A communication connection establishment method and a computing device

Abstract

The embodiment of the application provides a kind of communication connection establishment method and computing device, it is related to communication technical field, can effectively prevent TCP half-connection attack.The method comprises the following steps: the client sends request message to authorized end;In the case where the identity of the client is legal, the authorized end sends verification information to server;The client sends first handshake message to server;Server verifies first handshake message based on verification information;In the case where first handshake message is verified, second handshake message is sent to client;Second handshake message is the response to first handshake message;The client responds to second handshake message, and sends third handshake message to server;Third handshake message is the response of the client to second handshake message;Establish communication connection with server.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a communication connection establishment method and computing device. Background Technology

[0002] When data transmission is required between a client and a server, a communication connection must be established based on the Transmission Control Protocol (TCP) three-way handshake process to ensure reliable data transmission. During the TCP three-way handshake, if the server has received the client's connection request but has not yet successfully established a communication connection, the server will set a half-open state to maintain the connection establishment process between the client and the server. This half-open state consumes server resources.

[0003] Currently, some malicious attackers exploit this situation by sending a large number of connection establishment requests without executing the subsequent processes, causing the server to have a large number of half-open connections, resulting in significant resource consumption and even server crashes. This type of malicious attack is known as a TCP half-open connection attack. Summary of the Invention

[0004] This application provides a communication connection establishment method and computing device that can effectively prevent TCP half-open connection attacks.

[0005] In a first aspect, embodiments of this application provide a method for establishing a communication connection, applied to a server. The method includes: receiving verification information sent by an authorization terminal; the verification information being used to verify the legality of a client's first handshake message; receiving the first handshake message sent by the client; the first handshake message being used to request the establishment of a communication connection; verifying the first handshake message based on the verification information; if the first handshake message passes verification, sending a second handshake message to the client; receiving a third handshake message sent by the client, the third handshake message being the client's response to the second handshake message; and establishing a communication connection with the client.

[0006] The technical solution of this application embodiment sets up an authorization terminal. Before the client initiates a request to the server to establish a communication connection, it first sends a request message to the authorization terminal so that the authorization terminal can verify the client's identity and legitimacy. If the client is deemed legitimate, the authorization terminal sends verification information to the server. This verification information can be used to verify the first handshake message sent by the client when requesting to establish a connection. In this way, only after the first handshake message is verified successfully will the server continue to execute the subsequent process to establish a communication connection. It can be seen that the technical solution of this application embodiment, by introducing an authorization terminal, moves the process of verifying the client's legitimacy before receiving the first handshake message, and does not rewrite the first handshake message. By having the authorization terminal verify the client's legitimacy and then generating verification information and sending it to the server, the server can perform verification again after receiving the first handshake message, thereby ensuring that the client sends a normal connection establishment request and effectively preventing TCP half-open connection attacks.

[0007] In one possible implementation, the method further includes discarding the first handshake message if it fails verification. This means that if verification fails, the first handshake message is invalid, and the server does not need to respond to it, thus avoiding the need to expend resources to set up a half-open connection and effectively preventing TCP half-open connection attacks.

[0008] In another possible implementation, the verification information includes at least one of the following: source address, source port, destination port, sequence number of the first handshake message, and expected request time period. The first handshake message passes verification if at least one of the following conditions is met: the sending address of the first handshake message matches the source address in the verification information; the source port carried in the first handshake message matches the source port in the verification information; the destination port carried in the first handshake message matches the destination port in the verification information; the sequence number carried in the first handshake message matches the sequence number in the verification information; and the time the first handshake message is received falls within the expected request time period in the verification information. It can be seen that this comparison-based verification method has low computational complexity and low server-side computing power requirements, allowing the server to allocate more computing resources to service provision and ensuring a better user experience.

[0009] In another possible implementation, the method further includes: receiving an authorization validity period sent by the authorizing end; the authorization validity period is used to indicate the effective time of the verification information; verifying the first handshake message based on the verification information, including: verifying the first handshake message based on the verification information within the authorization validity period. By sending the authorization validity period of the verification information to the server, the authorizing end enables the server to determine the validity period of the verification information. After the authorization validity period expires, the server can delete the verification information to ensure security and save server space.

[0010] In another possible implementation, the first, second, and third handshake messages conform to the format specified by the Transmission Control Protocol (TCP). Compared with related technologies, this solution does not rewrite the content of the messages during the three-way handshake process, allowing most devices to use this solution to establish communication connections. It has better network compatibility and a wider range of application scenarios.

[0011] Secondly, embodiments of this application provide a communication connection establishment method applied to an authorization end. The method includes: receiving a request message sent by a client; the request message is used to request verification of the client's identity legitimacy; if the client's identity is determined to be legitimate, sending verification information to a server; the verification information is used by the server to verify the legitimacy of the client's first handshake message, and the first handshake message is used by the client to request the establishment of a communication connection with the server.

[0012] In one possible implementation, if the client's identity is determined to be legitimate, the method further includes: sending a response message to the client indicating that the client's identity is legitimate; the response message is used to trigger the client to send the first handshake message to the server.

[0013] In another possible implementation, the request message includes: at least one field and mask information; the mask information is used to indicate the field in the at least one field that serves as verification information; sending verification information to the server includes: generating verification information based on the field indicated by the mask information; and sending the verification information to the server.

