CN103166784A - Method and device for retraining simple network management protocol (SNMP) message impact - Google Patents

Method and device for retraining simple network management protocol (SNMP) message impact Download PDF

Info

Publication number
CN103166784A
CN103166784A CN2011104181619A CN201110418161A CN103166784A CN 103166784 A CN103166784 A CN 103166784A CN 2011104181619 A CN2011104181619 A CN 2011104181619A CN 201110418161 A CN201110418161 A CN 201110418161A CN 103166784 A CN103166784 A CN 103166784A
Authority
CN
China
Prior art keywords
snmp message
snmp
address
illegal
network element
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN2011104181619A
Other languages
Chinese (zh)
Inventor
强伟峰
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
ZTE Corp
Original Assignee
ZTE Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by ZTE Corp filed Critical ZTE Corp
Priority to CN2011104181619A priority Critical patent/CN103166784A/en
Priority to PCT/CN2012/075306 priority patent/WO2013086832A1/en
Publication of CN103166784A publication Critical patent/CN103166784A/en
Pending legal-status Critical Current

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00Traffic control in data switching networks
    • H04L47/10Flow control; Congestion control
    • H04L47/32Flow control; Congestion control by discarding or delaying data units, e.g. packets or frames
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/02Standardisation; Integration
    • H04L41/0213Standardised network management protocols, e.g. simple network management protocol [SNMP]
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06Management of faults, events, alarms or notifications
    • H04L41/0604Management of faults, events, alarms or notifications using filtering, e.g. reduction of information by using priority, element types, position or time
    • H04L41/0622Management of faults, events, alarms or notifications using filtering, e.g. reduction of information by using priority, element types, position or time based on time

Abstract

The invention provides a method and a device for restraining simple network management protocol (SNMP) message impact. The method and the device are used for resisting the SNMP message impact. The method for retraining the SNMP message impact comprises the steps that a network unit judges whether the number of SNMP messages received within set time reaches a set limit and a judging result is obtained; and when the judging result is that the number of the SNMP messages is beyond the set limit, the network unit abandons the SNMP messages which are received within the set time and are beyond the set limit. By the adoption of the technical scheme, the SNMP message impact can be effectively resisted.

