Low-delay TCP cross-message firewall detection method
A technology of text firewall and detection method, which is applied in the direction of electrical components, transmission systems, etc., can solve the problems of large delay, small delay, and inability to detect cross-message attacks, etc., and achieve the effect of reducing delay
- Summary
- Abstract
- Description
- Claims
- Application Information
AI Technical Summary
Problems solved by technology
Method used
Image
Examples
Embodiment 1
[0028] The present invention is realized through the following technical solutions, as figure 1 As shown, a low-latency TCP cross-message firewall detection method, when there are N packets detected, first backup the packets 2-N in the buffer, and then send them to the data receiving end; at the same time, in the buffer Assemble and detect message 1-packet N; if an attack is detected, block processing; if no attack is detected, send message 1 to the data receiving end, clear the buffer, and repeat the above operations until the detection is completed.
[0029] It should be noted that, through the above improvements, the present invention utilizes the principle that the receiving end of TCP data needs to recombine data to process, bypasses the first message and forwards the following messages first, so that only the first IP message is delayed , while the subsequent packet delay is small. At the same time, if the data receiving end does not receive the message 1, it cannot be ...
Embodiment 2
[0031] This embodiment is further optimized on the basis of the above embodiments, such as figure 1 Shown, step by step, in order to realize the present invention better, specifically comprise the following steps:
[0032] Step S1: The buffer receives message 1-message N, and determines whether the received message is message 1 or message 2-N;
[0033] If it is message 1, store it directly;
[0034] If it is a message 2-N, store and send the message 2-N to the data receiving end;
[0035] Step S2: Assemble and detect the message 1 and message 2-N in the buffer according to the TCP sequence number;
[0036] If an attack is found, block it;
[0037] If no attack is found, send the buffer message 1 to the data receiving end, and clear the buffer messages 1-N.
[0038] It should be noted that through the above improvements, even if the attack data has been sent to the data receiving end, since the data receiving end has not received the message 1, the data receiving end cannot...
Embodiment 3
[0042] This embodiment is further optimized on the basis of the above embodiments, such as figure 1 As shown, further, in order to better realize the present invention, the blocking processing in the step S2 specifically refers to: discarding the message 1, or sending the RST message to the receiving end.
[0043] Further, in order to better realize the present invention, the data receiving end is a data receiving end based on the TCP protocol stack.
[0044] Other parts of this embodiment are the same as those of the foregoing embodiments, so details are not repeated here.
PUM
Login to View More Abstract
Description
Claims
Application Information
Login to View More