[0014] Thirdly, embodiments of this application provide a method for establishing a communication connection, applied to a client. The method includes: sending a request message to an authorization terminal; the request message is used to request verification of the client's identity; if the client is legitimate, triggering the authorization terminal to send verification information to a server; the verification information is used by the server to verify the legitimacy of the client's first handshake message; the first handshake message is used by the client to request the establishment of a communication connection with the server; sending the first handshake message to the server; receiving a second handshake message sent by the server; the second handshake message is the server's response to the first handshake message; in response to the second handshake message, sending a third handshake message to the server; and establishing a communication connection with the server.

[0015] In one possible implementation, after sending a request message to the authorizing end, the method further includes: receiving a response message from the authorizing end; sending a first handshake message to the server, including: sending a first handshake message to the server if the response message indicates that the client's identity is legitimate.

[0016] In another possible implementation, after sending the first handshake message to the server, the method further includes: if a second handshake message is not received from the server after a preset time, resending the first handshake message to the server.

[0017] Fourthly, embodiments of this application provide an establishment apparatus applied to a server, comprising: a receiving module, a verification module, a sending module, and an establishment module. The receiving module is used to receive verification information sent by an authorization terminal; the verification information is used to verify the legality of the client's first handshake message; the receiving module is also used to receive the first handshake message sent by the client; the first handshake message is used to request the establishment of a communication connection; the verification module is used to verify the first handshake message based on the verification information; the sending module is used to send a second handshake message to the client if the first handshake message passes verification; the second handshake message is a response to the first handshake message; the receiving module is also used to receive a third handshake message sent by the client in response to the second handshake message, the third handshake message being the client's response to the second handshake message; the establishment module is used to establish a communication connection with the client.

[0018] In one possible implementation, the above apparatus further includes a discarding module. The discarding module is used to discard the first handshake message if the first handshake message fails to pass authentication.

[0019] In another possible implementation, the verification information includes at least one of the following: source address, source port, destination port, sequence number of the first handshake message, and expected request time period; the first handshake message passes verification if at least one of the following conditions is met: the sending address of the first handshake message matches the source address in the verification information; the source port carried in the first handshake message matches the source port in the verification information; the destination port carried in the first handshake message matches the destination port in the verification information; the sequence number carried in the first handshake message matches the sequence number in the verification information; and the time when the first handshake message is received falls within the expected request time period in the verification information.

[0020] In another possible implementation, the receiving module is also used to receive the authorization validity period sent by the authorizing end; the authorization validity period is used to indicate the effective time of the verification information; the verification module is specifically used to verify the first handshake message based on the verification information within the authorization validity period.

[0021] In another possible implementation, the first handshake message, the second handshake message, and the third handshake message are messages that conform to the format specified by the Transmission Control Protocol (TCP).

[0022] Fifthly, embodiments of this application provide an establishment apparatus applied to an authorization terminal, comprising: a receiving module and a sending module. The receiving module is configured to receive a request message sent by a client; the request message is used to request verification of the client's identity legitimacy; the sending module is configured to, if the client's identity is determined to be legitimate, send verification information to the server; the verification information is used by the server to verify the legitimacy of the client's first handshake message, the first handshake message being used by the client to request the establishment of a communication connection with the server.

[0023] In one possible implementation, the sending module is further configured to send a response message to the client indicating that the client's identity is legitimate; the response message is used to trigger the client to send the first handshake message to the server.

[0024] In another possible implementation, the request message includes: at least one field and mask information; the mask information is used to indicate the field in the at least one field that serves as verification information; the sending module is specifically used to generate verification information based on the field indicated by the mask information; and send the verification information to the server.

[0025] Sixthly, embodiments of this application provide an establishment apparatus applied to a client, comprising: a sending module, a receiving module, and an establishment module. The sending module is configured to send a request message to an authorization end; the request message is used to request verification of the client's identity; if the client is legitimate, the authorization end is triggered to send verification information to the server; the verification information is used by the server to verify the legitimacy of the client's first handshake message; the first handshake message is used by the client to request the establishment of a communication connection with the server; the sending module is further configured to send the first handshake message to the server; the receiving module is configured to receive a second handshake message sent by the server; the second handshake message is the server's response to the first handshake message; the receiving module is further configured to, in response to the second handshake message, send a third handshake message to the server; the establishment module is configured to establish a communication connection with the server.

[0026] In one possible implementation, the receiving module is further configured to receive a response message from the authorized end; the sending module is specifically configured to send a first handshake message to the server when the response message indicates that the client's identity is legitimate.

[0027] In another possible implementation, the sending module is also used to resend the first handshake message to the server if it does not receive the second handshake message from the server after a preset time.

[0028] In a seventh aspect, embodiments of this application provide a computing device including a processor and a memory; the processor is coupled to the memory; the memory is used to store computer instructions, which are loaded and executed by the processor to enable the computing device to implement the methods described in the first to third aspects.

[0029] Eighthly, embodiments of this application provide a computer-readable storage medium comprising: computer software instructions; which, when executed in a computing device, cause the computing device to implement the methods described in the first to third aspects.

[0030] Ninthly, embodiments of this application provide a computer program product that, when run on a computing device, causes the computing device to execute the steps of the related methods described in the first aspect above, so as to implement the methods of the first to third aspects above.

