Gateway SYN-ACK Mechanism for DDoS Defense
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current defense mechanisms against denial-of-service attacks, particularly SYN flood attacks, are inadequate in preventing resource exhaustion on server computers, leading to service disruptions and inefficiencies in managing network resources.
Innovation Solution
Implementing a gateway device that generates SYN-ACK messages with encoded connection information, allowing legitimate ACK messages to pass through and reconstructing connection information only when valid, thus preventing resource allocation during SYN flood attacks and shifting SYN cookie processing from server computers to the gateway device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the server computer directly responds to client connection requests, then the connection handling is simple and direct, but the server becomes vulnerable to SYN flood attacks and resource exhaustion
Solution Approach 1:
A gateway device is introduced as an intermediary between clients and server computers. The gateway responds to SYN requests on behalf of the server, sending SYN-ACK messages and managing connection state. This intermediary protects the server from direct exposure to SYN flood attacks while maintaining legitimate connection handling.
Solution Approach 2:
The gateway device performs preliminary connection validation before forwarding requests to the server. It maintains connection state information and only forwards ACK messages that complete valid TCP handshakes, preventing resource exhaustion from spurious connection requests.
2Measurement precision
If the server computer processes SYN cookies directly, then the connection validation is performed at the server, but processing overhead increases during attack conditions
Solution Approach 1:
The SYN cookie processing functionality is extracted from the server computer and implemented in the gateway device. The gateway generates and validates SYN-ACK messages, handling the computationally intensive connection validation logic away from the server to improve overall system efficiency during attack conditions.
3Loss of information
If the server allocates resources for each SYN request, then connection tracking is accurate, but resources are exhausted during flood attacks
Solution Approach 1:
The gateway device maintains connection state information in its own memory, serving as an intermediary that tracks connection progress without requiring the server to allocate resources for each half-open connection. This preserves connection tracking accuracy while protecting server resources.
Solution Approach 2:
The gateway device handles only the necessary portion of connection validation (SYN-ACK generation and ACK verification) without implementing full connection tracking on the server side. This partial action approach maintains sufficient connection information while avoiding excessive resource allocation.
Data Source
AI summary
Denial-of-service protection for a computing device on a first network is disclosed. In an embodiment, a packet containing a network address corresponding to a computing device on the first network is received from a source address of a second network by a gateway device. The packet includes a request to initiate a connection to the computing device on the first network. In response, an acknowledgement is transmitted to the source address. The acknowledgement includes sequence information sufficient to establish the requested connection, including a unique identifier. Subsequently received packets addressed to the network address of the computing device are forwarded by the gateway device to a corresponding network address of the computing device on the first network upon verifying a response to the acknowledgement.