Method and apparatus for blocking malicious network traffic

Abstract

A method (100) for blocking malicious network traffic is described, the method including providing (110) a client key to a client device, by a key generation appliance; receiving (120) a data packet from the client device, destined for an application server, by a control appliance; determining (130) whether the data packet includes the client key, by the control appliance, in response to determining that the data packet includes the client key, forwarding (140) the data packet to the application server, by the control appliance; and / or blocking (150) the data packet in response to determining that the data packet does not include the client key.

Description

[Technical Field]

[0001] Background technology Malicious network traffic may be encountered in various types of network configurations, particularly in networks that include an application server, e.g., a game server, and multiple client devices, e.g., game clients or game client devices, and may be used to carry out attacks against the application server.

[0002] Malicious network traffic, particularly game traffic, can include a particularly large volume of data packets sent from a malicious user on one of the client devices to a game server. If the attack is successful, the application server or network connection becomes overwhelmed by the received malicious traffic and is unable to continue performing work for legitimate users, or the application server's network ports become congested. As a result, the services provided by the application server become unavailable to legitimate users, which is commonly caused by a DoS attack, commonly referred to as a denial of service (DoS). In particular, a DoS attack carried out by a large number of client devices is commonly referred to as a distributed denial of service (DDoS) attack. In various network architectures, an attack is considered successful if the attacker is present or is able to degrade service quality, for example by causing delays.

[0003] The objective of conventional methods and apparatus is to prevent the success of such DoS or DDoS attacks by reducing the load of malicious network traffic reaching application servers, and / or to maintain a reasonable quality of service available to legitimate users while an attack is occurring. This is typically done by recognizing patterns in the received network traffic. Because different applications, particularly gaming applications, typically require different gaming protocols and therefore different payloads or differently structured payloads in data packets, known pattern recognition processes are typically based on the content of the headers of the data packets contained in the network traffic, rather than the payloads of the data packets.

[0004] Patterns in network traffic can be recognized based on predetermined or known patterns believed to be indicative of an attack, or alternatively, by identifying (substantial) deviations in the workload or network traffic previously received or encountered during normal operation when no attack is occurring.

[0005] However, these protection measures can be relatively easily circumvented because the information contained in the header, particularly the source information, e.g., the IP address of the client device, can be changed or forged. Furthermore, there exist certain network structures, e.g., gaming networks including a game server and multiple client devices, in which there is no or little malicious and acceptable network (gaming) traffic that reaches the application server without substantially affecting network traffic factors that affect the user experience, such as increasing the application server's response time or increasing latency.

[0006] Moreover, pattern recognition takes time. For example, a single new connection from a specific IP address range may be a legitimate user connection. Thousands of connection attempts from such an IP address range may represent a pattern and thus be classified as an attack. Therefore, due to the recognition delay, too few malicious data packets may be blocked.

[0007] Additionally, the system or process may be exploited because a malicious user may create a pattern to block one or more legitimate users. For example, if an attacker knows the IP address or range of IP addresses of at least one legitimate user, the attacker can spoof traffic originating from the IP address or range of IP addresses of the legitimate user or users, but the system or process may block legitimate network traffic that shares properties with the maliciously crafted pattern. In other words, too many data packets may be blocked.

[0008] The problem underlying the present invention is therefore to provide improved network attack protection, in particular an improved protection method, device or system for preventing malicious network traffic from reaching an application server.

[0009] overview According to one embodiment of many, there is provided a method for preventing or blocking malicious network traffic, the method including: providing, by a key generating appliance, a client key to a client device; receiving, by a control appliance, a data packet from the client device intended for an application server; determining, by the control appliance, whether the data packet includes the client key; forwarding, by the control appliance, the data packet to the application server in response to determining that the data packet includes the client key; and / or blocking, by the control appliance, the data packet in response to determining that the data packet does not include the client key.

[0010] In other words, a data packet is forwarded by the control appliance only in response to determining that the data packet contains a client key. This means that the control appliance can, as a default action, block all data packets, i.e., all traffic that does not contain the client key provided to the client device by the key-generating appliance. This allows for reliable packet-by-packet detection of malicious network traffic, thereby identifying and blocking single malicious network packets, particularly the initial network packet, of an attack. In this way, a deterministic approach is provided that can prevent a significantly increased number of, and particularly all, malicious data packets from reaching the application server.