[0031] The beneficial effects of aspects two through nine mentioned above can be referred to the corresponding description of aspect one, and will not be repeated here. Attached Figure Description

[0032] Figure 1 A schematic diagram of a semi-connection provided in an embodiment of this application;

[0033] Figure 2A schematic diagram illustrating a TCP half-open connection attack provided in an embodiment of this application;

[0034] Figure 3 A schematic diagram of a system architecture provided for an embodiment of this application;

[0035] Figure 4 A schematic diagram of a system architecture for a computing device provided in an embodiment of this application;

[0036] Figure 5 A flowchart illustrating a communication connection establishment method provided in an embodiment of this application;

[0037] Figure 6 A flowchart illustrating another communication connection establishment method provided in an embodiment of this application;

[0038] Figure 7 A flowchart illustrating another communication connection establishment method provided in an embodiment of this application;

[0039] Figure 8 A schematic diagram of the composition of a first communication connection establishment device provided in an embodiment of this application;

[0040] Figure 9 A schematic diagram illustrating the composition of a second communication connection establishment device provided in an embodiment of this application;

[0041] Figure 10 A schematic diagram of the composition of a third communication connection establishment device provided in an embodiment of this application;

[0042] Figure 11 This is a schematic diagram of the composition of a computing device provided in an embodiment of this application. Detailed Implementation

[0043] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0044] It should be noted that in the embodiments of this application, the words "exemplarily" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design scheme described as "exemplarily" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design schemes. Specifically, the use of the words "exemplarily" or "for example" is intended to present the relevant concepts in a specific manner.

[0045] To facilitate a clear description of the technical solutions of the embodiments of this application, the terms "first" and "second" are used in the embodiments of this application to distinguish the same or similar items with essentially the same function and effect. Those skilled in the art can understand that the terms "first" and "second" are not intended to limit the quantity or execution order.

[0046] The following is a brief introduction to the technical terms used in the embodiments of this application:

[0047] 1. TCP: A connection-oriented, reliable, byte-stream-based transport layer communication protocol. Computing devices in a communication network rely on the TCP three-way handshake process to provide reliable communication services.

[0048] 2. Three-way handshake: The process of establishing a communication connection between computing devices based on TCP. Each handshake corresponds to one message sending and receiving process. Taking a client requesting a service from a server as an example, the client needs to establish a communication connection with the server before it can obtain the services provided by the server. First, the first handshake is when the client sends a first handshake message to the server, requesting to establish a communication connection. This process not only proves that the client has a connection requirement but also proves that the client has the ability to write, that is, it can normally generate messages for communication. The second handshake is when the server sends a second handshake message to the client, informing the client that it has received the first handshake message. This process proves that the server has the ability to read and write, that is, it can normally read the content of the messages and respond. The third handshake is when the client sends a third handshake message to the server, confirming the establishment of the connection. This process proves that the client has the ability to read, that is, it can normally read the messages. After the three-way handshake process, both the client and the server can confirm that the other party has normal read and write capabilities, and therefore can communicate normally. Furthermore, during the three-way handshake, the different sequences of handshake messages are distinguished by flag bits in the messages. The first handshake message carries a synchronization sequence number (SYN) flag, indicating that this message is used to establish a connection. The second handshake message carries both a SYN flag and an acknowledgement character (ACK) flag, indicating that the first handshake message has been received and acknowledged. The third handshake message carries an ACK flag, indicating that the second handshake message has been received. Therefore, the first handshake message can also be called a SYN message, the second handshake message can also be called a SYN,ACK message, and the third handshake message can also be called an ACK message.

[0049] 3. Server-side: In the TCP communication process, the server provides the service. It listens for and waits for communication requests from clients, and upon receiving a request, establishes a communication connection with the client through a three-way handshake. The server is typically a single server or a cluster of multiple servers. For example, the server could be a server belonging to the company providing the service.

[0050] 4. Client: In TCP communication, the client initiates the request. Before initiating a request, the client needs to know the server's Internet Protocol (IP) address and port. After the three-way handshake process, the client can obtain the services provided by the server. The client is typically a user-side device, such as a user's mobile terminal or personal computer.

[0051] 5. Attacker: During TCP communication, an attacker impersonates a legitimate client to launch an attack on the server. The attacker attempts to mimic client behavior to prevent the server from providing normal services.

[0052] 6. Half-connected state: Figure 1 This is a schematic diagram of a semi-connected structure provided in an embodiment of this application. Figure 1 As shown, the three-way handshake process is continuous. From the moment the server receives the first handshake message until it receives the third, the server has determined that a client needs to establish a communication connection, but the connection is not yet fully established. Therefore, the server must maintain a process to keep track of this communication process and ensure the successful establishment of subsequent connections. This process of the server maintaining a process can be called setting a half-open connection. The maintained process consumes the server's memory and network port resources.

[0053] As described in the background section, the half-open connection state can be maliciously exploited by attackers. After sending a large number of first handshake messages to request the establishment of a connection, the attacker does not respond to the second handshake messages sent by the server, causing the server to consume resources to set up a half-open connection state. Figure 2 This is a schematic diagram of a TCP half-open connection attack provided in an embodiment of this application, as shown below. Figure 2 As shown, an attacker sends a large number of first handshake packets to the server by forging fake addresses. The server then returns a second handshake packet to the fake address. Because the address is fake, the second handshake packet cannot reach the attacker, and the server naturally does not receive the third handshake packet. This results in a large number of half-open connections being set up on the server, leading to a backlog of half-open connections and consuming a significant amount of memory and network port resources. This attack method is called a TCP half-open connection attack. It not only affects other legitimate clients' normal use of the server's services but can also cause the server to crash in severe cases.

[0054] The following is a brief introduction to two related technologies for preventing TCP half-open connection attacks.

[0055] One related technology achieves this by recording the duration of the half-open connection state. Specifically, the timer starts when the half-open connection is generated, and once the time spent establishing the connection (also known as the duration) exceeds a set threshold, the server cancels the half-open connection. This method aims to allow the server to promptly terminate half-open connections that may have been created due to attacks, thereby reducing network load and improving server reliability.

