Dynamic denial of service mitigation system

Abstract

A dynamic denial of service (DDoS) mitigation system comprising a BGP address family exchange connected to at least one DDoS mitigation route reflector, and at least one DDoS mitigation route reflector being an address family identifier specific route reflector, where each DDoS mitigation route reflector advertises BGP content in a first address family to the BGP family exchange. The BGP address family exchange translates the BGP content from the first address family to a destination address family and announces the translated content to a destination route reflector, and wherein the destination address family includes a flow specification diversion route.

1 . A network device comprising a processor, an input/output device coupled to the processor, and a memory coupled with the processor, the memory comprising executable instructions that when executed by the processor cause the processor to effectuate operations comprising:
 instantiating a first virtual private network transport tunnel extending from an ingress virtual provider edge router (vPE) to a head-end and a provider edge (HE-PE);   instantiating a second network transport tunnel extending from the HE-PE to an egress vPE;   diverting dirty traffic from the ingress vPE toward a scrubber via a first virtual private network transport tunnel; and   directing clean traffic to the egress vPE via a second virtual private network transport tunnel.   
     
     
         2 . The network device of  claim 1 , wherein the processor further effectuates operations comprising:
 instantiating a border gateway protocol (BGP) address family exchange (BAFX) in a network; and   translating, by the BAFX, at least one diversion route from a DDoS mitigation service route reflector to a flow specification diversion route.   
     
     
         3 . The network device of  claim 1 , wherein the processor further effectuates operations comprising:
 connecting a border gateway protocol (BGP) address family exchange (BAFX) to an address family specific dynamic denial of service function (DDoS) mitigation service route reflector; and   connecting the BAFX to a destination route reflector using a flow specification address family.   
     
     
         4 . The network device of  claim 1 , wherein the processor further effectuates operations comprising mapping, by a border gateway protocol (BGP) address family exchange (BAFX), a diversion address to a flow specification format during a translation, wherein the diversion address comprises affinity information corresponding to a forwarding action or a redirecting action for a specific location. 
     
     
         5 . The network device of  claim 1 , wherein diverting dirty traffic from the ingress vPE toward a scrubber occurs without changing IP best path information. 
     
     
         6 . The network device of  claim 1 , wherein the processor further effectuates operations comprising translating a non-flow specification address to a flow specification address. 
     
     
         7 . The network device of  claim 6 , wherein the processor further effectuates operations comprising broadcasting a flow specification diversion route from a destination route reflector to a vPE router. 
     
     
         8 . A method comprising:
 instantiating, by a processor, a first virtual private network transport tunnel extending from an ingress virtual provider edge router (vPE) to a head-end and a provider edge (HE-PE);   instantiating, by the processor, a second network transport tunnel extending from the HE-PE to an egress vPE;   diverting, by the processor, dirty traffic from the ingress vPE toward a scrubber via a first virtual private network transport tunnel; and   directing, by the processor, clean traffic to the egress vPE via a second virtual private network transport tunnel.   
     
     
         9 . The method of  claim 8  further comprising:
 instantiating a border gateway protocol (BGP) address family exchange (BAFX) in a network; and 
 translating, by the BAFX, at least one diversion route from a DDoS mitigation service route reflector to a flow specification diversion route. 
 
     
     
         10 . The method of  claim 8  further comprising:
 connecting a border gateway protocol (BGP) address family exchange (BAFX) to an address family specific dynamic denial of service function (DDoS) mitigation service route reflector; and 
 connecting the BAFX to a destination route reflector using a flow specification address family. 
 
     
     
         11 . The method of  claim 8  further comprising mapping a diversion address to a flow specification format during a translation, wherein the diversion address comprises affinity information corresponding to a forwarding action or a redirecting action for a specific location. 
     
     
         12 . The method of  claim 8 , wherein diverting dirty traffic from the ingress vPE toward a scrubber occurs without changing IP best path information. 
     
     
         13 . The method of  claim 8  further comprising translating a non-flow specification address to a flow specification address. 
     
     
         14 . The method of  claim 13  further comprising broadcasting a flow specification diversion route from a destination route reflector to a vPE router. 
     
     
         15 . A computer-readable storage medium storing executable instructions that when executed by a processor causes said processor to effectuate operations comprising:
 instantiating a first virtual private network transport tunnel extending from an ingress virtual provider edge router (vPE) to a head-end and a provider edge (HE-PE);   instantiating a second network transport tunnel extending from the HE-PE to an egress vPE;   diverting dirty traffic from the ingress vPE toward a scrubber via a first virtual private network transport tunnel; and   directing clean traffic to the egress vPE via a second virtual private network transport tunnel.   
     
     
         16 . The computer-readable storage medium of  claim 15 , wherein the processor further effectuates operations comprising:
 instantiating a border gateway protocol (BGP) address family exchange (BAFX) in a network; and   translating, by the BAFX, at least one diversion route from a DDoS mitigation service route reflector to a flow specification diversion route.   
     
     
         17 . The computer-readable storage medium of  claim 15 , wherein the processor further effectuates operations comprising:
 connecting a border gateway protocol (BGP) address family exchange (BAFX) to an address family specific dynamic denial of service function (DDoS) mitigation service route reflector; and   connecting the BAFX to a destination route reflector using a flow specification address family.   
     
     
         18 . The computer-readable storage medium of  claim 15 , wherein the processor further effectuates operations comprising mapping, by a border gateway protocol (BGP) address family exchange (BAFX), a diversion address to a flow specification format during a translation, wherein the diversion address comprises affinity information corresponding to a forwarding action or a redirecting action for a specific location. 
     
     
         19 . The computer-readable storage medium of  claim 15 , wherein diverting dirty traffic from the ingress vPE toward a scrubber occurs without changing IP best path information. 
     
     
         20 . The computer-readable storage medium of  claim 15 , wherein the processor further effectuates operations comprising translating a non-flow specification address to a flow specification address.