Load-Balancing Device SYN Flood Defense via Serial Number Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Load-balancing systems are vulnerable to SYN flood attacks, where attackers send numerous SYN packets, forcing real servers to allocate excessive resources for half-open TCP connections, leading to resource exhaustion and impaired service delivery.
Innovation Solution
A load-balancing device computes a serial number based on client connection information, includes it in the SYN+ACK packet, and generates a self-defined packet that the real server uses to establish a TCP connection, eliminating the need for the real server to create a database for client connection information and reducing resource consumption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the real server creates a database to store client connection information for each SYN packet, then TCP connection establishment is enabled, but system resources are exhausted under SYN flood attacks
Solution Approach 1:
The patent extracts the connection information storage function from the real server to the load-balancing device. The load-balancing device maintains a database of client connection information and serial numbers, while the real server only needs to verify the serial number. This extraction prevents the real server from exhausting resources under SYN flood attacks.
Solution Approach 2:
The load-balancing device acts as an intermediary between the client and real server during connection establishment. It computes and embeds serial numbers in SYN+ACK packets, validates ACK packets from clients, and forwards connection information to the real server. This intermediary role protects the real server from direct exposure to malicious SYN packets.
2Ease of operation
If the real server processes each SYN packet by creating half-open connections, then connection handling is enabled, but service availability deteriorates under attack
Solution Approach 1:
The load-balancing device performs preliminary actions by pre-computing serial numbers based on client connection information before the real server processes the connection. It embeds these serial numbers in SYN+ACK packets and validates client ACK packets against the pre-computed values. This preliminary validation prevents the real server from processing malicious connections.
Solution Approach 2:
The load-balancing device provides self-service by autonomously managing the connection establishment validation process. It maintains the connection information database, computes serial numbers, validates client responses, and filters packets before forwarding to the real server. This self-service capability protects the real server from resource exhaustion without requiring real server intervention.
3Object-affected harmful factors
If the load-balancing device computes and embeds serial numbers in SYN+ACK packets, then defense against SYN flood attacks is improved, but device complexity increases
Solution Approach 1:
The load-balancing device changes the parameter space by introducing serial numbers as an additional validation parameter in the TCP handshake process. It computes serial numbers from client connection information (source IP, destination IP, source port, destination port) and embeds them in SYN+ACK packets. The device then validates these serial numbers against client ACK packets, adding a security layer without fundamentally changing the TCP protocol.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An apparatus for establishing a connection in a load-balancing system is provided. The apparatus is coupled between a client device and a real server that provides services to the client device. The apparatus includes: a memory device storing instructions; and a processor configured to execute the instructions stored in the memory device to: receive a synchronous (SYN) packet from the client device, the SYN packet including client connection information; based on the client connection information, compute a serial number; return a first synchronous acknowledgement (SYN+ACK) packet to the client device, the first SYN+ACK packet including connection information of the real server; receive an acknowledgement (ACK) packet from the client; generate a self-defined packet to include the client connection information; and forward the self-defined packet to the real server.