Description

Suppress the method and apparatus that the SNMP message impacts
Technical field
The invention belongs to networking technology area, more specifically, relate to the method and apparatus that a kind of SNMP of inhibition message impacts.
Background technology
Simple Network Management Protocol (SNMP) is the NMP that is most widely used in present TCP/IP network, has become the de facto standards of network management through development and application for many years.Network management based on Simple Network Management Protocol comprises two parts: Network Management Station (also being managing process, Manag er) and by to network element (also be agent equipment, Agent).
In real network is used, a large amount of SNMP messages appears sometimes, and per second reaches several thousand more than, and these SNMP messages point to same IP address.Some causes the appearance of this situation because of network equipment failure, and some is that the people is the malicious attack of carrying out.
Therefore, in prior art, there is the problem that the SNMP message impacts that is subject in the network equipment.
Summary of the invention
The invention provides the method and apparatus that a kind of SNMP of inhibition message impacts, be used for solving the prior art network equipment and have the problem that the SNMP message impacts that is subject to.
For realizing purpose of the present invention, according to an aspect of the present invention, a kind of method that provides the SNMP of inhibition message to impact, adopted following technical scheme:
The method that suppresses the impact of SNMP message comprises: network element judges whether the SNMP message amount that receives in the scheduled time reaches default limit, and gets a judged result; And when judgment result is that the SNMP message amount surpasses default limit, network element is with the SNMP packet loss that exceeds default limit that receives in the scheduled time.
Further, network element judges whether the SNMP message amount that receives in the scheduled time reaches default limit, and must a judged result comprise: network element is upgraded the quantity of the SNMP message that receives in current first scheduled time when receiving new SNMP message; And network element judges whether the current time arrived for second scheduled time, if not, judges whether the quantity of SNMP message arrives default limit.
Further, whether the SNMP message amount that receives in network element judges the scheduled time reaches default limit, and before getting a judged result, the method that suppresses the impact of SNMP message also comprises: network element filters out illegal SNMP message based on predetermined masked list.
Further, predetermined masked list is: the list that is comprised of predefined illegal IP address or illegal MAC Address.
Further, network element filters out illegal SNMP message based on predetermined masked list and comprises: network element is obtained source IP address or the source MAC of the SNMP message that receives; Network element compares source IP address or source MAC and illegal IP address or illegal MAC Address, obtains a comparative result; Network element is source IP address or source MAC when being illegal IP address or illegal MAC Address at comparative result, SNMP packet loss that will be corresponding with source IP address or source MAC.
According to another aspect of the present invention, the device that provides a kind of SNMP of inhibition message to impact, and by the following technical solutions:
The device that suppresses the impact of SNMP message comprises: judge module is used for judging whether the SNMP message amount that receives in the scheduled time reaches default limit, and gets a judged result; And first discard module, be used for when judgment result is that the SNMP message amount surpasses default limit, with the SNMP packet loss that surpasses default limit that receives in the scheduled time.
Further, judge module comprises update module, is used for upgrading the quantity of the SNMP message that receives in current first scheduled time when receiving new SNMP message; And the judgement submodule, be used for judging whether the current time arrived for second scheduled time, if not, judge whether the quantity of SNMP message arrives default limit.
Further, the device that suppresses the impact of SNMP message also comprises: filtering module is used for filtering out illegal SNMP message based on predetermined masked list.
Further, filtering module comprises acquisition module, is used for obtaining source IP address or the source MAC of the SNMP message that receives; Comparison module, be used for source IP address or source MAC and illegal IP address or illegally MAC Address compare, obtain a comparative result; And second discard module, being used at comparative result is that source IP address or source MAC are when being illegal IP address or illegal MAC Address, with source IP address or SNMP packet loss corresponding to source MAC.
Can find that technique scheme of the present invention has following advantage:
1. by the limit of message amount was set within the unit interval, in the situation that a large amount of SNMP message impact devices abandon the SNMP message that exceeds the limit part, can make equipment the machine of delaying can not occur, except having abandoned part SNMP message, other function normal operations.
2. comprise the list of illegal IP address or illegal MAC Address by setting, can filter IP address or the MAC Address of abnormal SNMP message, eliminate the impact that abnormal SNMP message causes.
Except purpose described above, feature and advantage, the present invention also has other purpose, feature and advantage.The below is with reference to figure, and the present invention is further detailed explanation.
Description of drawings