[0056] In this technique, the server starts a timer for each client connection to calculate the time spent establishing the connection. Once the connection is successfully established, the timer stops. When the duration of a half-open connection exceeds a predetermined time limit, the server cancels the half-open connection and terminates the connection to prevent TCP half-open connection attacks. While this can mitigate TCP half-open connection attacks to some extent, it also has the following drawbacks: First, setting an appropriate time threshold is challenging because different time thresholds may be needed depending on the network environment and application scenario. A threshold that is too short may cause the server to misjudge a normal connection, affecting legitimate clients' normal service use. A threshold that is too long may not effectively prevent half-open connection attacks. Second, attackers can circumvent this simple timer method by frequently changing their IP address or using multiple fake IP addresses. This means the server may receive connection requests from multiple fake IP addresses simultaneously, requiring the server to maintain a large number of half-open connections during that time period, resulting in wasted resources. Therefore, this technique cannot effectively prevent TCP half-open connection attacks.

[0057] Another related technique achieves this by embedding verification information in the initial handshake message. The core idea of ​​this technique is to introduce additional verification information at the initial stage of connection establishment, so that the server can verify the legitimacy of the connection request upon receiving it. This verification information can contain specific identifiers or hash values ​​used to verify the authenticity of the connection request.

[0058] In this technique, the client embeds additional verification information into the first handshake message, and the server verifies it upon receiving it. If the verification information is valid, the server allows the connection to continue (responding with a second handshake message and setting the connection to a half-open state). Conversely, if the verification information is invalid, the server rejects the connection, ignoring or discarding the first handshake message, thus preventing TCP half-open connection attacks. While this improves defense against TCP half-open connection attacks to some extent, it also has some significant drawbacks: First, this method requires adding verification information to the first handshake message, introducing a new information transmission mechanism to existing network protocols, which may lead to incompatibility with some network devices. Second, attackers can still circumvent this verification mechanism by simulating valid verification information or using other cracking methods. Furthermore, if the generation and verification of the verification information are too simple, attackers can easily crack it, reducing the effectiveness of the technique. If the generation and verification of the verification information are too complex, it places high demands on the server's equipment, resulting in significant computing costs and potentially affecting the server's ability to provide services.

[0059] In conclusion, how to effectively prevent TCP half-open connection attacks is an urgent problem to be solved.

[0060] This application provides a method for establishing a communication connection, which can be applied to... Figure 3 In the system architecture shown. For example... Figure 3 As shown, the system includes a client, an authorization terminal, and a server. The technical solution of this application embodiment sets up an authorization terminal. Before the client initiates a request to the server to establish a communication connection, it first sends a request message to the authorization terminal so that the authorization terminal can verify the client's identity and legitimacy. If the client is deemed legitimate, the authorization terminal sends verification information to the server. This verification information can be used to verify the first handshake message sent by the client when requesting to establish a connection. Thus, only after the first handshake message verification is successful will the server continue to execute subsequent processes to establish a communication connection. It can be seen that the technical solution of this application embodiment, by introducing an authorization terminal, moves the process of verifying the client's legitimacy before receiving the first handshake message, and does not rewrite the first handshake message. By having the authorization terminal verify the client's legitimacy and then generating verification information to send to the server, the server performs verification again after receiving the first handshake message, thereby ensuring that the client sends a normal connection establishment request and effectively preventing TCP half-open connection attacks.

[0061] The embodiments provided in this application will now be described in detail with reference to the accompanying drawings.

[0062] In the technical solution provided in this application embodiment, the client, server, and authorization end can all be computing devices (wherein, the server and authorization end can be integrated on the same computing device or on different computing devices). The computing device can be a server. Specifically, in terms of form, the server can be a blade server, a high-density server, a rack server, or a full-rack server. In terms of function, the server can be a general-purpose server, a graphics processing unit (GPU) server, an artificial intelligence (AI) server, etc. Figure 4 A schematic diagram of the system architecture of a computing device, such as Figure 4 As shown, the hardware of this computing device includes a processor, an out-of-band controller, external storage, and RAM. The software includes an out-of-band management module and an operating system (OS).

[0063] The out-of-band management module runs within the out-of-band controller, while the OS runs on the processor (e.g., ...). Figure 4 (As shown).

[0064] The out-of-band management module can be a management unit for non-business modules. For example, the out-of-band management module can remotely maintain and manage the computing device through a dedicated data channel. This out-of-band management module is completely independent of the computing device's operating system and can communicate with the basic input / output system (BIOS) and the operating system through the computing device's out-of-band management interface.

[0065] For example, an out-of-band management module may include a management unit for the operating status of a computing device, a management system in a management chip outside the processor, a system management mode (SMM), etc. It should be noted that the specific form of the out-of-band management module is not limited in the embodiments of this application; the above is merely an illustrative example.

[0066] Memory, also known as internal memory or main memory, is installed in memory slots on the motherboard of a computing device. Memory communicates with the memory controller via memory channels. Memory has at least one memory rank, each memory rank located on one face of the memory. Each memory rank includes at least one subrank. Each memory rank or subrank comprises multiple memory chips. Each memory chip is divided into multiple bankgroups. Each bankgroup comprises multiple banks. Each bankgroup is divided into multiple cells. Each cell has a row address and a column address, and each cell includes one or more bits. In one partitioning method, memory can be divided from top to bottom into memory chips, bankgroups, bankgroups, rows / columns, cells, and bits. The addresses of memory chips, bankgroups, bankgroups, rows, columns, cells, and bits on memory are actual physical addresses. In another partitioning method, the CPU divides the memory chip into multiple memory pages based on a paging mechanism. The address of the memory page is a virtual address, which needs to be translated into a real physical address.

