A method and system protects a security parameter negotiation server that stores
states for connection requests pending negotiations from malicious denial-of-service
attacks that attempt to flood the server with false requests. The degradation of
performance of the server is dynamically detected, such as by monitoring the running
intervals of a reaper that removes unneeded states. When performance degradation
of the system is detected, relevant performance variables such as negotiation delay,
extra retransmission delay and packet drop percentage are dynamically adjusted
to reduce the workload on the negotiation server. Limiting the number of states
with incomplete negotiation status for each client and the total number of such
states further enhances the effectiveness of the protection against denial-of-service attacks.