[0011] Additionally or alternatively, the control appliance can receive, particularly consecutively, a plurality of data packets destined for the application server from the client device, and the control appliance determines whether a plurality of, particularly all, of the plurality of data packets include the client key, and forwards all of the plurality of data packets that include the client key to the application server and / or blocks all of the data packets that do not include the client key. For example, the plurality of data packets can include a first data packet and a second data packet received thereafter.

[0012] More specifically, the control appliance can block all data packets that do not include the client key among the plurality of data packets and forward the remaining data packets to the application server, thereby setting a balance between the speed of processing or forwarding the data packets and system security, thereby improving the efficiency of the system.

[0013] In the manner defined above, the client key may be a client token. The key generation appliance may include a token application programming interface, or API, that provides the client token.

[0014] The key generation appliance and the control appliance may be communicatively connected. The key generation appliance and the control appliance may exchange one or more respective client keys. Alternatively or additionally, the key generation appliance and the control appliance may be proprietary or storable and / or may have and / or communicate previously communicated key generation data to enable the key generation appliance and the control appliance to generate and / or verify one or more respective client keys. In other words, the control appliance may be configured to verify whether a client key was generated by the key generation appliance based on, for example, a shared secret, a shared key generation process, and / or shared key generation data.

[0015] Additionally or alternatively, the key generation appliance and the control appliance may be included in a (higher level) device, such as a network traffic control device. Additionally or alternatively, the key generation appliance may be included in the control appliance, or vice versa.

[0016] Additionally or alternatively, the key generation appliance, control appliance and / or network traffic control device may be included in an application server and, as noted above, can prevent malicious data packets from reaching specific server applications within the server, such as gaming applications.

[0017] In one embodiment, determining whether the data packet includes a client key includes determining whether the client key included in the data packet is valid.

[0018] For example, the key generation appliance may provide multiple client keys to a client, and in particular may periodically provide a client device with one, particularly a new, client key, such that only the most recently received client key may be a valid client key. Thus, client keys may be regularly or periodically rotated, thereby invalidating previous client keys.

[0019] Additionally or alternatively, the client key may be valid (only) for a predetermined amount of time. In other words, the client key may be (automatically) revoked after the predetermined time has elapsed. In one example, the key generation appliance may provide multiple client keys to the client, and may provide a new client key to the client device periodically, particularly in response to a request from the client device. In other words, the client device requests a new client key when or before the client key expires. In this way, the method may highly prevent data packets containing forged or intercepted client keys from reaching the application server.

[0020] According to one embodiment, determining whether the data packet includes a client key includes determining whether the client key included in the data packet has expired, in particular based on a timestamp of the client key.

[0021] The timestamp may indicate when the client key was generated and / or provided to the client device. In other words, the method may include determining, based on the timestamp of the client key, whether a predetermined time interval has elapsed after the client key was generated and / or provided.

[0022] Additionally or alternatively, the timestamp may indicate when a client key included in the data packet will expire. In other words, the method may include determining, by the key generating appliance, in particular during generation of the client key, when and / or how long since the client key has expired, and determining, by the controlling appliance, based on the timestamp of the client key, whether said time has arrived and / or whether said time has passed.

[0023] This allows a client device to be provided with a client key that is valid only for a limited, particularly predetermined, period, such as less than about 1 minute, about 1 minute, about 1-5 minutes, or about 1-30 minutes, thereby preventing a malicious user from carrying out an attack based on a client key that they have extracted or intercepted, for example, by inspecting other users' or their own network traffic.

[0024] According to one embodiment, the client key provided to the client device is a first client key, and determining whether the data packet includes a client key includes, in particular, determining whether the data packet includes the first client key or a second client key derivable from the first client key.

[0025] The second client key may be a portion of the first client key, and in particular may be shorter and / or contain fewer bytes than the first client key. In other words, the second client key may be a portion of the first client key, such as a representation of ½, ¼, 1 / 16, or 1 / 32 of the first client key, and in particular a representation of the first ½, ¼, 1 / 16, or 1 / 32 of the first client key. In one example, the first client key contains or consists of 64 bytes, and the second client key contains or consists of the first 4 bytes of the 64 bytes of the first client key.

