Methods, systems, and apparatus for mitigating network-based attacks

Patent metadata

Field	Value
Publication number	US-9769203-B2
Application number	US-201414492254-A
Country	US
Kind code	B2
Filing date	Sep 22, 2014
Priority date	Sep 22, 2014
Publication date	Sep 19, 2017
Grant date	Sep 19, 2017

Abstract

Methods, systems, computer program products, and articles of manufacture for mitigating a network-based attack are described. A first request associated with a transaction is obtained and a tracking identifier of the first request is associated with the transaction. A count of outstanding requests associated with a user is compared to a throttling limit. If the count of outstanding requests associated with the user is greater than the throttling limit, processing of the first request may be denied.

First claim

What is claimed is:

1. A method of mitigating a replay attack, the method comprising:
obtaining a first request associated with a transaction;
associating a request identifier of the first request with the transaction;
comparing a count of outstanding requests associated with a user to a throttling limit;
processing the first request if a request type and the request identifier of the first request corresponds to a current state of the transaction, the first request is an only request received having the request type and the request identifier of the first request, and the count of outstanding requests does not violate the throttling limit, the current state being one of a plurality of states for processing the transaction;
denying the first request if the request type of the first request does not correspond to the current state of the transaction, another received request has a same request type and a same request identifier of the first request, or the count of outstanding requests associated with the user violates the throttling limit;
obtaining an additional request associated with the transaction;
processing the additional request if a corresponding request identifier of the additional request matches the request identifier associated with the transaction; and
denying the additional request if the corresponding request identifier of the additional request does not match the request identifier associated with the transaction.

2. The method of claim 1 , wherein the request identifier is used as a tracking identifier.

3. The method of claim 1 , wherein the request identifier is based on a time of a creation of the first request.

4. The method of claim 1 , wherein a same request identifier is utilized for all valid requests of the transaction.

5. The method of claim 1 , further comprising:
obtaining a second additional request;
processing the second additional request if a request type of the second additional request corresponds to the current state of the transaction; and
denying the second additional request if the request type of the additional request does not correspond to the current state of the transaction.

6. The method of claim 5 , wherein the current state is one of a preview state, a create columnar table state, a data insert state, an alter table state, and an analytical view creation state.

7. The method of claim 1 , wherein the denying the first request comprises one or more of ignoring the first request, preventing submission of the first request, delaying processing of the first request, and requesting the user to delay submitting additional requests.

8. An apparatus for mitigating a replay attack, comprising:
a processor; and
memory to store instructions that; when executed by the processor; cause the processor to perform operations comprising:
obtaining a first request associated with a transaction;
associating a request identifier of the first request with the transaction;
comparing a count of outstanding requests associated with a user to a throttling limit;
processing the first request if a request type and the request identifier of the first request corresponds to a current state of the transaction, the first request is an only request received having the request type and the request identifier of the first request; and the count of outstanding requests does not violate the throttling limit, the current state being one of a plurality of states for processing the transaction;
denying the first request if the request type of the first request does not correspond to the current state of the transaction, another received request has a same request type and a same request identifier of the first request, or the count of outstanding requests associated with the user violates the throttling limit;
obtaining an additional request associated with the transaction;
processing the additional request if a corresponding request identifier of the additional request matches the request identifier associated with the transaction; and
denying the additional request if the corresponding request identifier of the additional request does not match the request identifier associated with the transaction.

9. The apparatus of claim 8 , wherein the request identifier is used as a tracking identifier.

10. The apparatus of claim 8 , wherein the request identifier is based on a time of a creation of the first request.

11. The apparatus of claim 8 , wherein a same request identifier is utilized for all valid requests of the transaction.

12. The apparatus of claim 8 , wherein the current state is one of a preview state, a create columnar table state, a data insert state, an alter table state, and an analytical view creation state.

13. The apparatus of claim 8 , wherein mitigation module is further configured to perform operations comprising:
obtaining a second additional request;
processing the second additional request if a request type of the second additional request corresponds to the current state of the transaction; and
denying the second additional request if the request type of the additional request does not correspond to the current state of the transaction.

14. The apparatus of claim 13 , wherein the current state is one of a preview state, a create columnar table state, a data insert state, an alter table state, and an analytical view creation state.

15. The apparatus of claim 8 , wherein the denying the first request comprises one or more of ignoring the first request, preventing submission of the first request, delaying processing of the first request, and requesting the user to delay submitting additional requests.

16. A non-transitory machine-readable storage medium comprising instructions that, when executed by one or more processors of a machine, cause the machine to perform operations comprising:
obtaining a first request associated with a transaction;
associating a request identifier of the first request with the transaction;
comparing a count of outstanding requests associated with a user to a throttling limit;
processing the first request if a request type and the request identifier of the first request corresponds to a current state of the transaction, the first request is an only request received having the request type and the request identifier of the first request, and the count of outstanding requests does not violate the throttling limit, the current state being one of a plurality of states for processing the transaction;
denying the first request if the request type of the first request does not correspond to the current state of the transaction, another received request has a same request type and a same request identifier of the first request, or the count of outstanding requests associated with the user violates the throttling limit;
obtaining an additional request associated with the transaction;
processing the additional request if a corresponding request identifier of the additional request matches the request identifier associated with the transaction; and
denying the additional request if the corresponding request identifier of the additional request does not match the request identifier associated with the transaction.

17. The non-transitory machine-readable storage medium of claim 16 , wherein a same request identifier is utilized for all valid requests of the transaction.

18. The non-transitory machine-readable storage medium of claim 16 , wherein the current state is one of a preview state, a create columnar table state, a data insert state, an alter table state, and an analytical v

Assignees

• Chandran Lakshmy
• Kunal Parsewar
• Tripathy Manasa Ranjan
• Vaitheeswaran Ganesh
• Harish Vishnu Gowda
• S Praveen
• Sap Se

Inventors

• Chandran Lakshmy
• Kunal Parsewar
• Tripathy Manasa Ranjan
• Vaitheeswaran Ganesh
• Harish Vishnu Gowda
• S Praveen

Classifications

• H04L63/0227

  Filtering policies (mail message filtering H04L51/212) · CPC title

• H04L63/1458

  Denial of Service · CPC title

• H04L63/1466 Primary

  Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title