Filtering Device TCP Connection Management for HTTP Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional HTTP proxy systems fail to perform filtering when HTTP clients are not set up correctly, and transmission proxy systems experience reduced throughput due to complex TCP session termination processes, leading to potential misidentification as Denial of Service (DoS) attacks.
Innovation Solution
A filtering system that detects frequent accesses from the same client to a Web server and disconnects TCP connections without transmitting HTTP requests, treating multiple Web servers with different IP addresses as a single access control object group, and includes a filtering device that relays TCP connections and HTTP requests while managing access control messages to avoid misidentification as a DoS attack.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a TCP termination process is performed to disconnect frequent accesses from a client, then access control effectiveness is improved, but the Web server may mistakenly identify the filtering device as a DoS attack source
Solution Approach 1:
The filtering device performs preliminary actions by establishing a TCP connection to the Web server before disconnecting the client's TCP connection. This preliminary connection establishment allows the Web server to recognize the filtering device as a legitimate entity rather than a DoS attack source, while still enabling effective access control through subsequent connection termination
Solution Approach 2:
The filtering device acts as an intermediary between the client and Web server. By establishing its own TCP connection to the Web server before disconnecting the client, it mediates the interaction in a way that protects the Web server from misidentifying the filtering device as an attacker, while maintaining effective access control functionality
2Reliability
If a transmission proxy system is used to perform TCP session termination, then access control capability is improved, but throughput is reduced due to complex software processes
Solution Approach 1:
The invention extracts the TCP session termination function from the software-based transmission proxy system and implements it through a dedicated filtering device that handles connection termination more efficiently. This separation allows the main proxy system to focus on HTTP processing while the filtering device handles TCP-level operations with reduced overhead
Solution Approach 2:
The filtering device uses lightweight, short-lived TCP connections to the Web server for the purpose of establishing presence and enabling subsequent client disconnections. These brief connection establishments are computationally inexpensive compared to full proxy processing, thereby maintaining high throughput while providing access control
Data Source
AI summary
In a system without a TCP termination process at normal times, and in the case where a URL within an HTTP access is extracted from reception packets, a passage/access refusal determination of the URL is performed, and a determination result is an access refusal, the TCP termination process is performed, a filtering device has the possibility that when an UTTP access as a disconnect case is frequently performed, it is erroneously recognized as a DoS attack on the side of the Web server device. A network system has a detection unit of frequent accesses to access control object data in the same Web server device from the same client device and a disconnect unit of a TCP connection to the Web server device after detection through the detection unit.