[0026] The second client key can be derived from the first client key based on a shared secret, such as a shared secret shared between the key generation appliance and the control appliance. For example, the second client key can be derived from the first client key by XORing a portion of the first client key with the shared secret. The shared secret can be a static secret. Alternatively or additionally, the second client key can be derived from the first client key by taking a fixed set of non-contiguous bits from the first client key, hashing the first client key, and taking specific bits from the result, and / or by any other deterministic calculation that can be performed on the first client key to derive the second client key.

[0027] This can reduce the size of the data packets sent and / or the packet transmission time, in particular the time spent by the control appliance to determine whether the data packets constitute malicious network traffic, i.e., whether the data packets contain the client key. Furthermore, the control appliance stores only the second client key, which can also efficiently use the storage capacity available to the control appliance.

[0028] Furthermore, the use of a second client key, especially a second client key containing a specific bit sequence not contained in the first client key, can prevent forgery of the second client key, for example by a malicious user inspecting his or her own traffic, thus further enhancing the security of the method.

[0029] In one embodiment, determining whether the data packet includes a client key includes, and particularly consists of, determining whether a previous data packet previously received from the client device includes a first client key and determining whether the data packet includes a second client key; and / or determining whether the data packet includes the first client key includes, and particularly consists of, determining whether a previous data packet previously received from the client device includes the second client key and determining whether it includes a third client key that is different from the second client key and derived from the first client key.

[0030] The third client key may be the same length as the second client key. A different short client key, e.g., a different second client key or a different third client key, may be sent in each packet. For example, a data packet may include the first two bytes of the first client key, then the second two bytes, and so on, or the sequence order may be optionally reversed, or may include a sequence of different values ​​derived from the first client key as described above. In this case, the control appliance may expect to receive a specific pattern of different short client keys (the second client key and / or the third client key) and, for example, block traffic that always includes the same short client key (the second client key and / or the third client key).

[0031] The method may also include determining whether the previously received data packet and the (subsequently received) data packet are received from the same client device, such determination being made based on parameters or source information contained or indicated in the data packets, particularly in their respective headers.

[0032] In this way, a portion of a client key, or a short client key derivable from the complete client key, is only accepted as a full client key if the complete client key was included in the previous or first data packet received from the client device, thereby reducing the size of subsequent data packets sent and / or packet transmission time while keeping the application server secure from attacks.

[0033] Additionally, the security of the method is further improved by varying the short client key, which can be derived from a part of the client key or the complete client key.

[0034] According to one embodiment, determining whether the data packet includes a client key includes determining whether the client key included in the data packet is associated with the client device and / or a user of the client device.

[0035] The client key may be associated with a client device or a user, in particular with the user's user account, i.e. may be different for each client device or its user, in this way making it possible to reliably identify the (user of) the client device from which a received data packet originates.

[0036] Such a determination can be made, for example, based on source information, such as the IP address indicated in the data packet, in particular the IP address indicated in the header of the data packet, while the client key can be embedded in the packet payload. Thus, both the packet header and the packet payload are used to recognize traffic as legitimate or malicious. This further enhances the security of the method for protecting against network attacks, in particular the method described.

[0037] According to one embodiment, determining whether the data packet includes a client key comprises determining whether the data packet includes the client key at a predetermined location therein, in particular at a predetermined location within the payload of the data packet and / or within a header of the data packet.

[0038] The client key may be included in the data packet at the end of the header or at the beginning of the payload, thereby extending the standardized data packet header in particular. Providing the client key at a predetermined location allows further reduction in the processing time of the control appliance, i.e., the time required for transmitting the data packet from the client device via the control appliance to the application server, and / or allows the method to be performed in various types of network architectures.

[0039] According to one embodiment, the method further includes receiving, by the key generating appliance, an authentication key indicating authentication of the client device and / or its user, and providing, by the key generating appliance, a client key to the client device in response to receiving and / or verifying the received authentication key.

