Guard Device TCP Handshake Spoofing Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional methods struggle to effectively defend against Denial-of-Service (DoS) attacks, particularly Distributed DoS (DDoS) attacks that use spoofed IP addresses, as they consume network resources and make it difficult for victims to trace the source of the attack.

Innovation Solution

A guard device intercepts incoming connection requests and uses the TCP three-way handshake protocol to verify the legitimacy of the source address by sending a deviating reply, analyzing the response, and determining the authenticity of the source address, thereby blocking spoofed traffic and allowing legitimate connections.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If conventional IP address filtering methods are used to defend against DoS attacks, then the victim can filter out traffic from suspected IP addresses, but the effectiveness is reduced when attackers use spoofed IP addresses

Engineering Contradiction:

Improveeffectiveness of DoS attack defenseVSAvoidspoofed IP addresses

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent implements feedback by having the guard device send a TCP ACK packet with an incorrect acknowledgment number to the source address, then analyze the response (RST packet with correct sequence number) to verify authenticity. This feedback mechanism allows the system to detect spoofed addresses by checking whether the response conforms to expected TCP protocol behavior.

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The guard device acts as an intermediary between the victim and incoming traffic. It intercepts SYN packets, sends deviating ACK replies, and analyzes responses before allowing connections to proceed. This intermediary position enables authentication without requiring the victim to directly handle spoofed packets.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If the guard device sends a deviating TCP reply to authenticate source addresses, then spoofed traffic can be detected, but normal TCP handshake operations are disrupted

Engineering Contradiction:

Improveauthentication accuracyVSAvoidprotocol operation smoothness

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The guard device performs preliminary authentication action by sending a deviating ACK packet before the normal TCP handshake is complete. The incorrect acknowledgment number serves as a challenge that must be correctly responded to with a RST packet containing the proper sequence number, verifying authenticity before allowing the connection to proceed normally.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

Instead of the sender normally responding to an ACK with a SYN-ACK to continue the handshake, the guard device inverts the protocol by sending an ACK with an incorrect number to elicit a RST response. This inversion creates a verification mechanism where the correct protocol response proves the source address is authentic.

Inventive Principle:

Principle #13The other way round (Inversion)

Data Source

PatentUS7979694B2Using TCP to authenticate IP source addresses

Publication Date: 2011.07.12 CISCO TECHNOLOGY INC

AI summary

A method for authenticating communication traffic includes intercepting a request directed over a network from a source address to open a connection to a target computer in accordance with a handshake procedure specified by a predetermined communication protocol. A reply to the request that deviates from the specified handshake procedure is sent to the source address. A response from the source address to the reply is analyzed in order to make an assessment of legitimacy of the source address. Upon determining, based on the assessment, that the source address is legitimate, the target computer is permitted to complete the handshake procedure so as to open the connection with the source address.