Infrastructure distributed denial of service protection

Abstract

A method of providing infrastructure protection for a server of a network organization, the method including announcing, as an internet protocol (IP) address associated with a server of a plurality of servers, a first anycast IP address, the first anycast IP address being one of a plurality of anycast IP addresses that each serve as an anycast address for a network of edge servers. Each of the plurality of anycast IP addresses is allocated to a respective server of the plurality of servers by the network of edge servers. The network of edge servers may receive an incoming network packet intended for the server, the incoming network packet identified using the first anycast IP address. The network of edge servers may determine whether the incoming network packet is legitimate and if so, the incoming network packet may be routed to the server using a generic routing encapsulation (GRE) tunnel.

1 . A method comprising:
 announcing, as an internet protocol (IP) address associated with a server of a plurality of servers, a first anycast IP address, the first anycast IP address being one of a plurality of anycast IP addresses that each serve as an anycast address for a network of edge servers, the first anycast IP address allocated specifically to the server, and wherein each of the plurality of anycast IP addresses is allocated to a respective server of the plurality of servers by the network of edge servers;   receiving, at the network of edge servers, an incoming network packet intended for the server, the incoming network packet identified using the first anycast IP address;   determining, by the network of edge servers, whether the incoming network packet is legitimate; and   in response to determining that the incoming network packet is legitimate, routing, by a processor, the incoming network packet to the server using a generic routing encapsulation (GRE) tunnel.   
     
     
         2 . The method of  claim 1 , wherein the GRE tunnel is defined by the first anycast IP address, the actual IP address of the server, and a second anycast IP address that serves as a spoof source address of the incoming network packet from a perspective of the server, wherein the network of edge servers anycasts the second anycast IP address towards the server from each edge server of the network of edge servers simultaneously. 
     
     
         3 . The method of  claim 2 , wherein routing the incoming network packet to the server comprises:
 modifying a header of the incoming network packet to indicate the second anycast IP address as a source IP address of the incoming network packet; and   transmitting the incoming network packet to the server at the actual IP address of the server.   
     
     
         4 . The method of  claim 1 , wherein a mapping of the first anycast IP address to the actual IP address is maintained between the network of edge servers and the server. 
     
     
         5 . The method of  claim 3 , further comprising:
 receiving, at an edge server of the network of edge servers, an encapsulated outgoing network packet from the server, wherein the encapsulated outgoing network packet is an outgoing network packet which has been encapsulated by the server with header information comprising the second anycast IP address as a destination address;   decapsulating the outgoing network packet to generate a decapuslated outgoing network packet by removing the encapsulation added by the server that includes the header information; and   transmitting the decapsulated outgoing network packet.   
     
     
         6 . The method of  claim 5 , wherein the decapsulating is performed by an edge server nearest to the server. 
     
     
         7 . The method of  claim 5 , wherein the received encapsulated outgoing network packet is received at a network organization and routed external to the server. 
     
     
         8 . A system comprising:
 a memory; and   a processor operatively coupled to the memory, the processor to:
 announce, as an interne protocol (IP) address associated with a server of a plurality of servers, a first anycast IP address, the first anycast IP address being one of a plurality of anycast IP addresses that each serve as an anycast address for a network of edge servers, the first anycast IP address allocated specifically to the server, and wherein each of the plurality of anycast IP addresses is allocated to a respective server of the plurality of servers by the network of edge servers; 
 receive, at the network of edge servers, an incoming network packet intended for the server, the incoming network packet identified using the first anycast IP address; 
 determine, by the network of edge servers, whether the incoming network packet is legitimate; and 
 in response to determining that the incoming network packet is legitimate, route the incoming network packet to the server using a generic routing encapsulation (GRE) tunnel. 
   
     
     
         9 . The system of  claim 8 , wherein the GRE tunnel is defined by the first anycast IP address, the actual IP address of the server, and a second anycast IP address that serves as a spoof source address of the incoming network packet from a perspective of the server, wherein the processor anycasts, via the network of edge servers, the second anycast IP address towards the server from each edge server of the network of edge servers simultaneously. 
     
     
         10 . The system of  claim 9 , wherein to route the incoming network packet to the server, the processor is to:
 modify a header of the incoming network packet to indicate the second anycast IP address as a source IP address of the incoming network packet; and   transmit the incoming network packet to the server at the actual IP address of the server.   
     
     
         11 . The system of  claim 8 , wherein a mapping of the first anycast IP address to the actual IP address is maintained between the network of edge servers and the server. 
     
     
         12 . The system of  claim 10 , where the processor is further to:
 receive, at an edge server of the network of edge servers, an encapsulated outgoing network packet from the server, wherein the encapsulated outgoing network packet is an outgoing network packet which has been encapsulated by the server with header information comprising the second anycast IP address as a destination address;   decapsulating the outgoing network packet to generate a decapuslated outgoing network packet by removing the encapsulation added by the server that includes the header information; and   transmitting the decapsulated outgoing network packet.   
     
     
         13 . The system of  claim 12 , wherein the decapsulating is performed by an edge server nearest to the server. 
     
     
         14 . The system of  claim 12 , wherein the received encapsulated outgoing network packet is received at a network organization and routed external to the server. 
     
     
         15 . A non-transitory computer-readable medium having instructions stored thereon which, when executed by a processor, cause the processor to:
 announce, as an interne protocol (IP) address associated with a server of a plurality of servers, a first anycast IP address, the first anycast IP address being one of a plurality of anycast IP addresses that each serve as an anycast address for a network of edge servers, the first anycast IP address allocated specifically to the server, and wherein each of the plurality of anycast IP addresses is allocated to a respective server of the plurality of servers by the network of edge servers;   receive, at the network of edge servers, an incoming network packet intended for the server, the incoming network packet identified using the first anycast IP address;   determine, by the network of edge servers, whether the incoming network packet is legitimate; and   in response to determining that the incoming network packet is legitimate, route, by the processor, the incoming network packet to the server using a generic routing encapsulation (GRE) tunnel.   
     
     
         16 . The non-transitory computer-readable medium of  claim 15 , wherein the GRE tunnel is defined by the first anycast IP address, the actual IP address of the server, and a second anycast IP address that serves as a spoof source address of the incoming network packet from a perspective of the server, wherein the processor anycasts, via the network of edge servers, the second anycast IP address towards the server from each edge server of the network of edge servers simultaneously. 
     
     
         17 . The non-transitory computer-readable medium of  claim 16 , wherein to route the incoming network packet to the server, the processor is to:
 modify a header of the incoming network packet to indicate the second anycast IP address as a source IP address of the incoming network packet; and   transmit the incoming network packet to the server at the actual IP address of the server.   
     
     
         18 . The non-transitory computer-readable medium of  claim 15 , wherein a mapping of the first anycast IP address to the actual IP address is maintained between the network of edge servers and the server. 
     
     
         19 . The non-transitory computer-readable medium of  claim 17 , where the processor is further to:
 receive, at an edge server of the network of edge servers, an encapsulated outgoing network packet from the server, wherein the encapsulated outgoing network packet is an outgoing network packet which has been encapsulated by the server with header information comprising the second anycast IP address as a destination address;   decapsulating the outgoing network packet to generate a decapuslated outgoing network packet by removing the encapsulation added by the server that includes the header information; and   transmitting the decapsulated outgoing network packet.   
     
     
         20 . The non-transitory computer-readable medium of  claim 19 , wherein the decapsulating is performed by an edge server nearest to the server.