Data-Plane Forwarding Circuit for SYN Flood Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for protecting against SYN flood denial of service attacks, such as the SYN cookie technique, burden general-purpose processors with hashing operations, leading to inefficiencies during attacks.
Innovation Solution
A data-plane forwarding circuit configured to validate sources of SYN data messages before forwarding, incorporating a SYN/ACK detector, SYN-processing circuit, and ACK-processing circuit, which generates and validates SYN cookies to manage connections and prevent attack traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SYN cookie technique is used to protect against SYN flood attacks, then server protection is improved, but general-purpose processor burden increases due to hashing operations
Solution Approach 1:
The patent extracts the SYN cookie hashing operations from the general-purpose CPU and implements them in dedicated hardware circuits within the network interface card. The hashing circuit is separated as an independent functional unit that handles SYN packet validation without burdening the CPU, thus resolving the contradiction between server protection and processor efficiency.
Solution Approach 2:
The patent introduces a dedicated hashing circuit as an intermediary component between the network interface and the CPU. This intermediary handles the computationally intensive hashing operations for SYN cookie validation, acting as a mediator that protects the server while relieving the CPU of heavy processing burdens.
2Reliability
If connection validation is performed for every SYN message, then network security is improved, but processing time increases
Solution Approach 1:
The patent implements preliminary action by pre-computing and storing hash values in a hardware lookup table before SYN flood attacks occur. When SYN packets arrive during an attack, the validation is performed through fast hardware table lookup rather than computationally intensive real-time hashing, thus maintaining network security while minimizing processing time.
Solution Approach 2:
The patent replaces the mechanical software-based hashing computation with a hardware-based lookup system. The dedicated hashing circuit and lookup table provide O(1) constant-time validation, substituting the time-consuming software hashing mechanism with a faster hardware-based approach that maintains security without increasing processing time.
Data Source
AI summary
Some embodiments of the invention provide a data-plane forwarding circuit (data plane) that can be configured to provide protection from a SYN-flood denial of service attack by validating a source of a SYN data messages before allowing future messages to be forwarded to a protected server. To perform its forwarding operations, the data plane includes several data message processing stages that are configured to process the data tuples associated with the data messages received by the data plane. In some embodiments, parts of the data plane message-processing stages are also configured to operate as a connection-validation circuit that includes (1) a SYN-processing circuit to process SYN data messages received by the data plane, and (2) an ACK-processing circuit to process ACK data messages received by the data plane.