ADC SYN-Cookie Authentication for Secure Direct Server Routing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network configurations are vulnerable to denial of service attacks, particularly due to the overwhelming number of SYN packets that can overwhelm servers, leading to service disruptions, and conventional Application Delivery Controllers (ADCs) may become bottlenecks in data transmission, especially in asymmetric network configurations where they cannot serve as intermediaries for both client and server communication.
Innovation Solution
The implementation of a method where an ADC receives a SYN packet from a client, determines the client as a trusted source, and transmits a SYN/ACK packet containing a SYN-cookie to authenticate the client, allowing the ADC to forward data directly to the server while maintaining sequence numbers and other parameters, thus preventing the ADC from becoming a bottleneck and protecting against SYN attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional ADCs are used to manage network traffic, then network security and traffic control are improved, but the ADC becomes a bottleneck in data transmission
Solution Approach 1:
The patent extracts the authentication function from the ADC by implementing SYN-cookie authentication. The ADC only needs to authenticate clients during the initial SYN phase, after which direct communication between clients and servers can proceed without ADC intervention, removing the ADC as a continuous bottleneck while maintaining security.
Solution Approach 2:
The patent applies preliminary authentication action through SYN-cookie implementation. The ADC performs client authentication in advance during the SYN packet phase, establishing trust before data transmission begins. This preliminary security measure eliminates the need for continuous ADC mediation, improving transmission efficiency while maintaining security.
2Adaptability or versatility
If SYN packets are allowed to flood the network, then network connectivity is maintained, but denial of service attacks can overwhelm servers
Solution Approach 1:
The patent introduces SYN-cookies as an intermediary authentication mechanism between clients and servers. The ADC acts as a mediator that verifies client authenticity through SYN-cookie validation before allowing SYN packets to reach the server, thus maintaining legitimate network connectivity while blocking malicious flood attacks.
Solution Approach 2:
The patent implements feedback-based authentication where the ADC monitors SYN packet patterns and validates clients using SYN-cookies. The system provides feedback to distinguish legitimate clients from attackers, allowing authentic traffic while blocking denial of service attacks that exhibit abnormal patterns.
Data Source
AI summary
Facilitation of secure network traffic over an application session by an application delivery controller is provided herein. A method for secure network traffic transmission over an application session may include receiving, from a client device, a SYN data packet intended for an application server. The method may continue with determining, based on the SYN data packet, that the client device is a trusted source. The method may further include transmitting, based on the determination that the client device is the trusted source, a SYN/ACK packet to the client device. The SYN/ACK packet may include information for the client device to authenticate the client device to the application server directly as the trusted source.