Multi-Core Cluster SYN Cookie Seed Synchronization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Clustered networking devices are vulnerable to SYN flood attacks, which consume server resources and disrupt legitimate traffic by overwhelming them with SYN requests, lacking effective protection mechanisms.
Innovation Solution
Implementing a master-slave mechanism for generating and synchronizing SYN-cookies across multiple cores in a cluster, using shared memory to store the cookie seed, ensuring all cores use the same seed for validating TCP connections and dropping unauthorized requests.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SYN flood attack protection is implemented without a synchronization mechanism, then each core generates its own SYN-cookie seed independently, but this causes inconsistency in connection validation across cores leading to connection failures
Solution Approach 1:
The patent merges the seed generation function into a single master core that creates a common SYN-cookie seed for all cores. This unified approach ensures that all cores use the same seed for connection validation, eliminating the inconsistency problem while maintaining reliability across the multi-core system.
Solution Approach 2:
The patent introduces shared memory as an intermediary mechanism between the master core and slave cores. The master core writes the generated seed to shared memory, and all slave cores read from this shared memory to obtain the common seed. This intermediary structure enables consistent seed distribution without requiring direct communication between all cores.
2Reliability
If a master-slave mechanism with shared memory is implemented for seed synchronization, then connection validation consistency is improved, but the device complexity and memory usage increase
Solution Approach 1:
The patent segments the multi-core system into master cores and slave cores with clearly defined roles. Master cores are responsible for seed generation and writing to shared memory, while slave cores are responsible for reading the seed and using it for connection validation. This segmentation simplifies the overall complexity by assigning specific functions to different core types.
Solution Approach 2:
The shared memory structure serves multiple functions: it stores the SYN-cookie seed, acts as a communication channel between master and slave cores, and provides a synchronization mechanism. This multi-functionality reduces the need for additional dedicated components, thereby limiting the increase in device complexity.
3Reliability
If SYN-cookies are generated with frequent seed updates, then security against attacks is improved, but network performance and connection establishment speed deteriorate
Solution Approach 1:
The patent implements periodic seed updates at predetermined intervals rather than continuous updates. The master core generates new seeds at regular time intervals and writes them to shared memory, while slave cores read the updated seeds periodically. This periodic approach maintains security by regularly refreshing the seed while minimizing performance impact by avoiding constant updates.
Solution Approach 2:
The master core generates and stores the SYN-cookie seed in shared memory in advance, before it is needed by slave cores for connection validation. This preliminary action allows slave cores to quickly read the pre-prepared seed without waiting for generation, thereby maintaining fast connection establishment speed while ensuring security.
Data Source
AI summary
The present solution is directed to systems and methods for synchronizing a random seed value among a plurality of multi-core nodes in a cluster of nodes for generating a cookie signature. The cookie signature may be used for protection from SYN flood attacks. A cluster of nodes comprises one master node and one or more other nodes. Each node comprises one master core and one or more other cores. A random number is generated at the master core of the master node. The random number is synchronized across every other core. The random number is used to generated a secret key value that is attached in the encoded initial sequence number of a SYN-ACK packet. If the responding ACK packet does not contain the secret key value, then the ACK packet is dropped.