ACK Flood Mitigation via Out-of-Window Sequence Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting and mitigating ACKFlood attacks in network security systems often result in network lag for clients, leading to poor user experience, especially for delay-sensitive services.
Innovation Solution
A data processing method and apparatus that utilize a security detection device and a security protection device to verify the validity of a client by sending a test message with a sequence number out of the client's sliding window, allowing the client to return a verification message, thereby distinguishing between valid and attacking clients without disrupting the network connection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a timeout retransmission mechanism is used to verify client validity, then network security against ACKFlood attacks is improved, but network lag occurs leading to poor user experience
Solution Approach 1:
The patent applies preliminary action by sending a test message with an out-of-window sequence number before the actual data message to verify client validity. This advance verification determines whether the client is legitimate or an attacker, allowing the system to prepare appropriate handling for the incoming data message without requiring timeout retransmission, thus eliminating network lag while maintaining security
Solution Approach 2:
The patent introduces an intermediary verification mechanism using test messages with out-of-window sequence numbers. This intermediary step acts as a mediator between the security verification requirement and the data transmission need, allowing the system to verify client validity through the TCP sliding window mechanism without disrupting the normal data flow or causing network lag
2Object-affected harmful factors
If ACK message discarding is used to mitigate ACKFlood attacks, then attack mitigation is improved, but valid clients may be incorrectly blocked
Solution Approach 1:
The patent applies parameter changes by modifying the sequence number parameter of the test message to be out of the client's sliding window. This parameter change triggers a specific response from valid TCP clients (they will send an ACK with a specific acknowledgment number), allowing the system to reliably distinguish valid clients from attackers without incorrectly blocking legitimate users
Data Source
AI summary
A data processing method a device, and a storage medium are provided. The method includes: detecting, via a security detection device in response to receiving a data message sent by a client, whether a destination server corresponding to the data message is under cyberattack; in response to the destination server being under cyberattack, guiding the data message to a security protection device, and sending a test message to the client via the security protection device; and verifying, via the security protection device, the verification message returned by the client, and in response to the verification succeeding, determining that the client is a valid client and sending the data message to the destination server, or in response to the verification failing, determining that the client is an attacking client and discarding the data message.