Dynamic traffic routing and service management controls for on-demand application services

Patent metadata

Field	Value
Publication number	US-8955112-B2
Application number	US-201113212220-A
Country	US
Kind code	B2
Filing date	Aug 18, 2011
Priority date	Aug 18, 2011
Publication date	Feb 10, 2015
Grant date	Feb 10, 2015

Abstract

A network routing and service control design enables an internet protocol (“IP”) network to effectively divert, on-demand, a given set of IP traffic flow from its normally followed network path to a network-attached application service processing complex and then enable the IP network to re-inject post-processed (e.g., Distributed Denial of Service scrubbed) traffic back into the network for routing to an originally-intended destination. This design also provides a sophisticated control mechanism for application service providers and/or customers/users for service management purposes. For example, application service providers can manage network and service processing resources and customers/users can manage their service requests.

First claim

We claim:

1. A network system for dynamic routing of internet protocol traffic, the network system comprising:
an on-demand application service controller configured to
receive an on-demand service request for an application service, wherein the application service comprises a distributed denial of service mitigation service and the on-demand service request is received in response to a distributed denial of service attack,
generate a validation request in response to receiving the on-demand service request, the validation request being used to validate a customer that provided the on-demand service request is responsible for a site for which the application service has been requested,
generate a diversion routing control message in response to receiving the on-demand service request for the application service, the diversion routing control message comprising instructions for an ingress provider edge router to divert ingress traffic from an intended destination to a distributed denial of service attack scrubber, implemented by an application server, for processing,
generate a re-injection routing control message in response to receiving the on-demand service request for the application service, the re-injection routing control message comprising instructions for an application service provider edge router to deliver the ingress traffic processed by the distributed denial of service attack scrubber to the intended destination,
send the diversion routing control message to the ingress provider edge router, and
send the re-injection routing control message to the application service provider edge router;

the ingress provider edge router being configured to
receive the diversion routing control message from the on-demand application service controller,
receive the ingress traffic directed to the intended destination, and
redirect the ingress traffic in accordance with the diversion routing control message to the application service provider edge router; and

the application service provider edge router being configured to
route the ingress traffic to the distributed denial of service attack scrubber implemented by the application server.

2. The network system of claim 1 , wherein:
the application service provider edge router is further configured to
receive the re-injection routing control message from the on-demand application service controller, and
deliver the ingress traffic processed by the distributed denial of service attack scrubber to the intended destination.

3. The network system of claim 2 , wherein the application service provider edge router in being configured to route the ingress traffic processed by the distributed denial of service attack scrubber to the intended destination is configured to route the ingress traffic processed by the distributed denial of service attack scrubber to a customer provider edge router that is in communication with a customer equipment serving the intended destination.

4. The network system of claim 1 , wherein the application service is a uniform resource locator blocking service and the application server is a uniform resource locator scrubber.

5. The network system of claim 1 , wherein the on-demand application service controller is further configured to:
send the validation request to a registry;
receive from the registry in response the validation request an indication of whether the customer is responsible for the site;
permit generation of the diversion routing control message, if the indication identifies the customer as being responsible for the site; and
deny generation of the diversion routing control message, if the indication identifies the customer as not being responsible for the site.

6. An on-demand application service controller comprising:
a processor; and
a memory that stores instructions which, when executed by the processor, cause the processor to perform operations comprising
receiving an on-demand service request for an application service, wherein the application service comprises a distributed denial of service mitigation service and the on-demand service request is received in response to a distributed denial of service attack,
generating a validation request in response to receiving the on-demand service request, the validation request being used to validate a customer that provided the on-demand service request is responsible for a site for which the application service has been requested,
generating a diversion routing control message in response to receiving the on-demand service request for the application service, the diversion routing control message comprising instructions for a provider edge router to divert ingress traffic from an intended destination to a distributed denial of service attack scrubber, implemented by an application server, for processing,
generating a re-injection routing control message in response to receiving the on-demand service request for the application service, the re-injection routing control message comprising instruction for an application service provider edge router to deliver the ingress traffic processed by the distributed denial of service attack scrubber to the intended destination,
sending the diversion routing control message to an ingress provider edge router, and
sending the re-injection routing control message to the application service provider edge router.

7. The on-demand application service controller of claim 6 , wherein the application service further comprises a uniform resource locator blocking service and the application server comprises a uniform resource locator scrubber.

8. The on-demand application service controller of claim 6 , wherein the on-demand service request is received from a customer equipment located at a customer premises via an multi-hop external border gateway protocol message.

9. The on-demand application service controller of claim 6 , wherein the on-demand service request is received from a customer service management client via one of a Web-based graphical user interface and a client/server application programing interface.

10. The on-demand application service controller of claim 6 , wherein the application service is a pay-as-you-go service.

11. The on-demand application service controller of claim 6 , wherein the application service is a subscription service.

12. The on-demand application service controller of claim 6 , wherein the operations further comprise:
sending the validation request to a registry;
receiving from the registry in response the validation request an indication of whether the customer is responsible for the site;
permitting generation of the diversion routing control message, if the indication identifies the customer as being responsible for the site; and
denying generation of the diversion routing control message, if the indication identifies the customer as not being responsible for the site.

13. The on-demand application service controller of claim 6 , wherein the instructions to receive the on-demand service request further comprise instructions to receive the on-demand service request from an attack monitor in response to the attack monitor detecting attack traffic directed to the intended destination.

14. A method for dynamic routing of internet protocol traffic, the method comprising:
receiving, at an on-demand application service controller, an on-demand service request for an application service, wherein the application service comprises a distributed denial of service mitigation service and the on-demand service request is received in response to a distributed denial of service attack;
generating, at the on-deman

Assignees

• Nguyen Han
• Cepleanu Adrian
• Jeng Huajin
• Spencer Thomas
• At & T Ip I Lp

Inventors

• Nguyen Han
• Cepleanu Adrian
• Jeng Huajin
• Spencer Thomas

Classifications

• H04L45/22

  Alternate routing · CPC title

• H04L63/1458

  Denial of Service · CPC title

• H04L45/38

  Flow based routing · CPC title

• H04L63/0272 Primary

  Virtual private networks · CPC title

• H04L45/306

  Route determination based on the nature of the carried application · CPC title