FTP Application Specific Packet Filter for Layered Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional packet filter firewalls are ineffective in preventing threats from the application layer, such as user login attacks, as they only filter based on network layer information and do not parse or detect content at the application layer.
Innovation Solution
Implementing an Application Specific Packet Filter (ASPF) method for FTP that tracks and detects TCP three-handshake protocols, monitors login interactions, and dynamically establishes data channel filtering rules based on parsed IP addresses and ports to allow legitimate data transmission while blocking unauthorized packets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If packet filter technology is used to filter data packets at the network layer, then processing speed is rapid and device performance impact is minimal, but application layer threats such as FTP user login attacks cannot be prevented
Solution Approach 1:
The patent segments the packet filtering process into two distinct layers: network layer filtering (using traditional packet filters for rapid processing) and application layer filtering (using ASPF to parse and detect application protocols). This segmentation allows each layer to handle its specific filtering tasks independently, maintaining high processing speed while adding application layer security capabilities.
Solution Approach 2:
The patent introduces an Application Specific Packet Filter (ASPF) as an intermediary component between the network layer packet filter and the FTP application. The ASPF acts as a mediator that parses application layer protocols, detects login interactions, and dynamically creates filtering rules, thereby bridging the gap between rapid network layer filtering and secure application layer protection.
2Ease of operation
If traditional packet filter firewall is deployed to control FTP transmission, then network layer filtering is implemented transparently without requiring user software, but it cannot detect or prevent application layer attacks
Solution Approach 1:
The patent extends the filtering capability from the network layer to the application layer by adding a new dimension of protocol parsing and detection. The ASPF analyzes FTP command structures, user interactions, and data patterns at the application layer, enabling detection of threats that are invisible to traditional network layer filters while maintaining transparent operation for users.
3Reliability
If ASPF dynamically creates data channel passing rules based on parsed FTP commands, then legitimate data transmission is allowed while unauthorized packets are blocked, but processing complexity increases
Solution Approach 1:
The patent implements dynamic filtering rules that are automatically created, updated, and removed based on real-time FTP session states. The ASPF monitors FTP command exchanges, dynamically generates data channel passing rules for legitimate connections, and automatically removes them when sessions end. This dynamic approach maintains high security while managing complexity through automation rather than static configuration.
Solution Approach 2:
The patent incorporates feedback mechanisms where the ASPF continuously monitors FTP protocol interactions, uses the parsed information to dynamically adjust filtering rules, and validates whether transmitted packets conform to the established rules. This closed-loop feedback system automatically adapts to legitimate traffic patterns while blocking unauthorized access, managing complexity through intelligent automation.
Data Source
AI summary
Disclosed is a method for Application Specific Packet Filter (ASPF) of a File Transfer Protocol (FTP), including the following steps: when a Transmission Control Protocol (TCP) connection of an FTP control channel is established, a first TCP Synchronous (TCP SYN) packet sent by a client is obtained and forwarded to an FTP server; it is detected whether a response packet from the FTP server is a TCP Synchronize-Acknowledgment (SYN+ACK) packet, and if not, the response packet is discarded; it is detected whether a response packet from the client is an ACK TCP packet, and if not, the response packet is discarded; and a data flow table is created to record and update an FTP state. A device for ASPF of a FTP is also provided. The method and device can avoid and stop the attacks from the FTP application layer, and ensure safe and reliable transmission of an FTP service.