[0067] External storage devices can be plug-in hard drives, smart media cards (SMC), secure digital (SD) cards, flash cards, etc., or external storage devices such as USB flash drives.

[0068] It should be noted that the system architecture and application scenarios described in the embodiments of this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided in the embodiments of this application. As those skilled in the art will know, with the evolution of system architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0069] Figure 5 This is a flowchart illustrating a communication connection establishment method provided in an embodiment of this application. For example, the communication connection establishment method provided in this embodiment can be applied to... Figure 3 In the system architecture shown.

[0070] like Figure 5 As shown, the communication connection establishment method provided in this application embodiment may specifically include the following steps:

[0071] S501, The client sends a request message to the authorizing end; correspondingly, the authorizing end receives the request message sent by the client.

[0072] The request message is used to request verification of the client's identity.

[0073] In this embodiment, when a client needs to use a service provided by the server, it can send a request message to the authorization end. Accordingly, the authorization end verifies the client's identity and legitimacy based on the request message to determine whether the client is legitimate and whether it can establish a communication connection with the server.

[0074] In one implementation, during the sending of the request message, an application layer protocol protection scheme can be employed to ensure that the content of the request message is not stolen or tampered with. For example, Secure Socket Layer (SSL) can be used to encrypt the communication between the client and the authorized end; this application embodiment does not impose specific limitations on this. SSL is a public-key-based network security protocol that uses a public key to encrypt transmitted data to ensure security.

[0075] In one implementation, the authorizing server can use a feature-based method to verify the client's identity. For example, the client can generate a unique identifier using physically unclonable functions (PUF) technology and register with the authorizing server using this unique identifier. Subsequently, when requesting verification, the client can include its unique identifier in the request message. The authorizing server compares the unique identifier in the request message with its stored unique identifier to determine the client's legitimacy. Alternatively, the authorizing server can use a username and password-based method to verify the client's legitimacy. The client first registers with the authorizing server, which assigns the client a username and password. Later, during verification, the client can include the username and password in the request message, allowing the authorizing server to verify the client's identity based on these credentials.

[0076] S502. After confirming that the client's identity is legitimate, the authorizing end sends verification information to the server.

[0077] The verification information is used by the server to verify the legitimacy of the client's first handshake message, which is used by the client to request the establishment of a communication connection with the server.

[0078] In this embodiment of the application, when the authorizing end receives the request message from the client and verifies that the identity is legitimate, it can send verification information to the server. This allows the server to verify the first handshake message sent by the client to request the establishment of a connection based on the verification information, in order to determine whether the connection is legitimate.

[0079] In one implementation, the authentication information includes at least one of the following: source address (e.g., 192.168.0.1), source port (e.g., 80), destination port (e.g., 90), sequence number of the first handshake message (e.g., 400), and expected request time period (e.g., 9:00-10:00). Here, the source address refers to the client's IP address, used to indicate the client's location in the network. The source port refers to the port used by the client to request the service. In computer networks, ports are used to distinguish different network services, allowing multiple services to run simultaneously on the same device without interfering with each other. The destination port refers to the port used by the server to provide the service. The sequence number of the first handshake message is used to identify the message. The expected request time period indicates the time period during which the client may initiate a connection request (send the first handshake message).

[0080] It should be noted that the verification information can be pre-configured and stored on the authorization server. After verifying the client's identity, the authorization server can retrieve the corresponding verification information from its own storage space or database and send it to the server. Alternatively, the authorization server can generate verification information temporarily based on the request message sent by the client, as described below:

[0081] In one implementation, the request message sent by the client includes, in addition to information for the authorizing end to verify its own legitimacy, at least one field and mask information. Therefore, in this embodiment, the mask information is used to indicate the field among the at least one fields that serves as verification information. Thus, as... Figure 6 As shown, sending verification information to the server in S502 above can be implemented as follows:

[0082] S5021. Generate verification information based on the fields indicated by the mask information.

[0083] S5022, Send verification information to the server.

[0084] For example, regarding S5021-S5022 above, the request information may include at least one of the following fields: source address, source port, destination address, destination port, sequence number of the first handshake message, and expected request time period. The authorizing end uses the mask information to determine the field used for subsequent verification of the first handshake message from at least one field, obtains the verification information, and sends the verification information to the server.

[0085] S503: The client sends the first handshake message to the server; correspondingly, the server receives the first handshake message sent by the client.

[0086] The first handshake message is used to request the establishment of a communication connection.

[0087] In one implementation, after sending a request message to the authorizing end, the client can proactively send a first handshake message to the server to request the establishment of a communication connection.

[0088] In another implementation, the authorizing end, after verifying the client's legitimacy, can send a response message indicating the client's legitimacy. This response message triggers the client to send its first handshake message to the server. Upon receiving the response message, and given its legitimacy, the client can send its first handshake message to the server to request a connection. It should be understood that the response message allows the client to determine the validity of its authentication and, if successful, request a connection, thus increasing the success rate of connection establishment. This avoids situations where the authorizing end fails to authenticate the client, but the client is unaware of the authentication result and mistakenly believes the server has not responded, leading to multiple repeated requests to establish a connection.

[0089] S504. The server verifies the first handshake message based on the verification information.

[0090] In this embodiment, after receiving the first handshake message from the client, the server can verify the first handshake message based on the verification information obtained from the authorizing end. The legitimacy of the connection is determined by comparing the characteristics of the first handshake message (such as its content and the time it was received) with the verification information.

