Global State Synchronization for Asymmetric Network Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional systems fail to effectively mitigate denial-of-service attacks and provide high performance asymmetric network communication, as they only detect but do not resolve the issue of resource overload and lack global state management in distributed networks.
Innovation Solution
A method for global state synchronization in TCP communications that securely establishes connectivity between clients and servers by using hash cookies and queuing ACK packets to manage session state across remote network apparatuses, ensuring proper sequence and acknowledgment numbers for communication sessions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the server reserves and allocates system resources for each incoming TCP SYN packet, then the server can facilitate connection establishment, but the server becomes vulnerable to denial-of-service attacks where attackers can exhaust all system resources by generating large quantities of SYN packets
Solution Approach 1:
The patent applies preliminary action by having the server allocate minimal resources and create placeholder connection entries immediately upon receiving a SYN packet, rather than reserving full system resources. This allows the server to quickly acknowledge the connection attempt with a SYN-ACK packet while deferring actual resource allocation until the connection is fully established and verified, thus preventing resource exhaustion from malicious SYN floods
Solution Approach 2:
The patent introduces an intermediary mechanism in the form of a state synchronization system that coordinates connection state information across multiple servers. This intermediary layer allows servers to verify connection legitimacy through centralized state checking before allocating full resources, enabling them to distinguish between legitimate clients and attackers while maintaining connection establishment reliability
2Reliability
If intermediary systems validate data packets based on symmetric routing, then they can ensure packet authenticity, but they prohibit legitimate packets in asymmetric network environments where packets travel different paths
Solution Approach 1:
The patent applies dynamics by implementing a dynamic state synchronization system that continuously updates connection state information across the distributed network. Instead of relying on static symmetric routing validation, the system dynamically adapts to asymmetric network conditions by checking the current global connection state, allowing legitimate packets to pass through intermediary systems even when they arrive via different paths than the original SYN packet
Solution Approach 2:
The patent implements universality by creating a centralized state synchronization mechanism that serves multiple functions: validating connection legitimacy, coordinating resource allocation across servers, and adapting to various network topologies including asymmetric routing. This universal system replaces multiple location-specific validation systems, enabling consistent packet validation across diverse network environments
3Measurement precision
If prior art systems detect denial-of-service conditions, then they can identify attack patterns, but they fail to actually mitigate the attacks or resolve the resource overload situation
Solution Approach 1:
The patent implements feedback by creating a closed-loop system where the centralized state synchronization mechanism continuously monitors connection states across all servers, detects potential denial-of-service conditions, and automatically coordinates resource allocation and connection acceptance decisions. This feedback loop transforms passive attack detection into active mitigation by enabling real-time coordination responses that prevent resource exhaustion before it occurs
Solution Approach 2:
The patent merges previously separate functions of attack detection and attack mitigation into a unified state synchronization system. By combining detection capabilities with centralized coordination of resource allocation and connection management, the system eliminates the gap between identifying attacks and resolving them, allowing precise detection to directly drive effective mitigation actions across the distributed network
Data Source
AI summary
The present invention provides a system and method is disclosed for the development and maintenance of a globally distributed state session table wherein a plurality of client connections from one network are stored in a plurality of computer systems to track the aforementioned connection to one or more secondary networks. Client connection requests may originate anywhere on the Internet and server responses to such client requests may be sent asymmetrically from any other point on the Internet. The client-server connection is secured utilizing an intermediary device that acts as a transparent relay, generating a secret cookie hash for the client, such that only the data packets containing such hash are forwarded by the globally distributed system to the server.