Accompanying drawing is used to provide a further understanding of the present invention, consists of the application's a part, and illustrative examples of the present invention and explanation thereof are used for explaining the present invention, do not consist of improper restriction of the present invention.In the accompanying drawings:
Fig. 1 is the main flow chart of the method for the described inhibition of embodiment of the present invention SNMP message impact;
Fig. 2 is the described SNMP message process chart with suppressing SNMP message impact method of the embodiment of the present invention;
Fig. 3 is the particular flow sheet of the method for the described inhibition of embodiment of the present invention SNMP message impact; And
Fig. 4 is the structural representation of the device of the described inhibition of embodiment of the present invention SNMP message impact.
Embodiment
Below in conjunction with accompanying drawing, embodiments of the invention are elaborated, but the multitude of different ways that the present invention can be defined by the claims and cover is implemented.
Fig. 1 is the main flow chart of the method for the described inhibition of embodiment of the present invention SNMP message impact.
Shown in Figure 1, the method that suppresses the impact of SNMP message comprises:
S101: network element judges whether the SNMP message amount that receives in the scheduled time reaches default limit, and gets a judged result; And
S103: when judgment result is that the SNMP message amount surpasses default limit, network element is with the SNMP packet loss that exceeds default limit that receives in the scheduled time.
Technique scheme by the present embodiment, the limit of message amount was set within the unit interval, in the situation that a large amount of SNMP message impact devices, abandon the SNMP message that exceeds the limit part, can make equipment the machine of delaying can not occur, except having abandoned part SNMP message, other function normal operations.
Preferentially, network element judges whether the SNMP message amount that receives in the scheduled time reaches default limit, and must a judged result comprise: network element is upgraded the quantity of the SNMP message that receives in current first scheduled time when receiving new SNMP message; And network element judges whether the current time arrived for second scheduled time, if not, judges whether the quantity of SNMP message arrives default limit.
The specific practice of above-described embodiment can for: when having the SNMP message, first upgrade the SNMP message number that current this second receives, then check that the current time is whether to next second: if arrived next second, just will represent that the SNMP message number that current this second receive asks zero; If be less than next second, just check whether the SNMP message number of current this second processing reaches the full quota, if do not reach, continue to process, if reached, abandon current SNMP message, do not deal with.
By the technique scheme of the present embodiment, when a large amount of SNMP message impacts network element, can a large amount of CPU and the memory sources of consumer device, gently affect the equipment normal operation, heavy make equipment in paralyzed state.The SNMP message limit of processing by per second is set will be over the packet loss of this limit, and the initial period that a large amount of like this messages is processed at snmp protocol just has been dropped, and has reduced taking system resource.
Preferably, whether the SNMP message amount that receives in network element judges the scheduled time reaches default limit, and before getting a judged result, the method that suppresses the impact of SNMP message also comprises: network element filters out illegal SNMP message based on predetermined masked list.
The SNMP message number of processing for the method effectively minimizing system that sets unit interval treatment S NMP message limit, but the shortcoming that exists is possible will ask to have filtered together from other legal SNMP on attacker's SNMP request and network, cause system's normal operation to be affected, technique scheme by the present embodiment, can first carry out once overanxious to the SNMP message, thereby illegal SNMP message is discarded in advance, guarantee that the method for legal SNMP message participation SNMP message limit is further processed the SNMP message.
Preferably, predetermined masked list is: the list that is comprised of predefined illegal IP address or illegal MAC Address.
For maliciously illegal or abnormal IP address and the MAC Address that belong to of knowing in advance, by setting up a list, these are belonged to malice illegal or abnormal IP address and MAC Address included, when receiving the SNMP message, obtain its source IP address or source MAC, if this source IP address or source MAC in this list, abandon corresponding with it SNMP message.
Preferably, network element filters out illegal SNMP message based on predetermined masked list and comprises: network element is obtained source IP address or the source MAC of the SNMP message that receives; Network element compares source IP address or source MAC and illegal IP address or illegal MAC Address, obtains a comparative result; Network element is source IP address or source MAC when being illegal IP address or illegal MAC Address at comparative result, SNMP packet loss that will be corresponding with source IP address or source MAC.
By the technique scheme of this enforcement, the IP address in the list of self-shileding in the future or the SNMP packet loss of MAC Address make system only process legal SNMP request.
Fig. 2 is the described SNMP message process chart with suppressing SNMP message impact method of the embodiment of the present invention.
Shown in Figure 2, for normal SNMP message handling process, add suppress SNMP message impact method concrete steps can for:
Step 201: get the data that reach from the SNMP port reads, and the data that read are put into buffering area.
