Quarantine-based mitigation of effects of a local DoS attack

Patent metadata

Field	Value
Publication number	US-9286473-B2
Application number	US-201414165439-A
Country	US
Kind code	B2
Filing date	Jan 27, 2014
Priority date	Dec 31, 2013
Publication date	Mar 15, 2016
Grant date	Mar 15, 2016

Abstract

In one embodiment, techniques are shown and described relating to quarantine-based mitigation of effects of a local DoS attack. A management device may receive data indicating that one or more nodes in a shared-media communication network are under attack by an attacking node. The management device may then communicate a quarantine request packet to the one or more nodes under attack, the quarantine request packet providing instructions to the one or more nodes under attack to alter their frequency hopping schedule without allowing the attacking node to learn of the altered frequency hopping schedule.

First claim

What is claimed is:

1. A method, comprising:
receiving, at a management device, data indicating that one or more nodes in a shared-media communication network are under attack by an attacking node; and
communicating a quarantine request packet to the one or more nodes under attack, the quarantine request packet providing instructions to the one or more nodes under attack to alter their frequency hopping schedule without allowing the attacking node to learn of the altered frequency hopping schedule by encrypting the frequency hopping schedule.

2. The method as in claim 1 , wherein the quarantine request packet includes a secret key that determines the altered frequency hopping schedule.

3. The method as in claim 1 , wherein the quarantine request packet includes a list of the one or more nodes under attack to be quarantined.

4. The method as in claim 1 , wherein the quarantine request packet determines the duration for which the one or more nodes under attack will be quarantined.

5. The method as in claim 1 , wherein the quarantine request packet is unicast or multicast to the one or more nodes under attack.

6. The method as in claim 1 , wherein the quarantine request packet is broadcast to the one or more nodes under attack.

7. The method as in claim 6 , wherein the quarantine request packet includes a compressed list of the one or more nodes under attack to be quarantined.

8. The method as in claim 1 , further comprising:
communicating a quarantine state message to one or more shared-media networks to ensure the one or more shared-media networks are accepting new nodes.

9. A method, comprising:
receiving a quarantine request packet at a node in a shared-media communication network;
altering, based on the quarantine request packet, a frequency hopping schedule of the node without allowing an attacking node to learn of the altered frequency hopping schedule by encrypting the frequency hopping schedule.

10. The method as in claim 9 , further comprising:
communicating a discovery beacon to indicate a public frequency schedule.

11. The method as in claim 10 , wherein the discovery beacon includes a quarantine flag.

12. The method as in claim 10 , wherein the discovery beacon includes an indication that the communicating node is in quarantine.

13. The method as in claim 9 , wherein the quarantine request packet includes a duration period for quarantine.

14. The method as in claim 13 , wherein the duration period for quarantine is dynamically adjusted.

15. An apparatus, comprising:
one or more network interfaces to communicate within a computer network;
a processor coupled to the network interfaces and configured to execute one or more processes; and
a memory configured to store a process executable by the processor, the process when executed operable to:
receive, at a management device, data indicating that one or more nodes in a shared-media communication network are under attack by an attacking node; and
communicate a quarantine request packet to the one or more nodes under attack, the quarantine request packet providing instructions to the one or more nodes under attack to alter their frequency hopping schedule without allowing the attacking node to learn of the altered frequency hopping schedule by encrypting the frequency hopping schedule.

16. The apparatus as in claim 15 , wherein the quarantine request packet includes a secret key that determines the altered frequency hopping schedule.

17. The apparatus as in claim 15 , wherein the quarantine request packet includes a list of the one or more nodes under attack to be quarantined.

18. The apparatus as in claim 15 , wherein the quarantine request packet determines the duration for which the one or more nodes under attack will be quarantined.

19. The apparatus as in claim 15 , wherein the quarantine request packet is unicast or multicast to the one or more nodes under attack.

20. The apparatus as in claim 15 , wherein the quarantine request packet includes a compressed list of the one or more nodes under attack to be quarantined.

Assignees

• Cisco Tech Inc

Inventors

• Cruz Mota Javier
• Vasseur Jean-Philippe
• Di Pietro Andrea
• Hui Jonathan W

Classifications

• H04W12/12

  Detection or prevention of fraud · CPC title

• G06F21/554 Primary

  involving event detection and direct action · CPC title

• H04W12/125 Primary

  Protection against power exhaustion attacks · CPC title

• H04W12/122 Primary

  Counter-measures against attacks; Protection against rogue devices · CPC title