International Business Machines Corporation

Brian E Carpenter

Clark Debs Jeffries

Andreas Kind

Michael Steven Siegel

Richard Harold Boivie

Kiyoshi Maruyama

A method for managing attacks in a computer system is disclosed. The computer system is used in sending, receiving, or sending and receiving a plurality of packets, which include a plurality of administrative packets. The method includes determining whether a congestion of the administrative packets exists. Congestion of the administrative packets indicates that a potential attack exists. The method also includes discarding a portion of the plurality of administrative packets if it is declared that the congestion of the administrative packets exists. The portion of the plurality of packets is sufficient to ensure that a remaining portion of the plurality of packets transmitted is not more than a maximum administrative packet bandwidth limit and, if the plurality of administrative packets present a sufficient offered load, not less than a minimum administrative packet bandwidth guarantee.

Method for managing of denial of service attacks using bandwidth allocation technology

Methods and apparatus are provided for metering data packets having a plurality of different packet lengths in a data communications network. A token count Tis incremented at a token increment rate CIR subject to an upper limit CBS on the token count. On arrival of a packet of length L tokens, it is determined if both T&#x3e;0 and T+n&#x2267;L, where n is a defined number of tokens. If so, the data packet is categorized as in profile and L tokens are subtracted from the token count T. Otherwise the data packet is categorized out of profile. In some embodiments, n is set to a value in the range 0&#x3c;n&#x3c;(L&#x2212;1) where Lis the maximum length of data packets to be metered. In other embodiments, n is varied in the range 0&#x2266;n&#x2266;(L&#x2212;1) in dependence on at least one feedback signal indicating an operational condition in the network. The degree of conformance of the metering system is determined by the parameter n, whereby the conformance level can be tuned to particular multi-length packet environments.

Traffic metering in data networks

A multicast communication system for small groups using a protocol to indicate to routers receiving a packet according to the protocol to perform the following process: (1) determining a next hop for each of the destination nodes listed in the packet received; (2) partitioning the destination nodes into groups according to the next hop determined for each destination node in the preceding step; (3) replicating the packet such that there is at least one copy of the packet for each of the next hops; (4) modifying the list of addresses for the destination nodes such that the list of addresses for each of the next hops includes only the addresses for the destination nodes to be routed in that next hop; and (5) transmitting the modified copies of the packet to the next hops found in the previous steps for routing to the addresses included in each packet.

Growing community of inventors

Kilchberg, Switzerland

Brian E Carpenter