Step 202: the SNMP message is suppressed SNMP message shock treatment by suppressing SNMP message impact method.
Step 203: the SNMP message is decoded, the message that receives is carried out syntactic analysis and is converted into internal form.
Step 204: security inspection checks whether this message has the mib variable of its requirement of limiting operation.
Step 205: the mapping mib variable, confirm that requested mib variable must be on main MIB tree, and can be mapped to corresponding MIB leaf node.
Step 206: corresponding data is set, after finding the leaf node of mib object on the MIB tree, just should operates to carry out corresponding function according to the GET/SET of request and read or Update Table.
Step 207: to result coding, after complete corresponding operation, the agency need to be converted into the data structure of inside the ASN.1 form, and puts into buffering area and be ready for sending.
Step 208: send the SNMP message, call the transmission function and send the data to management station.
By the technique scheme of the present embodiment, make the equipment of supporting snmp protocol possess and resist the ability that the SNMP message impacts, and this programme has the characteristics of simple highly versatile, also be fit to other protocol process module.
Fig. 3 is the particular flow sheet of the method for the described inhibition of embodiment of the present invention SNMP message impact.
Shown in Figure 3, suppress the method that the SNMP message impacts concrete steps can for:
Step 301: receive the SNMP message, get the data that reach from the SNMP port reads, and the data that read are put into buffering area.
Step 302: check source IP address in the SNMP message or source MAC whether in the list of shielding, if, program enters step 305 and abandons this SNMP message, if not in masked list, enters in 303 steps.Need IP address or the MAC Address of shielding, can be configured by modes such as order lines in advance.
Step 303: check in this link whether the SNMP message of receiving in the time period of current this second has reached the limit of setting, if reach the full quota, program enters step 305 and abandons this SNMP message, if do not reach, enter step 304 and continue to process.
Judge that the specific practice whether the SNMP message received in the time period of current this second reach the full quota is as follows: when having the SNMP message, first upgrade the SNMP message number that current this second receives, then check that the current time is whether to next second: if arrived next second, just will represent that the SNMP message number that current this second receive asks zero; If be less than next second, just check whether the SNMP message number of current this second processing reaches the full quota, if do not reach, continue to process, if reached, program abandons current SNMP message, does not deal with.
Step 304: continue the processing of SNMP message in this step, enter message normal process program.
By the technique scheme of the present embodiment, in conjunction with the mode of the mode of setting treatment S NMP message limit in the unit interval and illegal address filtration, the impact that the SNMP message is impacted system is reduced to minimum.
Fig. 4 is the structural representation of the device of the described inhibition of embodiment of the present invention SNMP message impact.
Shown in Figure 4, the device that suppresses the impact of SNMP message comprises judge module 41, is used for judging whether the SNMP message amount that receives in the scheduled time reaches default limit, and gets a judged result; And first discard module 43, be used for when judgment result is that the SNMP message amount surpasses default limit, with the SNMP packet loss that surpasses default limit that receives in the scheduled time.
Preferably, judge module 41 comprises the update module (not shown), is used for upgrading the quantity of the SNMP message that receives in the current scheduled time before receiving new SNMP message; And judgement submodule (not shown), be used for judging that the current time is whether within the cycle of a scheduled time, if judge whether the quantity of SNMP message arrives default limit.
Preferably, the device that suppresses the impact of SNMP message also comprises the filtering module (not shown), is used for filtering out illegal SNMP message based on predetermined masked list.
Preferably, the filtering module (not shown) comprises the acquisition module (not shown), is used for obtaining source IP address or the source MAC of the SNMP message that receives; The comparison module (not shown), be used for source IP address or source MAC and illegal IP address or illegally MAC Address compare, obtain a comparative result; And the second discard module (not shown), being used at comparative result is that source IP address or source MAC are when being illegal IP address or illegal MAC Address, with source IP address or SNMP packet loss corresponding to source MAC.
Pass through the above embodiment of the present invention, when a large amount of SNMP messages occurring, by the limit of message amount was set within the unit interval, in the situation that a large amount of SNMP message impact devices, abandon the SNMP message that exceeds the limit part, can make equipment the machine of delaying can not occur, except having abandoned part SNMP message, other function normal operations.Can also comprise the list of illegal IP address or illegal MAC Address by setting, can filter IP address or the MAC Address of abnormal SNMP message, eliminate the impact that abnormal SNMP message causes.
The above is only embodiments of the present invention; should be pointed out that for those skilled in the art, under the prerequisite that does not break away from the principle of the invention; can also make some improvements and modifications, these improvements and modifications also should be considered as protection scope of the present invention.

