations in the network.
Responses against DDos attacks may be found in detection strategies of a DDos attack, and taking countermeasures against it. As to detection of DDos attacks network traffic inspection may be carried out by a device in front of the networked service, which captures network traffic packets for analysis purposes. During analysis, the contents of network packets (usually protocol headers) are submitted to a set of rules or signatures which define a probability if the network packet (and related traffic from the same network session) is malicious network traffic. Based on the probability outcome of this phase, another countermeasure (for instance rate limiting) is deployed to take a prevent the DDos attack.
Another detection method is backscatter traffic analysis. DDos attack network traffic sent by clients often make use of incorrect source network addressing, (IP spoofing) which means that network traffic contains a source address pointing of another system, somewhere on the internet instead of the client sending the packet. This kind of network traffic can result in so called backscatter traffic: The server under attack sends network traffic to the spoofed address of the incoming network packet. So called network telescopes (CAIDA), are specifically designed to capture backscatter traffic and by that are able to detect ongoing DDos attacks. When admission control is applied, for example, using a computational model, a computer server can predict the likeliness of arriving in an overload situation See: Meulenhoff et al., Intelligent overload control for composite web services, Service-Oriented Computing, 2009. These methods may predict the expected computational load in the near future upon the initiation of a new client-server session. When the expected computational load exceeds a threshold: the capacity of the server, the new session is not admitted to the service (see blocking). Such an overload situation could be an indication of an ongoing DDos attack, which at the same time could trigger admission control routines as a counter measure.
Further known countermeasures include admission control schemes known as rate limiting, throttling or blocking mechanisms. Rate limiting switches, routers or servers control the rate of traffic transmitted or received on a network interface. Network traffic which exceeds a specific rate limit is dropped or delayed. In case of a DDos attack, a rate limiting device can be used to protect a server from becoming overloaded, and even crash. At the same time, rate limiting alone does not prevent the service from becoming unreachable.
In its most extreme form, rate limiting or throttling is equal to blocking (infinite delay). Statefull firewalls are an application of network traffic inspection. Where a stateless firewall checks network traffic based on the contents of individual packet, a statefull firewall does a check in the context of the ongoing communication session.
U.S. Pat. No. 7,188,366 discloses a method that detects attack packets in the edge router of the LAN accommodating the server. The packets are then destroyed, the address of the upstream routers close to the attack source are retrieved, and attack source retrieval modules are transmitted from the edge router to all the upstream routers. When the router at the uppermost stream is reached, a protection module is executed to destroy the attack packets. When the attacks cease, the protection module deletes itself and the protection process is ended.
EP1612674 concerns a method of handling an access request to an information processing system. It is detected whether or not the system is or threatens to be overloaded. In such case, a type of access request is detected and compared with a type of system overload. Access requests deemed to contribute to overload situations are not-admissible when exceeding predetermined threshold levels of a specified type of access control parameters. It does however not provide a solution to address requests that are rendered inadmissible.
A problem associated with the prior art based on network traffic filtering is that some knowledge about the content of the malicious network traffic is desired. A detection mechanism based on inspecting network traffic may lead to false positives, and undetected DDos attacks. This is illustrated by a client-server program that makes use of encrypted or obfuscated network traffic. A network device inspecting network traffic cannot get access to the encrypted or obfuscated data, and therefore cannot derive the type of communication and decide if the session is legitimate or not.
According to an aspect of the present application, a method for handling access requests is provided whereby the available capacity of various resources are considered in the further handling of an access request. Accordingly a method is provided for handling server overload, comprising:
Accordingly a solution is provided for transparently uploading to and executing server-software on a client or third party device in response to an overload of service requests. By providing a means to host server functionality at multiple locations that are to a group of clients, overload situations caused by a DDos attack can be mitigated.
