Network Authentication via Function Transformation on SYN Parameters
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network authentication methods for preventing DDoS attacks, such as SYN Flood, require storing acknowledgment values, leading to resource occupation and inefficiency during network congestion or flood attacks.
Innovation Solution
A network authentication method that calculates a check value using a function transformation on network parameters in the SYN and RST data packets, eliminating the need to store acknowledgment values and reducing resource usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the gateway stores acknowledgment values (SEQ) in a white list for authentication, then the server can be protected from DDoS attacks, but storage resources are occupied and the system becomes less efficient during network congestion
Solution Approach 1:
The gateway performs function transformation on network parameters (IP address, port, protocol) to generate the acknowledgment value SEQ in advance when sending SYN_ACK packets. This preliminary calculation eliminates the need to store SEQ values during authentication, as they can be regenerated on-demand using the same transformation function applied to the client's network parameters.
Solution Approach 2:
The authentication system uses the client's own network parameters (source IP, destination port, protocol type) as input to the function transformation. The client effectively authenticates itself by providing parameters that the gateway can transform to verify the ACK value in returned packets, eliminating the need for external storage of authentication data.
2Reliability
If the gateway sends SYN_ACK and RST packets for authentication, then fake IP address forgery can be detected, but network resources are consumed due to multiple packet transmissions
Solution Approach 1:
The gateway sends a SYN_ACK packet with a calculated SEQ value based on the client's network parameters. The client is expected to return an RST or ACK packet with the same SEQ value. This feedback mechanism allows the gateway to verify whether the returning packet originates from the same entity that sent the SYN, detecting IP forgery without requiring additional packet exchanges beyond the standard TCP handshake.
3Productivity
If the gateway maintains a white list of authenticated IPs with aging time, then repeated connections can be accelerated, but the system complexity increases due to list management
Solution Approach 1:
Instead of storing complete authentication records with multiple fields (IP, port, timestamp, SEQ values) in a complex white list structure, the system stores only the essential network parameters (source IP, destination port, protocol) that are needed to regenerate the authentication data. The SEQ values are copied on-demand through function transformation rather than being stored, significantly simplifying the data structure and management logic.
Data Source
AI summary
A network authentication method, a client and a device are provided. The method includes: receiving SYN data sent by a client, where the SYN data includes a sequence number SEQ1 and a network parameter comprising an ID in the header of the SYN data; sending SYN_ACK data to the client, where the SYN_ACK data includes an acknowledgment number ACK2 obtained by carrying out a function transformation according to the network parameter; receiving RST data sent by the client, where the RST data includes a sequence number SEQ3 or an acknowledgment number ACK3, and the RST data further includes a network parameter the same as that of the SYN data; carrying out the function transformation according to the network parameter of the RST data to obtain a check value CHK; and passing the authentication of the client if CHK matches SEQ3 or ACK3.