Claims (9)

1. one kind is suppressed the method that the SNMP message impacts, and it is characterized in that, comprising:
Network element judges whether the SNMP message amount that receives in the scheduled time reaches default limit, and gets a judged result; And
When judgment result is that described SNMP message amount surpasses described default limit, described network element is with the SNMP packet loss that exceeds described default limit that receives in the described scheduled time described.
2. the method for inhibition SNMP message as claimed in claim 1 impact, is characterized in that, described network element judges whether the SNMP message amount that receives in the scheduled time reaches default limit, and must a judged result comprise:
Described network element is upgraded the quantity of the described SNMP message that receives in current first scheduled time when receiving new SNMP message; And
Described network element judges whether the current time arrived for the second described scheduled time, if not, judges whether the quantity of described SNMP message arrives described default limit.
3. the inhibition as claimed in claim 1 SNMP message method of impacting, it is characterized in that, judge in described network element whether the SNMP message amount that receives in the scheduled time reaches default limit, and before getting a judged result, the method that described inhibition SNMP message impacts comprises also:
Described network element filters out illegal SNMP message based on predetermined masked list.
4. the method for inhibition SNMP message as claimed in claim 3 impact, is characterized in that, described predetermined masked list is:
The list that is formed by predefined illegal IP address or illegal MAC Address.
5. the method for inhibition SNMP message as claimed in claim 4 impact, is characterized in that, described network element filters out illegal SNMP message based on predetermined masked list and comprises:
Described network element is obtained source IP address or the source MAC of the described SNMP message that receives;
Described network element compares described source IP address or described source MAC and described illegal IP address or described illegal MAC Address, obtains a comparative result;
Described network element is described source IP address or described source MAC when being described illegal IP address or described illegal MAC Address at described comparative result, SNMP packet loss that will be corresponding with described source IP address or described source MAC.
6. one kind is suppressed the device that the SNMP message impacts, and it is characterized in that, comprising:
Judge module is used for judging whether the SNMP message amount that receives in the scheduled time reaches default limit, and gets a judged result; And
The first discard module is used for described when judgment result is that described SNMP message amount surpasses described default limit, and is described with the SNMP packet loss that surpasses described default limit that receives in the described scheduled time.
7. the device of inhibition SNMP message as claimed in claim 6 impact, is characterized in that, described judge module comprises:
Update module is for upgrade the quantity of the described SNMP message that receives in current first scheduled time when receiving new SNMP message; And
The judgement submodule is used for judging whether the current time arrived for second scheduled time, if not, judges whether the quantity of described SNMP message arrives described default limit.
8. the device of inhibition SNMP message as claimed in claim 7 impact, is characterized in that, also comprises:
Filtering module is used for filtering out illegal SNMP message based on predetermined masked list.
9. the device of inhibition SNMP message as claimed in claim 8 impact, is characterized in that, described filtering module comprises:
Acquisition module is for the source IP address or the source MAC that obtain the described SNMP message that receives;
Comparison module is used for described source IP address or described source MAC and described illegal IP address or described illegal MAC Address are compared, and obtains a comparative result; And
The second discard module, being used at described comparative result is that described source IP address or described source MAC are when being described illegal IP address or described illegal MAC Address, with described source IP address or SNMP packet loss corresponding to described source MAC.
CN2011104181619A 2011-12-14 2011-12-14 Method and device for retraining simple network management protocol (SNMP) message impact Pending CN103166784A (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN2011104181619A CN103166784A (en) 2011-12-14 2011-12-14 Method and device for retraining simple network management protocol (SNMP) message impact
PCT/CN2012/075306 WO2013086832A1 (en) 2011-12-14 2012-05-10 Method and device for suppressing impact of snmp packets

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN2011104181619A CN103166784A (en) 2011-12-14 2011-12-14 Method and device for retraining simple network management protocol (SNMP) message impact

Publications (1)

Publication Number Publication Date
CN103166784A true CN103166784A (en) 2013-06-19

