Method for guarding against attack realized for networked devices

A network device and anti-attack technology, which is applied in the network field, can solve problems such as poor anti-attack capabilities and affect normal business, and achieve the effect of preventing attacks, enhancing defense capabilities, and maintaining network order

CN100420197CActive Publication Date: 2008-09-17HUAWEI TECH CO LTD
4 Cites 0 Cited by

Patent Information

Authority / Receiving Office
CN · China
Patent Type
Patents(China)
Current Assignee / Owner
Publication Date
2008-09-17

Smart Images

  • Figure 1
    Figure 1
Patent Text Reader

Abstract

The method includes following steps: When receiving message, network device looks up corresponding connection list item based on relevant information in message; if finding connection list item, forwarding message according to corresponding forwarding list item; otherwise, based on IP address in message, obtaining number of connection built by the user of sending message, and determining whether the number is less than presetting value; if yes, building connection list item and forwarding list item for the user as well as carrying out service treatment; other wise discarding out the said message. Through restricting number of connection from same user, the invention prevents attacks. Moreover, if the said number exceeds specific number, new connection message from the user is discarded. Thus, the invention guarantees that resources will not be exhausted when system encounters attacks from network storm, and system still is able to provide normal operation so as to raise ability of system for anti attack.
Need to check novelty before this filing date? Find Prior Art

Description

technical field

[0001] The invention relates to network technology, in particular to a method for realizing network equipment attack prevention. Background technique

[0002] In recent years, the application of the network has been popularized rapidly, and the rapid development of the network has left a large number of system and protocol loopholes. While enjoying the convenience brought by the network, users also face the threats it brings. The following are some commonly used attack methods and principles:

[0003] TCP SYN Flood: When a user makes a standard Transmission Control Protocol (TCP) connection, there will be a 3-way handshake process. The first is to request the server to send a synchronization message. After receiving the synchronization message, the server will send a synchronization confirmation message back to the requester to indicate confirmation. When the requester receives the synchronization confirmation message, it will send a reception confirmation m...

Examples

Embodiment Construction

[0024] The invention prevents TCP SYN Flood and UDP Flood attacks by limiting the number of transmission control protocol / user datagram protocol (TCP / UDP) connections of each user.

[0025] The network storm (SYN Flood) attack is that the attacker sends a large number of first packet packets SYN to the server, and the server will send the first packet response packet SYN ACK after receiving each first packet packet, and establish the transmission control protocol (TCP) Half-open the connection, and then wait for the response message ACK from the client side. But the attacker will not send the response message ACK that the server is waiting for, causing the server to be full of half-open connections. Because the server keeps sending out the first packet response message SYN ACK without any response, the server is in an abnormally busy state, making it difficult to process normal connection requests, and eventually causing normal business interruption.

[0026] Since the transm...