Secret hashing for TCP SYN/FIN correspondence
View Patent ↗Methods of preventing flooding-type denial-of-service attacks in a computer-based network are described. Connection establishing messages known as SYN packets are matched with connection terminating messages (FIN packets) by using a hash algorithm. The hash algorithm or message digest uses source and destination IP addresses, port numbers, and a secret key as input parameters. The SYN packets and FIN packets are mapped to buckets using the hash algorithm and statistics are maintained for each bucket. A correspondence between SYN packets and FIN packets is maintained to close a security hole.
1. A method of detecting a denial of service (DoS) attack at a router in a digital communications system, the method comprising the steps of:
a) calculating, for each connection establishing and connection terminating packet received at the router, a value uniquely identifying a connection;
b) incrementing by one during a predetermined time interval a global count and a bucket count of a bucket identified uniquely by the value upon receiving a connection establishing packet, wherein said global count uses any one of a cumulative sum, a moving average, or a filter derivative to detect open connections;
c) decrementing by one during the predetermined time interval the global count and the bucket count of the bucket identified uniquely by the value upon receiving a connection terminating packet, only if the bucket count is strictly positive; and
d) identifying a DoS attack using the global count by tracking unsuccessful connection attempts over successive time intervals.
2. The method as defined in claim 1 wherein the predetermined time interval is one of a continuous sliding window or a non-overlapping sliding window.
3. The method as defined in claim 2 wherein the bucket counter is reset at the end of the predetermined time interval.
4. The method as defined in claim 1 wherein said connection establishing packet is a SYN or a SYN/ACK packet and said connection terminating packet is a FIN packet.
5. A method according to claim 1 wherein said router is connected between a LAN and a network in said digital communication system, said connection establishing packet being received from the LAN side of the router and said connection terminating packet being received from the network side of the router.
6. A method according to claim 5 wherein said connection establishing packet is a SYN packet and said connection terminating packet is a FIN packet.
7. A method according to claim 1 wherein said router is located between a LAN and a network in said digital communication system, said connection establishing packet being received from the network side of the router and said connection terminating packet being received from the LAN side of the router.
8. A method according to claim 7 wherein said connection establishing packet is a SYN packet and said connection terminating packet is a FIN packet.
9. A method according to claim 1 wherein said value is determined using a hash function with inputs of source IP address, destination IP address, port number, and a key.
10. The method of claim 1 wherein said each value is determined by hashing the data representing the source IP address and the destination IP address of said connection establishing packet and connection terminating packet, and the port number on which said connection establishing packet and connection terminating packet are received.
11. The method of claim 1 wherein said values are maintained in a hash table that includes a plurality of buckets, each bucket maintaining a respective bucket count, and each bucket further being accessed for increasing or decreasing said respective bucket count using said key.
12. The method of claim 11 wherein each bucket is a Bloom filter.
13. The method of claim 11 wherein each bucket maintains at least one additional count for distinctly counting one or more of: the number of SYN packets received in said bucket, the number of RST packets received in said bucket, and the number of FIN packets deducted from said bucket.
14. A method of detecting a denial of service (DOS) attack at a router in a digital communications system, the method comprising the steps of:
a) calculating at the router, for each connection establishing and connection terminating packet, a value using as input parameters source and destination IP addresses and port number of each said packet and a key;
b) during a predetermined time interval, incrementing by one a bucket count in a bucket identified uniquely by the value upon receiving a connection establishing packet;
c) during the predetermined time interval, decrementing by one the bucket count in the bucket identified uniquely by the value upon receiving a connection terminating packet if the bucket count is strictly positive;
d) incrementing by one a global count in a global counter upon receiving each connection establishing packet and decrementing by one the global count upon transmitting each connection terminating packet for counting all open connections at said router,
wherein said global count uses any one of a cumulative sum, a moving average, or a filter derivative to detect open connections.
15. A method according to claim 14 wherein said connection establishing packet is a SYN packet and said connection terminating packet is a FIN packet.