[0091] In one implementation, when the server verifies the first handshake message based on the authentication information, if the first handshake message fails the verification, the server discards it. It can be understood that if the verification fails, the first handshake message is invalid, and the server does not need to respond to the first handshake message, thus avoiding the need to expend resources to set up a half-open connection, effectively preventing TCP half-open connection attacks.

[0092] In one implementation, the first handshake message passes verification if at least one of the following conditions is met:

[0093] The address sent in the first handshake message is the same as the source address in the verification message;

[0094] The source port carried in the first handshake message is the same as the source port in the authentication information;

[0095] The destination port carried in the first handshake message is consistent with the destination port in the authentication information;

[0096] The sequence number carried in the first handshake message matches the sequence number in the verification message;

[0097] The first handshake message was received within the expected request time period specified in the verification information.

[0098] It should be understood that when the server receives the first handshake message, it can parse it and determine whether the content carried in the message matches the corresponding verification information, thus judging whether the first handshake message is valid. Here, "matching" can mean that the content of both parties is identical, or that the content of both parties is identical. It can be seen that this comparison-based verification method has low computational complexity and low demand on the server's computing power, allowing the server to allocate more computing resources to service provision and ensuring a better user experience.

[0099] In one implementation, to further ensure security, the authorizing end can set an expiration period for the authentication information. Within this expiration period, the authentication information can only be used by the server to verify the initial handshake message. Therefore, as... Figure 7 As shown, the technical solution provided in this application embodiment also includes the following:

[0100] S701. The authorizing end sends the authorization validity period to the server; correspondingly, the server receives the authorization validity period sent by the authorizing end. The authorization validity period indicates the effective time of the verification information.

[0101] In the above S504, the server verifies the first handshake message based on the verification information, which can be implemented as follows: within the authorization validity period, the first handshake message is verified based on the verification information.

[0102] It's understandable that the longer verification information is stored, the greater the likelihood of it being stolen by attackers. After stealing the verification information, an attacker could send a first handshake message matching that information, making it impossible for the server to distinguish the attacker's message and resulting in a TCP half-open connection attack. Therefore, the authorizing end sends the authorization validity period of the verification information to the server, allowing the server to determine the validity duration of the verification information. After the authorization validity period expires, the server can delete the verification information to ensure security and save server space.

[0103] It should be noted that the above steps S701 and S502 can be executed simultaneously or sequentially. That is, the authorizing end can send the authorization validity period and verification information to the server at the same time or separately. This application embodiment does not make specific limitations on this.

[0104] S505: If the first handshake message passes verification, a second handshake message is sent to the client. Correspondingly, the client receives the second handshake message sent by the server.

[0105] The second handshake message is the server's response to the first handshake message.

[0106] S506. In response to the second handshake message, the client sends a third handshake message to the server; correspondingly, the server receives the third handshake message sent by the client.

[0107] The third handshake message is the client's response to the second handshake message.

[0108] S507. The server establishes a communication connection with the client.

[0109] Regarding S505-S507 above, if the authorized end passes the initial handshake verification, the server determines the connection is legitimate and can then send a second handshake message to the client to inform it that the first handshake message has been received. Furthermore, the client responds to the second handshake message by sending a third handshake message. Upon receiving the third handshake message, the server establishes a communication connection with the client, enabling reliable data transmission.

[0110] In some scenarios, if the client sends the initial handshake message too quickly, the server may not have received the authentication information from the authorizing end. In this case, the server will consider the initial handshake message invalid and discard it. Therefore, to ensure that the client can successfully establish a connection with the server, the client also performs the following:

[0111] If the second handshake message is not received from the server after the preset time, the first handshake message is resent to the server.

[0112] It should be understood that the client side has a retransmission mechanism to prevent the server from discarding the first handshake message due to special circumstances, ensuring that legitimate clients can establish communication connections normally and improving the communication stability between the client and the server.

[0113] In this embodiment, the first handshake message, the second handshake message, and the third handshake message are all messages conforming to the TCP standard format, meaning the content of the messages and the three-way handshake process are consistent with existing standards. Compared with related technologies, this solution does not rewrite the content of the messages during the three-way handshake process, allowing most devices to use this solution to establish communication connections, resulting in better network compatibility and a wider range of application scenarios.

[0114] In this embodiment, the server will not return a second handshake message to the attacker, thereby preventing the attacker from parsing the second handshake message to obtain relevant information about the server. Therefore, this solution can also prevent SYN sniffing attacks.

[0115] The technical solution of this application embodiment sets up an authorization terminal. Before the client initiates a request to the server to establish a communication connection, it first sends a request message to the authorization terminal so that the authorization terminal can verify the client's identity and legitimacy. If the client is deemed legitimate, the authorization terminal sends verification information to the server. This verification information can be used to verify the first handshake message sent by the client when requesting to establish a connection. In this way, only after the first handshake message is verified successfully will the server continue to execute the subsequent process to establish a communication connection. It can be seen that the technical solution of this application embodiment, by introducing an authorization terminal, moves the process of verifying the client's legitimacy before receiving the first handshake message, and does not rewrite the first handshake message. By having the authorization terminal verify the client's legitimacy and then generating verification information and sending it to the server, the server can perform verification again after receiving the first handshake message, thereby ensuring that the client sends a normal connection establishment request and effectively preventing TCP half-open connection attacks.

[0116] Furthermore, in this solution, client identity verification is shifted from the server to the authorization end. This ensures the server is protected from attacks and allows it to focus more on providing services rather than verifying client legitimacy. Moreover, the three-way handshake message used to establish the communication connection in this solution is consistent with existing standards, thus ensuring strong device compatibility and wide applicability.