One advantage of this solution in contrast to prior art is that no knowledge about the content of the malicious network traffic is required. The solution may therefore be ideal for zero-day (not seen before) attacks. Current prior art based on network traffic filtering is based on network layer based information. Since the mitigation of DDos attacks takes place at application level (a server function is replicated into the direction of the client), the solution is better suitable for mitigation of application layer DDos attacks. This invention provides a solution for transparently uploading to and executing server-software on a client or third party device in response to an overload of service requests.
In an embodiment the server further comprises a resource provider lookup function to select a resource from said resource providers. Without straining system resources the lookup function may form an effective way to redirect the client request to an available resource provider. Additionally, or alternatively, selection may be provided by a client request advertisement indicating a selectable resource. This may be the case if the client has available resources, or has functionality to detect available resources. This may be used to the advantage of minimal server loading.
In a further embodiment the offloaded server function may in turn comprise one or more offloadable server functions (OSF) that provide a part or all of the functionality of the server application, and which may be loaded on other resources in another network location. This is convenient for transferring resources to another device, which may in turn forward the functionality to resources that are located on suitable locations in the network, that may not be known by the lookup function of the primary server.
In a further embodiment addresses of communication devices may be retrieved that are close to attack sources at the upstream; and the offloaded server function may be transmitted to a resource provider in a defense position at the upstream. This has the advantage of minimizing server load and providing a contagion mechanism of the attack, which may throttle an attacker. For example, a resource provider lookup function may comprise an attack source determining function able to extract the address of a communication device to be chosen as an upstream defense position from the candidates of upstream communication device close to the attack sources retrieved by the resource provider lookup function.
In a further embodiment, the plurality of resource objects comprise at least one of physical and virtual resources.
A method is presented that enables a server to make use of client or third party resources. The client request data contains data about the network location of the client. The server may store this location data of each client. Before or after execution of the request, the server determines if the server is in or close to an overload situation. If the server is not in an overload situation, no further changes are needed. If the server is in or close to an overload situation, the server selects a new location in the network from the database with all client locations. The server allocates a new instance of the server function at a resource provider on (or close to) this location. The server may select one or more clients from the database. The selected clients are transparently redirected to the offloaded server function. Subsequent requests from clients are handled by the offloaded server function. The offloaded server function employs the same functionality and thus may decide to offload a server function to another network location.
To execute the method a system provides the described functionality may be composed of the following functional components.
Throughout the application, any function for carrying out the disclosed methods, in particular, as further clarified below: a server function; an offloaded/offloadable server function; load detection function; resource provider lookup function; and attack source determining function is implemented in hardware and/or software and as structurally identifiable by the function it perform in the system; i.e. the function is physically implemented in hardware and/or software or information structures transmitted through the network. The function may be implemented in hardware or software, to provide dedicated processing circuitry that processes input data read from system resources. A server function may e.g. be provided by a connected physical network device, but may also be formed as a virtual device, functioning in a network, and which may be implemented on a hardware resource that can be reached via network communication. These functions may be executed by one or more processors configured to perform operational acts in accordance with the present systems and methods, such as to provide control signals to the various other module components. The processor may be a dedicated processor for performing in accordance with the present system or may be a general-purpose processor wherein only one of many functions operates for performing in accordance with the present system. The processor may operate utilizing a program portion, multiple program segments, or may be a hardware device utilizing a dedicated or multi-purpose integrated circuit. Any type of processor may be used such as dedicated or shared one. The processor may include micro-controllers, central processing units (CPUs), digital signal processor s (DSPs), ASICs, or any other processor(s) or controller(s) such as digital optical devices, or analog electrical circuits that perform the same functions, and employ electronic techniques and architecture. The controller or processor may further comprise a memory that may be part of or operationally coupled to the controller. The memory may be any suitable type of memory where data is stored. Any medium known or developed that can store and/or transmit information suitable for use with the present systems and methods may be used as a memory. The memory may also store user preferences and/or application data accessible by the controller for configuring it to perform operational acts in accordance with the present systems and methods.