Family

ID=48589537

Family Applications (1)

Application Number Title Priority Date Filing Date
CN2011104181619A Pending CN103166784A (en) 2011-12-14 2011-12-14 Method and device for retraining simple network management protocol (SNMP) message impact

Country Status (2)

Country Link
CN (1) CN103166784A (en)
WO (1) WO2013086832A1 (en)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6513122B1 (en) * 2001-06-29 2003-01-28 Networks Associates Technology, Inc. Secure gateway for analyzing textual content to identify a harmful impact on computer systems with known vulnerabilities
CN101184085A (en) * 2007-12-13 2008-05-21 华为技术有限公司 IP telephone terminal and safety communication method thereof
CN101286996A (en) * 2008-05-30 2008-10-15 北京星网锐捷网络技术有限公司 Storm attack resisting method and apparatus
CN101296182A (en) * 2008-05-20 2008-10-29 华为技术有限公司 Data transmission control method and data transmission control device
CN101582838A (en) * 2008-05-13 2009-11-18 原创信通电信技术(北京)有限公司 Resource management method of IP telecommunications network routing/exchanging equipment based on threshold value control

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101834743A (en) * 2010-04-27 2010-09-15 中兴通讯股份有限公司 Processing method and device of SNMP (Simple Network Management Protocol) request message

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6513122B1 (en) * 2001-06-29 2003-01-28 Networks Associates Technology, Inc. Secure gateway for analyzing textual content to identify a harmful impact on computer systems with known vulnerabilities
CN101184085A (en) * 2007-12-13 2008-05-21 华为技术有限公司 IP telephone terminal and safety communication method thereof
CN101582838A (en) * 2008-05-13 2009-11-18 原创信通电信技术(北京)有限公司 Resource management method of IP telecommunications network routing/exchanging equipment based on threshold value control
CN101296182A (en) * 2008-05-20 2008-10-29 华为技术有限公司 Data transmission control method and data transmission control device
CN101286996A (en) * 2008-05-30 2008-10-15 北京星网锐捷网络技术有限公司 Storm attack resisting method and apparatus

Also Published As

Publication number Publication date
WO2013086832A1 (en) 2013-06-20

Similar Documents

Publication Publication Date Title
CN108063765B (en) SDN system suitable for solving network security
CN101136922B (en) Service stream recognizing method, device and distributed refusal service attack defending method, system
CN101589595B (en) A containment mechanism for potentially contaminated end systems
CN101547187B (en) Network attack protection method for broadband access equipment
CN102739683B (en) A kind of network attack filter method and device
CN104137513B (en) Attack prevention method and equipment
CN109688105B (en) Threat alarm information generation method and system
CN101505219B (en) Method and protecting apparatus for defending denial of service attack
CN106656989B (en) Flow monitoring method and terminal
CN101286996A (en) Storm attack resisting method and apparatus
CN101098227A (en) User safety protection method of broadband access equipment
CN109657463B (en) Method and device for defending message flooding attack
CN101227289A (en) Uniform intimidation managing device and loading method of intimidation defense module
CN100420197C (en) Method for guarding against attack realized for networked devices
CN101895552B (en) Security gateway and method thereof for detecting proxy surfing
CN107360182B (en) Embedded active network defense system and defense method thereof
CN102594834B (en) Method and device for defending network attack and network equipment
CN101378312B (en) Safety payment control system and method based on broadband network
CN108737344B (en) Network attack protection method and device
CN107547561B (en) Method and device for carrying out DDOS attack protection processing
CN105516200A (en) Cloud system security processing method and device
CN101826991A (en) Method and system for identifying illegal data packet
CN104601578A (en) Recognition method and device for attack message and core device
CN103166784A (en) Method and device for retraining simple network management protocol (SNMP) message impact
JP4322179B2 (en) Denial of service attack prevention method and system

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
WD01 Invention patent application deemed withdrawn after publication

Application publication date: 20130619

WD01 Invention patent application deemed withdrawn after publication