Method and device for preventing attack under transmission control protocol (TCP)

Abstract

The invention discloses a method and device for preventing an attack under a transmission control protocol (TCP). The method comprises the following steps: receiving a request synchronization message which is sent by a client and requests to establish a session with a sever; sending a first confirmation message to the client; receiving a second confirmation message sent by the client; judging whether the request synchronization message belongs to an attack message based on the second confirmation message; if the request synchronization message is judged to belong to the attack message, abandoning the request synchronization message; and if the request synchronization message is judged to belong to a legal message, establishing a session table between the client and the server. By using the method and device disclosed by the embodiment of the invention, under the condition of a large number of SYN Flood attacks, the attacks can be effectively prevented, and normal connection between a user and the server can be guaranteed; and therefore, the service experience is enhanced.

Description

technical field [0001] The present invention relates to the technical field of communication, and more specifically, relates to a method and device for preventing attacks under the transmission control protocol TCP. Background technique [0002] With the development of the field of communication technology, the traffic volume of telecommunication data also increases rapidly. Undoubtedly, the network will also face various security challenges, and the attack of SYN flood traffic is a typical one. This attack uses a large number of data packets to attack the target system and consumes the resources of the target system so that legitimate users cannot use network services normally. [0003] In order to protect the server behind the network device, the TCP Proxy scheme is generally used, that is to say, the network device first establishes a connection with the proxy server, and only establishes a connection with the real server when the real data packet arrives. [0004] At p...

AI Technical Summary

Problems solved by technology

[0005] But, adopt above-mentioned prior art, under the situation of a large amount of SYN Flood attacks, because when receiving each SYN message that attacker sends, proxy server all needs to establish session table, so can consume the session table resource of proxy server , causing normal users to be unable to connect to the server

Images