The invention is described more fully hereinafter with reference to the accompanying drawings, in which embodiments of the invention are shown. This invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. The description of the exemplary embodiments is intended to be read in connection with the accompanying drawings, which are to be considered part of the entire written description. In the drawings, the size and relative sizes of systems, components, layers, and regions may be exaggerated for clarity. Embodiments are described with reference to schematic illustrations of possibly idealized and/or intermediate structures of the invention.
In case of the overload detection function estimates a high overload likeliness (3), the server function redirects detected client requests to the offloaded server function (1 and 7) on a selected resource provider in response to the load detection function detecting an overload situation. This can be done, for instance, by defining a location from the datastore (2) for a new server location. Among other methods, defining a new server location could be done by clustering (e.g. with k-means where k, the number of clusters is set to two), or by a graph based approach, where the graph is split and assigned to a new server. The server can make use of a resource provider lookup function to get the location and contact details of a resource provider (4), and allocates an offloaded server function at a resource provider on this location (5 and 6). A subset of clients which are assigned to the offloaded server function are redirected by the server function (e.g. by HTTP redirect or DNS reconfiguration). In this case the client function makes use of the offloaded server function (7). The offloaded server function may communicate with another server function (8) executed on the same physical device or elsewhere in a physical network.
Implementation of Redirection Functions an Offloaded Server Functionality with Java Webstart
Here we describe the process of the invention in case of an implementation for HTTP and Java Web Start. The client application is a web browser application. The offloaded server function could be implemented by spawning a new process (of native code), running a script in a script engine, starting a new virtual machine in a hypervisor. Here we use a Java Web Start application which is running at the client computer. A minimal example of the HTTP request sent by the client (step 7a, 15a) is shown below.
This is a request for server application ‘/webapplication’ at server www.server.com. Information about local resources is provided through the HTTP header attribute ‘Resource-Provider’ telling that a resource provider is available at ‘http://www.client.com/ResourceProvider’ (e.g. at the address of the client). Two possible options for adding this HTTP header attribute to the request can be done by creating a browser plugin or proxy server on the path between client and server that insert to attribute to the request.
The redirection function can be implemented in various forms: a plugin added to the web browser (e.g. a firefox extension allows to modify request content), a HTTP proxy server installed on the client computer (e.g. with the apache HTTP server it is possible to rewrite requests and redirect incoming requests to other systems, add headers to the forwarded request).
The resource provider can be implemented in the same plugin of the webbrowser or HTTP proxy which implements the redirection function. The resource provider also runs a webservice so that it is accessible for the server. The request to the resource provider for creating a new offloaded server function (11,20) gives the resource provider the location of the Java Webstart program (a datafile to be downloaded from some location)
Both the operation (create an offloaded server function) and the location of the Java Web Start program are passed as arguments to the request to the resource provider. The resource provider parses the request arguments, downloads the Java Web Start program from the specified location, after which it is started. The resource provider changes the configuration of a redirection function (a plugin to the web browser or HTTP proxy on the client) to only redirect requests for the server functionality implemented by the offloaded server function to the new offloaded server function (e.g. a redirection rule based on the URL). After completion of this process the resource provider response to the server is to inform the server the location of the offloaded server function:
Now the server can generate a redirection response to the original request of the client.
New requests of the client for the server are intercepted by the redirection function implemented by the web browser plugin or a proxy server and redirected to the local Java Web Start application. In this case, the Java Web Start application is a java program which implements a webserver.
offloaded server function hosted by a cloud provider
The offloaded server function can also be hosted by a third party resource provider. Examples of such third parties are cloud providers like amazon EC2 or windows azure and Google App Engine (which provides a platform as a service or PaaS). In case of the Amazon EC2 service, the user also needs to advertise access credentials of the amazon service to the server. In case of Amazon these credentials are formed by the AWS Access Key, to be used to query the EC2 interface (see: http://docs.amazonwebservices.com). This provides access to the Amazon EC2 interface for the server and Resource provider selection function. Here the role of the resource provider is played by the Amazon EC2 service. The interfaces to this service (11,19,20) is provided by the EC2 webservice.
