TCP Validation via Systematic Transmission Regulation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to effectively mitigate denial of service attacks, particularly distributed denial of service (DDoS) attacks, as they either rely on server-side traffic handling, cannot prevent 'syn flood' attacks, are cumbersome, or struggle with implementation in asymmetric networks and spoofed attacks.
Innovation Solution
Implementing a method that intercepts and validates TCP SYN packets by using a hash table to track session states, blocking illegitimate connections by storing information and awaiting subsequent SYN packets, and applying a timeout to expired sessions, thereby preventing resource exhaustion.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the server reserves and allocates system resources for each TCP SYN packet, then legitimate connections are facilitated, but system resources are exhausted by attackers generating large quantities of SYN packets
Solution Approach 1:
The patent applies preliminary action by having the server reserve resources in advance for potential connections before actual data transfer begins. The server allocates buffer space and connection state structures when receiving SYN packets, preparing resources proactively to facilitate legitimate connections quickly while maintaining control mechanisms to prevent resource exhaustion from attack traffic.
Solution Approach 2:
The patent changes the parameter of resource allocation timing and quantity based on connection validation state. Resources are allocated dynamically - initially for SYN reception, then adjusted based on whether the connection completes the three-way handshake successfully. This parameter change allows the system to hold resources for legitimate clients while discarding allocations from attackers who don't complete the handshake.
2Duration of action of moving object
If the server maintains resources for a predetermined period of time, then connection establishment is supported, but denial of service occurs when resources are exhausted
Solution Approach 1:
The patent applies dynamics by making the resource maintenance period adaptive rather than fixed. The server maintains resources for the minimum duration needed to complete the TCP three-way handshake, then automatically releases them. This dynamic approach ensures resources are held long enough for legitimate connections while being released promptly to prevent denial of service when attack traffic accumulates.
3Measurement precision
If prior art systems detect denial of service conditions, then attack identification is achieved, but mitigation of the situation fails
Solution Approach 1:
The patent converts the harmful effect of resource allocation into a benefit by using resource allocation itself as the detection mechanism. Instead of adding separate detection systems, the server's normal resource allocation behavior becomes the detection tool - legitimate connections consume resources appropriately and complete handshakes, while attackers exhaust resources without completion. The harm of resource consumption is transformed into a beneficial detection signal that automatically mitigates attacks through resource release.
Data Source
AI summary
The present invention provides a technique for validating TCP communication between a client requesting resources and a server providing requested resources to protect the specified server from a denial of service attack wherein a plurality of clients initiate communication with a server, but do not complete the communication for the purpose of denying service to the server from other legitimate clients. Through systematic transmission regulation of TCP packets, an intermediary apparatus or set of apparatuses, can, to a high degree of certainty, validate client connections to protect the server from this saturated condition. The communication is then reproduced by the apparatus or apparatuses.