TCP Connection Protection via SYN Cookie Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for defending against SYN FLOOD attacks suffer from low protection performance and delayed connection responses due to the need to re-establish TCP connections after validation, which disrupts normal client connections and increases resource usage.
Innovation Solution
A processing system and method for TCP connections that involves a protection device and a connection device, where the protection device receives and verifies connection packets, counts SYN packets, and generates verification information to forward or discard packets based on thresholds, ensuring legitimate connections are maintained without interrupting existing connections.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SYN COOKIE authorization is used to defend against SYN FLOOD attack, then protection capability is improved, but connection response time increases due to need to re-establish connection after validation
Solution Approach 1:
The protection device performs preliminary verification of SYN packets by generating and validating SYN cookies before forwarding to the server. This preliminary action filters out invalid connection requests in advance, preventing them from consuming server resources and causing subsequent connection re-establishments.
Solution Approach 2:
The protection device acts as an intermediary between the client and the server, handling SYN packet verification locally. By validating SYN cookies at this intermediate layer, the system avoids the need for the server to re-establish connections for attacked clients, thereby reducing connection response time while maintaining protection capability.
2Reliability
If TCP proxy is used to forward connections, then protection capability is improved, but device complexity increases and response delay elongates
Solution Approach 1:
The patent extracts the connection verification function from the server and places it in the protection device. By taking out the SYN packet validation logic, the server no longer needs to maintain complex proxy connections, reducing overall system complexity while preserving protection capability.
Solution Approach 2:
The protection device performs self-service by locally validating SYN packets and generating appropriate responses. This self-service approach eliminates the need for the protection device to maintain complex proxy connections to the server, simplifying the overall system architecture.
3Reliability
If whitelist authorization is used, then protection capability is improved, but connection interruption increases affecting client experience
Solution Approach 1:
The protection device performs preliminary verification of SYN packets using SYN cookies before any connection is established. This preliminary action identifies and filters invalid requests in advance, preventing connection interruptions for legitimate clients while maintaining protection against attacks.
Solution Approach 2:
The protection device uses feedback from SYN cookie validation to make intelligent decisions about packet forwarding. By validating SYN packets and receiving feedback on their legitimacy, the system can maintain continuous connections for authorized clients while blocking attacks, improving both protection capability and connection continuity.
Data Source
Figure 1~2
Figure 3~4
Figure 5~6
AI summary
The present disclosure provides a processing method, a device, and a system for TCP connection. The method includes: receiving a connection packet sent by a client for establishing a TCP connection with a server; determining a packet type of the connection packet, where the packet type of the connection packet at least includes SYN packet and ACK packet; when the packet type of the connection packet is the ACK packet, utilizing connection verification information to perform verification of the ACK packet, where the connection verification information is generated based on the SYN packet; and when the verification of the ACK packet is passed, forwarding the ACK packet to the server. The present disclosure solves issues of low protection performance and delay in connection response caused by the need to re-establish connection after validating the TCP connection sent by the client.