[0117] As can be seen, the above mainly describes the solutions provided by the embodiments of this application from a methodological perspective. To achieve the above functions, the embodiments of this application provide corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should readily recognize that, in conjunction with the modules and algorithm steps of the various examples described in the embodiments disclosed herein, the embodiments of this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0118] In an exemplary embodiment, this application also provides a first communication connection establishment apparatus. This first communication connection establishment apparatus may be the aforementioned server or run on the aforementioned server. The first communication connection establishment apparatus may include one or more functional modules for implementing the methods of the above method embodiments. Figure 8 As shown, the first communication connection establishment device includes: a receiving module 801, a verification module 802, a sending module 803, and an establishment module 804.

[0119] The receiving module 801 is used to receive verification information sent by the authorization server; the verification information is used to verify the legitimacy of the client's first handshake message;

[0120] The receiving module 801 is also used to receive the first handshake message sent by the client; the first handshake message is used to request the establishment of a communication connection.

[0121] The verification module 802 is used to verify the first handshake message based on the verification information;

[0122] The sending module 803 is used to send a second handshake message to the client if the first handshake message passes the verification; the second handshake message is a response to the first handshake message.

[0123] The receiving module 801 is also used to receive the third handshake message sent by the client in response to the second handshake message, wherein the third handshake message is the client's response to the second handshake message;

[0124] Module 804 is used to establish a communication connection with the client.

[0125] In one possible implementation, the above apparatus further includes a discard module 805. The discard module 805 is used to discard the first handshake message if the first handshake message fails to pass authentication.

[0126] In another possible implementation, the verification information includes at least one of the following: source address, source port, destination port, sequence number of the first handshake message, and expected request time period; the first handshake message passes verification if at least one of the following conditions is met: the sending address of the first handshake message matches the source address in the verification information; the source port carried in the first handshake message matches the source port in the verification information; the destination port carried in the first handshake message matches the destination port in the verification information; the sequence number carried in the first handshake message matches the sequence number in the verification information; and the time when the first handshake message is received falls within the expected request time period in the verification information.

[0127] In another possible implementation, the receiving module 801 is further configured to receive the authorization validity period sent by the authorization server; the authorization validity period is used to indicate the effective time of the verification information; the sending verification module 802 is specifically configured to verify the first handshake message based on the verification information within the authorization validity period.

[0128] In another possible implementation, the first handshake message, the second handshake message, and the third handshake message are messages that conform to the format specified by the Transmission Control Protocol (TCP).

[0129] In an exemplary embodiment, this application also provides a second communication connection establishment apparatus. This apparatus may be the aforementioned authorized terminal or operate on the aforementioned authorized terminal. The second communication connection establishment apparatus may include one or more functional modules for implementing the methods of the above method embodiments. Figure 9 As shown, the second communication connection establishment device includes a receiving module 901 and a sending module 902.

[0130] The receiving module 901 is used to receive request messages sent by the client; the request message is used to request verification of the client's identity and legitimacy.

[0131] The sending module 902 is used to send verification information to the server when the client's identity is determined to be legitimate. The verification information is used by the server to verify the legitimacy of the client's first handshake message, which is used by the client to request the establishment of a communication connection with the server.

[0132] In one possible implementation, the sending module 902 is further configured to send a response message to the client indicating that the client's identity is legitimate; the response message is used to trigger the client to send the first handshake message to the server.

[0133] In another possible implementation, the request message includes: at least one field and mask information; the mask information is used to indicate the field in the at least one field that serves as verification information; the sending module 902 is specifically used to generate verification information based on the field indicated by the mask information; and send the verification information to the server.

[0134] In an exemplary embodiment, this application also provides a third communication connection establishment apparatus. This apparatus may be the aforementioned client or run on the aforementioned client. The third communication connection establishment apparatus may include one or more functional modules for implementing the methods of the above method embodiments. Figure 10 As shown, the third communication connection establishment device includes: a sending module 1001, a receiving module 1002, and an establishment module 1003.

[0135] The sending module 1001 is used to send a request message to the authorization end; the request message is used to request verification of the client's identity; if the client is legitimate, the authorization end is triggered to send verification information to the server; the verification information is used by the server to verify the legitimacy of the client's first handshake message; the first handshake message is used by the client to request the establishment of a communication connection with the server; the sending module 1001 is also used to send the first handshake message to the server; the receiving module 1002 is used to receive the second handshake message sent by the server; the second handshake message is the server's response to the first handshake message; the receiving module 1002 is also used to send a third handshake message to the server in response to the second handshake message; the establishing module 1003 is used to establish a communication connection with the server.

[0136] In one possible implementation, the receiving module 1002 is further configured to receive a response message from the authorized end; the sending module 1001 is specifically configured to send a first handshake message to the server when the response message indicates that the client's identity is legitimate.

[0137] In another possible implementation, the sending module 1001 is also used to resend the first handshake message to the server if it does not receive the second handshake message sent by the server after a preset time.

[0138] In an exemplary embodiment, this application also provides a computing device. Figure 11 This is a schematic diagram illustrating the composition of a computing device provided in an embodiment of this application. Figure 11 As shown, the computing device may include a processor 1101 and a memory 1102; the memory 1102 stores instructions executable by the processor 1101; when the processor 1101 is configured to execute instructions, the computing device implements the method described in the foregoing method embodiments.