[0040] In particular, the key generating appliance may provide a client key to a client device only in response to receipt and / or verification of a received authentication key. Thus, the key generating appliance may not provide any subsequent client keys to a client device except in response to receipt and / or verification of corresponding additional or iterations of the received authentication key. Alternatively, the key generating appliance may (periodically) provide a (new) client key to a client device in response to initial receipt and / or verification of a received authentication key.

[0041] The authentication key can be received by the key generation appliance from the authentication appliance or directly from the client device. In other words, the authentication key is exchanged for a client key at the key generation appliance. The authentication key can be an authentication token, such as a JSON Web Token, that represents the authentication of the client device or its user (user account). The authentication key can include a digital signature of the authentication appliance.

[0042] Replacing the authentication key with the client key, i.e., incorporating the client key into the data packet without using the authentication key directly, not only provides additional protection against counterfeiting, but also increases the efficiency of the method, in particular the efficiency of determining / verifying the client key by the control appliance: for example, the client key may be smaller in size and can be specifically designed for the determination and verification mechanism within the control appliance.

[0043] Furthermore, the separation of the authentication key and the client key reduces the need for coordination between the control appliance / key generation appliance and the system controlled by the authentication appliance that provides the authentication key. For example, new client keys can be generated periodically, which involves changing the entire structure of the client key without having to change the authentication key or adapt the authentication appliance.

[0044] According to one embodiment, the method further includes receiving, by the key generating appliance, a platform key associated with the client device, and providing, by the key generating appliance, the client key to the client device in response to receiving and / or verifying the received platform key.

[0045] In particular, the key generation appliance may provide the client key to the client device only in response to receiving and / or verifying the received platform key. The platform key may be received from the client device. Alternatively or additionally, the platform key may be received from or via an authentication appliance. For example, the key generation appliance may provide the client key to the client device only if both the authentication key and the platform key have been received and / or verified.

[0046] The platform key may be a static key or secret that is associated with the client, i.e., burned into the client, and thus can only be changed when the client is updated. The platform key requirement allows reverse engineering attempts by malicious users to be identified, for example, when the authentication appliance receives a request for a client key with a valid authentication key but an invalid platform key, or conversely, when it receives a request for a client key with an invalid authentication key but a valid platform key.

[0047] According to one embodiment, the method further includes receiving, by the authentication appliance, user credentials for a user of the client device, and sending, by the authentication appliance, an authentication key to the key generation appliance and / or the user device in response to receiving the user credentials and / or verifying the received user credentials.

[0048] For example, a user of a client device can submit user credentials to an authentication appliance. In response, the authentication appliance can provide the user or client device with an authentication key that can be used to indicate the authentication of the user or client device to other appliances or other services. These other appliances or services only need to verify the authentication key and do not need to verify the credentials separately. Because the authentication appliance has already received and / or verified the user credentials and the control appliance operates using the client key exchanged for the authentication key, the method is more efficient and reliable. Furthermore, by providing the client key only upon authentication of the user, user account, or client device, any client key—and therefore any received data packets containing the client key—can be linked to an authenticated user, user account, or client device. This strengthens the process of identifying and blocking malicious users or user devices.

[0049] According to another, possibly independent embodiment, there is provided an apparatus for intercepting or blocking malicious network traffic, the apparatus including a control appliance and a key generation appliance, the apparatus being configured to perform any of the methods described above.

[0050] According to another, possibly independent embodiment, there is provided a system for blocking malicious network traffic, the system including the apparatus described above and an authentication appliance configured to receive user credentials of a user of a client device and to transmit an authentication key to a key generation appliance in response to receiving the user credentials and / or verifying the received user credentials.

[0051] According to one embodiment, the system further includes an application server and / or a client device.

[0052] According to another, possibly independent embodiment, there is provided a computer program comprising instructions which, when executed by a computer, cause the computer to carry out one of the methods described above.

[0053] According to another, possibly independent embodiment, a computer-readable medium is provided that includes instructions that, when executed by a computer, cause the computer to perform one of the methods described above.