Implementation of the offloaded server function placement decision function and Resource provider selection function can be done by adding an extension to the webserver. Most webserver implementations (Internet Information Server, Apache HTTP server, Nginx) allow to add extensions that add additional processing functionality to an incoming request. A sample implementation of the offloaded server function decision function is shown below.
Input for this function is an array of known offloaded server functions of this server and client and a data-structure describing the required resources of the offloaded server function. In an iteration over the list of offloaded server functions, the requirements are compared to the available resources on the offloaded server function. The first offloaded server function with enough resources is returned, an input for the redirection function. If no offloaded server function was found, NULL is returned which is the signal to create a new offloaded server function.
A sample implementation in psuedocode of the Resource provider selection function is shown below:
Input for this function is an array of known resource providers and a data-structure describing the required resources for a offloaded server function. In an iteration over the list of resource providers, the requirements are compared to the available resource of the resource provider. In this example, each resource provider is queried to get the latest data on available resources. If a resource provider is returned by the function, this resource provider is used for creating a new offloaded server function. If nothing is returned (NULL), no resource provider is found, and the server must resort to a default path and generate the response itself or generate a server error (e.g. a HTTP 503 Service Unavailable status code)
In a way similar to U.S. Pat. No. 7,188,366
The server application may use the information in the advertisement and submit it to a offloaded server function decision function (9) and a Resource provider selection function (10) to decide whether to create a offloaded server function, and to select the most optimal location for the offloaded server function, and thus which resource provider to choose. Both functions (Resource provider selection function, offloaded server function decision function) compare the information sent in the advertisement by the client to the resource requirements of an offloaded server function (e.g. the Resource provider selection function can decide to create a offloaded server function when the resource provider has sufficient processing power available). If it is decided to create an offloaded server function, the server sends a create offloaded server function request to the selected resource provider (11). Amongst other possible solutions, the request (11) sent by the server to the resource provider may be embedded in a HTTP request. Information in the request would be the requested operation (create an offloaded server function), and operational parameters like (a reference to) an image for the offloaded server function.
The resource provider processes the create offloaded server function request and creates a new offloaded server function (12). The resource provider also provisions a redirection function (13). The redirection function is a means to redirect requests from the client to the offloaded server function. Provisioning of this function could be mean configuration of the client device (e.g. update local DNS information, configure a proxy service, change a routing table, firewall, change configuration of a web browser plugin, client application configuration) in order to redirect requests to the offloaded server function (14). After provisioning, the server may redirect the client request to the offloaded server function (e.g. with an HTTP redirect).
Finally, the above-discussion is intended to be merely illustrative of the present system and should not be construed as limiting the appended claims to any particular embodiment or group of embodiments. Thus, while the present system has been described in particular detail with reference to specific exemplary embodiments thereof, it should also be appreciated that numerous modifications and alternative embodiments may be devised by those having ordinary skill in the art without departing from the scope of the present systems and methods as set forth in the claims that follow. The specification and drawings are accordingly to be regarded in an illustrative manner and are not intended to limit the scope of the appended claims.
In interpreting the appended claims, it should be understood that the word “comprising” does not exclude the presence of other elements or acts than those listed in a given claim; the word “a” or “an” preceding an element does not exclude the presence of a plurality of such elements; any reference signs in the claims do not limit their scope; several “means” may be represented by the same or different item(s) or implemented structure or function; any of the disclosed devices or portions thereof may be combined together or separated into further portions unless specifically stated otherwise. The mere fact that certain measures are recited in mutually different claims does not indicate that a combination of these measures cannot be used to advantage and are deemed explicitly disclosed by the subject application.
| Number | Date | Country | Kind |
|---|---|---|---|
| 13195144.4 | Nov 2013 | EP | regional |
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/NL2014/050814 | 11/28/2014 | WO | 00 |