[0139] This application also provides a computer-readable storage medium. All or part of the processes in the above method embodiments can be executed by computer instructions instructing related hardware. The program can be stored in the computer-readable storage medium, and when executed, it can include the processes of the above method embodiments. The computer-readable storage medium can be any of the foregoing embodiments or memory. The computer-readable storage medium can also be an external storage device of the recovery device, such as a plug-in hard drive, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the recovery device. Further, the computer-readable storage medium can include both internal storage units of the recovery device and external storage devices. The computer-readable storage medium is used to store the computer program and other programs and data required by the recovery device. The computer-readable storage medium can also be used to temporarily store data that has been output or will be output.

[0140] This application also provides a computer program product, which includes a computer program that, when run on a computer, causes the computer to execute any of the communication connection establishment methods provided in the above embodiments.

[0141] Although this application has been described herein in conjunction with various embodiments, those skilled in the art, by reviewing the accompanying drawings, disclosure, and appended claims, will understand and implement other variations of the disclosed embodiments in carrying out the claimed application. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude multiple components. A single processor or other unit can implement several functions listed in the claims. While different dependent claims may recite certain measures, this does not mean that these measures cannot be combined to produce good results.

[0142] Although this application has been described in conjunction with specific features and embodiments, it is obvious that various modifications and combinations can be made thereto without departing from the spirit and scope of this application. Accordingly, this specification and drawings are merely exemplary illustrations of this application as defined by the appended claims, and are considered to cover any and all modifications, variations, combinations, or equivalents within the scope of this application. Clearly, those skilled in the art can make various alterations and modifications to this application without departing from the spirit and scope of this application. Thus, if such modifications and modifications of this application fall within the scope of the claims of this application and their equivalents, this application is also intended to include such modifications and modifications.

[0143] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for establishing a communication connection, characterized in that, The method is applied to a server, which communicates with both a client and an authorization terminal; wherein the authorization terminal and the server are different computing devices; the method includes: The system receives verification information sent by the authorizing end; the verification information is used to verify the legitimacy of the client's first handshake message; the verification information is sent by the authorizing end after determining that the client's identity is legitimate; the verification information includes at least one of the following: source address, source port, destination port, sequence number of the first handshake message, and expected request time period; Receive the first handshake message sent by the client; the first handshake message is used to request the establishment of a communication connection; Based on the verification information, at least one of the following is verified in the first handshake message: Verify whether the sending address of the first handshake message is consistent with the source address in the verification information; Verify whether the source port carried in the first handshake message is consistent with the source port in the verification information; Verify whether the destination port carried in the first handshake message is consistent with the destination port in the verification information; Verify whether the sequence number carried in the first handshake message matches the sequence number in the verification information; Verify whether the time when the first handshake message is received falls within the expected request time period in the verification information; If the first handshake message passes verification, a second handshake message is sent to the client; the second handshake message is a response to the first handshake message. Receive the third handshake message sent by the client, wherein the third handshake message is the client's response to the second handshake message; Establish a communication connection with the client.

2. The method according to claim 1, characterized in that, The method further includes: If the first handshake message fails to pass verification, the first handshake message is discarded.

3. The method according to claim 1, characterized in that, The method further includes: Receive the authorization validity period sent by the authorization terminal; the authorization validity period is used to indicate the effective time of the verification information; The verification of the first handshake message based on the verification information includes: During the authorization period, the first handshake message is verified based on the verification information.

4. The method according to any one of claims 1-3, characterized in that, The first handshake message, the second handshake message, and the third handshake message are messages that conform to the format specified by the Transmission Control Protocol (TCP).

5. A method for establishing a communication connection, characterized in that, The method is applied to an authorization terminal, which is communicatively connected to both a client and a server; wherein the authorization terminal and the server are different computing devices; the method includes: Receive a request message sent by the client; the request message is used to request verification of the client's identity and legitimacy; If the client's identity is confirmed to be legitimate, a response message indicating the client's legitimacy is sent to the client, and verification information is sent to the server. The response message triggers the client to send the first handshake message to the server. The verification information is used by the server to verify the legitimacy of the client's first handshake message, which is used by the client to request the establishment of a communication connection with the server. The verification information includes at least one of the following: source address, source port, destination port, sequence number of the first handshake message, and expected request time period.

6. The method according to claim 5, characterized in that, The request message includes: at least one field and mask information; the mask information is used to indicate the field among the at least one field that serves as the verification information; Send verification information to the server, including: The verification information is generated based on the fields indicated by the mask information; Send the verification information to the server.

7. A method for establishing a communication connection, characterized in that, Applied to a client, the client communicates with both an authorization terminal and a server; wherein the authorization terminal and the server are different computing devices; the method includes: Send a request message to the authorization terminal; the request message is used to request verification of the client's identity and legitimacy; Receive the response message from the authorized end; If the identity verification passes, the authorizing end is triggered to send verification information to the server. The verification information is used by the server to verify the legitimacy of the client's first handshake message. The first handshake message is used by the client to request the establishment of a communication connection with the server. The verification information includes at least one of the following: source address, source port, destination port, sequence number of the first handshake message, and expected request time period. If the response message indicates that the client's identity is valid, the first handshake message is sent to the server. Receive the second handshake message sent by the server; the second handshake message is the server's response to the first handshake message; In response to the second handshake message, a third handshake message is sent to the server; Establish a communication connection with the server.

8. The method according to claim 7, characterized in that, After sending the first handshake message to the server, the method further includes: If the second handshake message is not received from the server after a preset time period, the first handshake message is resent to the server.

9. A computing device, characterized in that, The computing device includes a processor and a memory; the processor is coupled to the memory; the memory is used to store computer instructions, which are loaded and executed by the processor to enable the computing device to implement the communication connection establishment method as described in any one of claims 1-8.

Images