[0054] The invention can be better understood by reading the following description of non-limiting embodiments with reference to the accompanying drawings, in which: [Brief explanation of the drawings]

[0055] [Figure 1] 1 is a flowchart illustrating a first method for blocking malicious network traffic. [Figure 2] 1 is a flow chart illustrating a second method that precedes the first method. [Figure 3] FIG. 1 illustrates a network system configured to perform a first method and / or a second method.

[0056] Detailed Description of the Preferred Embodiments 1 illustrates a flowchart of a method 100 for preventing or blocking malicious network traffic, particularly for preventing malicious network data packets from reaching an application server. The method 100 may be performed by at least some network components included in a network system 300 illustrated in FIG.

[0057] Method 100 begins at step 110, where a client key is provided to client device 330 by key generation appliance 340. Key generation appliance 340 may be included in network traffic control device 360. In other words, the client key can be provided to client device 330 by network traffic control device 360.

[0058] The client key may be a key generated by the key generation appliance 340. The client key may also be one specifically designed for the control process performed by the control appliance 320, as described in more detail below.

[0059] The network system 300 and method 100 may be a system and method used in a gaming application, such as an online gaming application. That is, the client device 330 may be a game client. The application server 310 may be a game server. The key generation appliance 340 may be a token API. In this specification, the client key may also be referred to as a first client key or a client token, particularly a client long token.

[0060] A client key may be generated for and / or associated with a particular client device 330. A client key may also be provided to a client device 330 in response to a request. For example, the key generation appliance 340 may provide, i.e., send, a client key to a client device 330 in response to a request received by the client device 330.

[0061] In step 120, the control appliance 320 receives a data packet from the client device 330. The data packet is intended for the application server 310. In other words, the client device 330 sends the data packet to the application server 310 via the control appliance 320.

[0062] The control appliance 320 may be included in the network traffic control device 360. In other words, data packets destined for the application server 310 may be received by the network traffic control device 360.

[0063] In step 130 , the control appliance 320 determines whether the data packet received from the client device 330 includes the client key previously provided to the client device 330 by the key generation appliance 340 in step 110 .

[0064] If the data packet received from the client device 330 includes a client key, as determined in method step 130, the control appliance 320 forwards the data packet to the application server 310. If the data packet received from the client device 330 does not include a client key, as determined in method step 130, the control appliance 320 blocks the data packet in step 150, i.e., does not forward the data packet to the application server 310.

[0065] This allows the control appliance 320, which controls network traffic between the client device 330 and the application server 310, to prevent all data packets sent from the client device 330 to the application server 310 that do not contain the client key from reaching the application server 310.

[0066] In this way, network traffic between client device 330 and application server 310 is controlled on a packet-by-packet basis. In other words, control appliance 320 can determine whether a data packet belongs to malicious network traffic or is part of a network attack, such as a DDoS attack, based on the content of the data packet itself.

[0067] That is, control appliance 320 can detect even the first malicious data packets of an attack launched against application server 310. Therefore, control appliance 320 or any other network component of network system 300 does not need to detect patterns in network traffic to identify malicious network packets. While processes based on pattern detection inherently block either too many or too few data packets, the methods described herein can (i) block all malicious data packets and (ii) block only malicious data packets in a deterministic manner.

[0068] The following provides particular details regarding method step 130 in which the control appliance 320 determines, via the key generation appliance 340, whether a data packet received from the client device 330 contains a client key previously provided to the client device 330.

[0069] The control appliance 320 can determine that a data packet contains a client key only if the client key (or a portion of the client key, or another client key derivable from the client key as described below) included in the data packet is valid. The valid client key may be the most recent or most recent client key of multiple client keys previously provided to the client device 330 by the key generation appliance 340.

[0070] A valid client key may be, for example, a client key that has not yet expired, and an expired client key may be a client key that has been replaced by a newer or subsequent client key.

[0071] Additionally or alternatively, the client key (or a portion of the client key, or another client key derivable from the client key as described below) may have a limited validity period. In other words, a client key may be determined to be an expired client key if a predetermined time interval has elapsed since the client key was generated by the key generation appliance 340 and / or provided to the client device 330. In other words, the control appliance 320 may determine the age of the client key based on, for example, a timestamp of the client key, and may determine that the client key is an expired client key if the age of the client key exceeds a predetermined threshold age. Additionally or alternatively, the control appliance 320 may determine that the client key is an expired client key if the point in time or time interval given by the timestamp of the client key has elapsed. In other words, the key generation appliance 340 may specify when the client key expires in step 110.

