Transmission control protocol blocking module and soft switch method

Abstract

The TCP interception module includes monitoring module, halting module, and soft switching module. The monitoring module is in use for monitoring TCP connection request initiated from external host to inner server, and determining whether router is attacked by external network. The halting module is in use for halting TCP connection request initiated from external host to inner server as well as replacing the protected server to respond to TCP connection request initiated from external network. The soft switching module is n use for switching working modes of router between the monitoring mode and the halting mode freely. Simplifying flow for processing former monitoring mode, the invention does not increase processing complexity of the interception module. Advantages are: flexible working-modes, switching between modes freely, reduced system overhead, and raised utilization ratio of CPU.

Description

technical field [0001] The invention relates to the field of security attack prevention in network communication, in particular to a security attack prevention technology TCP (Transfer Control Protocol) interception method. Background technique [0002] With the rapid development of the Internet, its applications are becoming more and more extensive, and the security of the network has attracted more and more attention. Because the attacks against the network are increasingly rampant, the security of the network is an important bottleneck restricting the development of the Internet. . Whether it is the application layer software, the operating system, or the hardware itself, there are security vulnerabilities. The network protocol itself also has security risks, which provide opportunities for network hackers to attack network systems. DDOS (Distributed Denial of Service attack) is a popular network attack method in recent years. Once implemented, the attack network packet...

AI Technical Summary

Problems solved by technology

However, routers working in this mode cannot really protect internal servers, because SYN-flood attack packets can reach internal servers

[0007] Therefore, the existing TCP interception technology has the following deficiencies: the working mode is single, and it can only work in one of these two modes

However, network hackers are always waiting for opportunities. The network environment is not safe. When the network is under attack, if the router is in monitoring mode, it cannot really protect the internal server, because a large number of flooding packets arrive at the server in an instant. , which will cause the resources in the service period to be exhausted quickly and cause service denial

Images