TCP Security Engine for DDoS Filtering Between Clients and Servers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cyberattacks on the network protocol layer, particularly targeting TCP, pose significant challenges in communication networks, leading to disruptions and failures, with methods like DDOS attacks being particularly detrimental.
Innovation Solution
A network protocol security engine is configured to reside between client and server devices, performing validations on packet attributes to filter and reject malicious requests, thereby preventing cyberattacks and protecting web server resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If TCP protocol is used for network communication, then reliable data transmission is achieved, but the system becomes vulnerable to DDOS attacks and protocol-level cyberattacks
Solution Approach 1:
The patent introduces a network protocol security engine as an intermediary component positioned between clients and web servers. This security engine validates TCP packets, filters malicious traffic, and isolates attack traffic from legitimate web service processing, thereby protecting servers from DDOS attacks while maintaining reliable communication for authorized requests
Solution Approach 2:
The patent segments the network security function by separating TCP connection processing from web service handling. The security engine operates as a distinct layer that handles protocol validation and attack filtering independently, allowing web servers to focus solely on processing legitimate requests without the overhead of security processing
2Object-affected harmful factors
If network security validations are performed on all packets, then attack filtering capability is improved, but system performance and processing speed deteriorate
Solution Approach 1:
The security engine performs preliminary validation of TCP packet attributes (such as sequence numbers, acknowledgment numbers, and flag combinations) before packets reach the web server. By conducting these security checks in advance at the network layer, the system filters out malicious traffic early, preventing it from consuming server resources and maintaining high processing speeds for legitimate requests
Solution Approach 2:
The patent extracts security validation functionality from the web server processing path and places it in a dedicated security engine at the network layer. This extraction allows security checks to be performed independently on all packets without interfering with web server performance, as the security engine handles validation while servers focus on processing authorized requests
3Device complexity
If TCP connection processing is integrated with web services, then system simplicity is maintained, but resource exhaustion from attacks directly impacts web service performance
Solution Approach 1:
The security engine serves as an intermediary layer between network traffic and web services, handling all TCP connection processing and attack filtering independently. This mediation ensures that even when attacks consume network resources, web servers remain unaffected and continue processing legitimate requests with optimal performance
Solution Approach 2:
The patent segments the system into distinct functional components: the security engine handles network-level security and connection management, while web servers handle application-level processing. This segmentation isolates web services from attack traffic, preventing resource exhaustion at the server level while maintaining overall system functionality
Data Source
AI summary
A method comprises configuring a network protocol security engine to separately reside between a set of one or more first computing devices (e.g., clients) making one or more service requests (e.g., TCP requests) and a set of one or more second computing devices (e.g., web servers) responding to the one or more service requests. The network protocol security engine validates packets associated with the requests/responses to either accept or reject the requests/responses and thus prevent cyberattacks (e.g., flooding attacks) from adversely affecting resources of the set of one or more second computing devices.