[0072] Thus, a new client key may be provided to the client device by the key generation appliance 340, particularly in response to a request by the client device 330, when and / or before the previous client key becomes invalid and / or expires, and / or before the previous client key expires or becomes invalid and / or before the client key expires or becomes invalid.

[0073] The control appliance 320 can further determine that a data packet contains a client key if (and only if) the data packet contains at least a portion of the client key, particularly if (and only if) the data packet contains a portion of the client key or another client key derivable from the client key. In other words, a data packet transmitted from the client device 330 to the application server 310 via the control appliance 320 may contain a second client key, a short (or small) client key, or a client short token. The second client key may represent a portion of the first (complete) client key. The second client key may be shorter and / or smaller in size than the first client key. In other words, the method can determine that a data packet contains a client key even if the data packet contains (only) the second client key.

[0074] In this way, the data packet transmitted from the client device 330 to the application server 310 via the control appliance 320 may be smaller in size and still contain a valid client key. Furthermore, the determination performed by the control appliance 320 in method step 130 as to whether the data packet contains a client key can be performed more efficiently, and in particular faster. Furthermore, the control appliance 320 can store only the second, i.e., shorter, client key in memory associated with or used by the control appliance 320, thereby further improving the efficiency of the method 100, the network traffic control device 360, and the network system 300.

[0075] The control appliance 320 may further determine in step 130 that the data packet includes a client key by determining that the data packet includes at least the second client key, and in particular only the second client key, in combination with determining that a previous data packet previously received from the client device included the (complete, i.e., first) client key.

[0076] In other words, a first data packet sent from client device 330 to application server 310 can be forwarded by control appliance 320, i.e., the first data packet can pass through control appliance 320, only if the first data packet includes the first client key or the client long key. A subsequent second data packet sent from client device 330 to application server 310 and received can be forwarded by control appliance 320 only if the second data packet includes the first client key or the second client key, i.e., the client short key.

[0077] In this way, it is ensured that the client device possesses or had possession of the first client key. Thus, the use of the client short key can improve the efficiency of the network system 300 or the method 100 while ensuring the security and / or reliability of the system and method.

[0078] The control appliance 320 can forward a second data packet from the client device 330 to the application server 310 only if the second client key included in the second data packet is associated with the first client key included in the previously received first data packet, i.e., if the second client key included in the second data packet belongs to, is derivable from, or is part of the first client key. When a new or subsequent client key is provided to the client device 330 by the key generation appliance 340, the control appliance 320 can forward a data packet including each new second client key that can represent a portion of the new first client key only if a data packet including the new first client key has previously been received. In other words, in order to have all data packets forwarded to the application server 310, the provision of the new client key by the key generation appliance 340 requires that the new client key be incorporated into every subsequent data packet sent by the client device 330.

[0079] Control appliance 330 may determine in step 130 that a data packet contains a client key if the client key included in the data packet is associated with a client device and / or its user. Control appliance 320 may store or otherwise maintain a data pair indicating that a particular client key belongs to, or is associated with, a particular client device and / or a particular user of a particular client device. Control appliance 320 may make this determination, for example, based on source information included in the data packet, particularly in the header of the data packet.

[0080] In step 130, control appliance 330 may determine that a data packet contains a client key if the data packet has the client key in a predetermined location within the data packet. For example, control appliance 330 may determine that a data packet contains a client key only if the client key is located in the header of the data packet and / or at the beginning of the payload of the data packet, or only if the client key is located in a predetermined location within the header of the data packet and / or within the payload of the data packet.

[0081] Similarly, in the above-described exemplary method steps included in method step 130, if the above-described requirements are not met, the control appliance 330 can determine that the data packet does not contain the client key and thereby block the respective data packet as described with respect to step 150.

[0082] Before providing the client key to the client device 330 by the key generation appliance 340, the method 100 may perform some or all of method steps 210-240 of the method 200, a flowchart of which is shown in FIG.

