Patent ID: 7552206
Filing Date: 2009-06-23
Classification: H04L

Abstract:
1. In a computer network comprising a local service that receives requests for data from remote clients using a data transport protocol, a method of protecting the local service against denial of service attacks by controlling the number of permitted remote client connections to the local service based on network sub-paths used to transfer data between the local service and the remote clients, the method comprising acts of: receiving a first request from a remote client for establishing a connection to a local service, the first request traversing a network sub-path that includes at least one intermediary node for routing the first request from the remote client to the local service; upon receiving the first request from the remote client, using a tracing protocol to detect the network sub-path over which the first request traversed; accessing a database that stores network sub-paths for other requests that have been received by the local service; determining that a number of the other requests traversed the same network sub-path as the first request, the same network sub-path including the at least one intermediary node; determining that the total number of requests that traversed the same network sub-path during the predefined period of time exceeds a predefined level, wherein the total number of requests includes the number of other requests that traversed the same network sub-path as the first request, and the first request; and upon determining that the total number of requests that traversed the same network sub-path exceeds the predefined level, throttling processing of the first request for controlling connections to the local service.