[0083] In a first method step 210, the authentication appliance 350 receives user credentials, i.e., user identification data such as a username and / or user security data such as a user password, from a user of the client device 330. The user credentials can be transmitted from the client device 330 to the authentication appliance 350.

[0084] In response to receiving and / or verifying the received user credentials, the authentication appliance 350 sends an authentication key to the user device in step 220. In other words, the client device receives an authentication key after sending the user credentials to the authentication appliance 350, i.e., after logging in to the authentication appliance 350 or an authentication service at the authentication appliance 350.

[0085] A user of a client device may have a personal account on the authentication appliance 350, which is used to authenticate the user for use of a particular service, such as joining a game residing on a game server, e.g., the application server 310. The client device 330 can use an authentication key to prove to a server, e.g., the application server 310, that it is operated by a particular user, e.g., a player, who has been authenticated by the authentication appliance 350. However, an authentication key that can be used as proof of authentication on different server systems and / or for different purposes may not be suitable or well-suited for controlling network traffic to prevent malicious data packets from reaching the application server 310. For example, the authentication key may be too long or too large to be incorporated into data packets sent from the client device 330 to the application server 310 via the control appliance 320.

[0086] The client device 330 transmits the authentication key to the key generation appliance 340, which receives the authentication key, in step 230. In exchange for the authentication key received from the client device 330, the key generation appliance 340 can provide the client key to the client device 330, along with a client key specifically associated with the client device 330, as described for method step 110.

[0087] In this way, the control appliance 320 can use the client key to determine whether or not to forward a data packet to the application server 310. A client key specifically designed for use by the control appliance 320 can be generated. Furthermore, communication of the client key between the control appliance 320 and the key generation appliance 340 can be facilitated by using a client key generated by the key generation appliance 340 rather than using an authentication key. In particular, the control appliance 320 and the key generation appliance 340 can be based on or included in the network traffic control device 360, as described above. As a further advantage, the client key can be generated and / or updated independently of the authentication key, which can be used for other purposes, thereby avoiding additional network traffic and / or additional coordination between the control appliance 330, the key generation appliance 340, and / or the authentication appliance 350. On the other hand, any data packet containing a client key can be linked to the authentication key, i.e., to a user and / or user device authenticated by an additional, independent authentication appliance.

[0088] Additionally or alternatively, the authentication appliance 350 may communicate directly with the key generation appliance 340. In particular, the authentication appliance 315 may send the authentication key associated with the client device 330 directly to the key generation appliance 340.

[0089] In addition to or instead of the authentication key, the client device 330 may transmit a platform key associated with the client device to the key generation appliance 340, which is received by the key generation appliance 340 in step 240. The key generation appliance 340 may provide the client key to the client device 330 only in response to receiving the platform key and / or the authentication key. The platform key may be static, i.e., it may not change in response to changes in the user of the client device. In this manner, both the user of the client device and the client device may be authenticated and / or verified by the key generation appliance 340 before the client key is provided to the client device 330 by the key generation appliance 340, as discussed with respect to method step 110.

[0090] Alternatively or additionally, the client device 330 may communicate the platform key or platform token to the authentication appliance 350 , which then transmits the platform key and / or authentication key to the key generation appliance 340 .

[0091] Figure 3 illustrates a network system 300 configured to perform the methods 100 and 200 illustrated in Figures 1 and 2, as described above with respect to Figures 1 and 2. In particular, Figure 3 illustrates a network traffic control device 360 ​​configured to perform the method 100 described with respect to Figure 1.

[0092] More specifically, network system 300 includes an application server 310 that is communicatively coupled to a control appliance 320 via a first network link 315. Network system 300 further includes a client device 330 that is communicatively coupled to the control appliance 320 and a key generation appliance 340 via a second link 325 and a third network link 335, respectively. Network system 300 further includes a key generation appliance 340 that is communicatively coupled to the control appliance via a fourth network link 345. Network system 300 further includes an authentication appliance 350 that is communicatively coupled to the key generation appliance 340 via a fifth network link 355 and further to the client device 330 via a sixth network link 365. [Explanation of symbols]

[0093] 100 First Method 110~150 Method steps of the first method 200 Second Method 210-240 Method steps of the second method 300 Network System 310 Application Server 315 First Network Link 320 Control Appliances 325 Second Network Link 330 client devices 335 Third Network Link 340 Key Generation Appliance 345 The Fourth Network Link 350 Authentication Appliance 355 The Fifth Network Link 360 Network Traffic Control Device 365 The Sixth Network Link

Claims

1. 1. A method for blocking malicious network traffic, the method comprising: Providing (110) a client key to a client device by a key generation appliance; receiving, by a control appliance, a data packet from the client device destined for an application server (120); determining, by the control appliance, whether the data packet includes the client key (130); forwarding (140), by the control appliance, the data packet to the application server in response to determining that the data packet includes the client key; and / or and blocking, by the control appliance, the data packet in response to determining that the data packet does not include the client key (150). Including, the client key provided to the client device is a first client key; determining whether the data packet includes the client key; determining whether the data packet includes a first client key or a second client key derivable from the first client key.

2. determining whether the data packet includes the client key; determining whether the client key included in the data packet is valid; 2. The method of claim 1, comprising:

3. determining whether the data packet includes the client key; determining whether the client key included in the data packet has expired; 2. The method of claim 1, comprising:

4. determining whether the data packet includes the client key; determining whether a previous data packet previously received from the client device includes the first client key; determining whether the data packet includes the second client key; and / or determining whether the data packet includes the client key; determining whether a previous data packet previously received from the client device includes the second client key; determining whether the data packet includes a third client key that is different from the second client key and derivable from the first client key; 2. The method of claim 1, comprising:

5. determining whether the data packet includes the client key; determining whether the client key included in the data packet is associated with the client device and / or a user of the client device; 2. The method of claim 1, comprising:

6. determining whether the data packet includes the client key; determining whether the data packet includes the client key at a predetermined location within the data packet; 2. The method of claim 1, comprising:

7. The method further comprises: receiving, by the key generation appliance, an authentication key indicative of authentication of the client device and / or a user of the client device (230); providing (110), by the key generation appliance, the client key to the client device in response to receiving and / or verifying the received authentication key; 2. The method of claim 1, comprising:

8. The method further comprises: receiving, by the key generation appliance, a platform key associated with the client device (240); providing (110), by the key generation appliance, the client key to the client device in response to receiving and / or verifying the received platform key; 2. The method of claim 1, comprising:

9. The method further comprises: receiving (210) user credentials for a user of the client device by an authentication appliance; transmitting, by the authentication appliance, an authentication key to the key generation appliance and / or user device in response to receiving the user credentials and / or verifying the received user credentials (220); 2. The method of claim 1, comprising:

10. The method comprises: receiving, by the control appliance, a plurality of data packets from the client device destined for the application server (120); determining, by the control appliance, whether a plurality of data packets includes the client key (130); forwarding (140) by the control appliance to the application server all data packets of the plurality of data packets that include the client key; and / or and blocking, by the control appliance, all data packets of the plurality of data packets that do not contain the client key (150).

2. The method of claim 1, comprising:

11. The method comprises: blocking (150) by the control appliance all data packets of the plurality of data packets that do not contain the client key; forwarding (140) the remaining data packets of the plurality of data packets to the application server; 11. The method of claim 10, comprising:

12. An apparatus (360) for blocking malicious network traffic, comprising: a control appliance (320); a key generation appliance (340); Including, The apparatus is configured to perform the method of claim 1. Apparatus (360).

13. A system (300) for blocking malicious network traffic, comprising: The device (360) of claim 12; Authentication appliance (350) and wherein the authentication appliance (350) receiving (330) user credentials for a user of the client device; transmitting an authentication key to the key generation appliance (340) in response to receiving the user credentials and / or verifying the received user credentials; The system (300) is configured as follows.

14. the system further comprising: the application server (310), and / or The client device (330) The system of claim 13, comprising:

15. A computer program comprising instructions which, when executed by a computer, cause the computer to carry out the method of any one of claims 1 to 11.

16. A computer readable medium comprising instructions which, when executed by a computer, cause the computer to perform the method of any one of claims 1 to 11.

Images