Systems and methods for network access control

1. A system for network access control, system comprising:

a network device comprising one or more processors; and

a memory communicatively coupled to the network device, the memory storing instructions executable by the one or more processors of the network device, the network device being configured to:

determine whether a client device is a trusted source or an untrusted source for a network using a SYN packet received from the client device, the SYN packet comprising identifying information for the client device;

generate a SYN cookie using a cryptographic hash function computed over the identifying information of the client device received in the SYN packet from the client device;

based on the determination that the client device is neither the trusted source nor the untrusted source, transmit a SYN/ACK packet to the client device, the SYN/ACK packet comprising the SYN cookie and identifying information for the network device;

receive an ACK packet from the client device, the ACK packet including the identifying information for the client device, identifying information for the network device, and the SYN cookie;

establish a connection with the network for the client device; and

apply a SYN cookie tolerance level to determine whether a number of times the client device provided an incorrect SYN cookie in one or more ACK packets when attempting to connect to the network device exceeds a predetermined threshold, wherein the connection is established when the number of times the client device provides the incorrect SYN cookie is below the predetermined threshold.

2. The system of claim 1 , wherein the network device is further configured to place the client device on a black list if the client device is subsequently determined to be the untrusted source.

3. The system of claim 1 , wherein the network device is further configured to drop, based on determining that the client device is the untrusted source, the SYN packet to deny network access to the client device.

4. The system of claim 1 , wherein the network device is further configured to transmit, based on determining that the client device is the trusted source, a SYN/ACK packet to the client device, the SYN/ACK packet comprising identifying information for the network device;

receive an ACK packet from the client device that includes the identifying information for the client device and the identifying information for the network device; and

establish the connection with the network for the client device.

5. The system according to claim 1 , wherein the SYN cookie comprises one or more of the following: a maximum segment size value and a cryptographic hash function computed using at least one of an IP address of the network device, a port number of the network device, an IP address of the client device, and a port number of the client device.

6. A system for network access control, system comprising:

a network device comprising one or more processors; and

a memory communicatively coupled to the network device, the memory storing instructions executable by the one or more processors of the network device, the network device being configured to:

determine whether a client device is a trusted source or an untrusted source for a network using a SYN packet received from the client device, the SYN packet comprising identifying information for the client device;

generate a SYN cookie using a cryptographic hash function computed over the identifying information of the client device received in the SYN packet from the client device;

based on the determination that the client device is neither the trusted source nor the untrusted source, transmit a SYN/ACK packet to the client device, the SYN/ACK packet comprising the SYN cookie and identifying information for the network device;

receive an ACK packet from the client device, the ACK packet including the identifying information for the client device, identifying information for the network device, and the SYN cookie;

establish a connection with the network for the client device;

receive a number of ACK packets from the client device that include an incorrect SYN cookie, wherein the incorrect SYN cookie comprises identifying information for the client device that is incorrect or identifying information for the network device that is incorrect;

apply a SYN cookie tolerance level, wherein the SYN cookie tolerance level specifies a number of times the client device is allowed to supply the incorrect SYN cookie;

add the identifying information for the client device to a black list if the client device exceeds the SYN cookie tolerance level, the black list storing identifying information for one or more untrusted sources; and

drop subsequent SYN packets or ACK packets received from the client device.

7. A system for network access control, system comprising:

a network device comprising one or more processors; and

a memory communicatively coupled to the network device, the memory storing instructions executable by the one or more processors of the network device, the network device being configured to:

determine whether a client device is a trusted source or an untrusted source for a network using a SYN packet received from the client device, the SYN packet comprising identifying information for the client device;

generate a SYN cookie using a cryptographic hash function computed over the identifying information of the client device received in the SYN packet from the client device;

based on the determination that the client device is neither the trusted source nor the untrusted source, transmit a SYN/ACK packet to the client device, the SYN/ACK packet comprising the SYN cookie and identifying information for the network device;

receive an ACK packet from the client device, the ACK packet including the identifying information for the client device, identifying information for the network device, and the SYN cookie;

establish a connection with the network for the client device;

set an allowable connection rate policy for the client device, wherein the allowable connection rate policy specifies a maximum number of times the client device is to attempt to connect to the network in a given time period;

add the identifying information for the client device to a black list if the client device violates the allowable connection rate policy; and

drop subsequent SYN packets or ACK packets received from the client device.

8. The system according to claim 1 , wherein the network device is further configured to perform a SYN cookie check, the SYN cookie check comprising comparing information in the SYN cookie received in the ACK packet from the client device with information in the SYN cookie provided by the network device in the SYN/ACK packet, wherein the establishing of the connection is performed based on passing, by the client device, the SYN cookie check.

9. A method for network access control, the method comprising:

determining, at a network device, whether a client device is a trusted source or an untrusted source for a network using a SYN packet received from the client device, the SYN packet comprising identifying information for the client device;

generating, by the network device, a SYN cookie using a cryptographic hash function computed over the identifying information of the client device received in the SYN packet from the client device;

based on determining that the client device is neither the trusted source nor the untrusted source, transmitting a SYN/ACK packet to the client device, the SYN/ACK packet comprising the SYN cookie and identifying information for the network device;

receiving an ACK packet from the client device, the ACK packet including the identifying information for the client device, identifying information for the network device, and the SYN cookie;

establishing a connection with the network for the client device; and

applying a SYN cookie tolerance level to determine whether a number of times the client device provided an incorrect SYN cookie in one or more ACK packets when attempting to connect to the network device exceeds a predetermined threshold, wherein the connection is established when the number of times the client device provides the incorrect SYN cookie is below the predetermined threshold.

10. The method of claim 9 , further comprising placing the client device on a black list if the client device is subsequently determined to be the untrusted source.

11. The method of claim 9 , further comprising dropping, based on determining that the client device is the untrusted source, the SYN packet to deny network access to the client device.

12. The method of claim 9 , further comprising:

based on determining that the client device is the trusted source, transmitting a SYN/ACK packet to the client device, the SYN/ACK packet comprising identifying information for the network device;

receiving an ACK packet from the client device that includes the identifying information for the client device and the identifying information for the network device; and

establishing the connection with the network for the client device.

13. The method of claim 9 , wherein the establishing the connection comprises connecting the client device to a host server such that network traffic flows directly from the host server to the client device.

14. A method for network access control, the method comprising:

determining, at a network device, whether a client device is a trusted source or an untrusted source for a network using a SYN packet received from the client device, the SYN packet comprising identifying information for the client device;

generating, by the network device, a SYN cookie using a cryptographic hash function computed over the identifying information of the client device received in the SYN packet from the client device;

based on determining that the client device is neither the trusted source nor the untrusted source, transmitting a SYN/ACK packet to the client device, the SYN/ACK packet comprising the SYN cookie and identifying information for the network device;

receiving an ACK packet from the client device, the ACK packet including the identifying information for the client device, identifying information for the network device, and the SYN cookie;

establishing a connection with the network for the client device;

receiving a number of ACK packets from the client device that include an incorrect SYN cookie, wherein the incorrect SYN cookie comprises identifying information for the client device that is incorrect or identifying information for the network device that is incorrect;

applying a SYN cookie tolerance level, wherein the SYN cookie tolerance level specifies a number of times the client device is allowed to supply the incorrect SYN cookie;

adding the identifying information for the client device to a black list if the client device exceeds the SYN cookie tolerance level, the black list storing identifying information for one or more untrusted sources; and

dropping subsequent SYN packets or ACK packets received from the client device.

15. A method for network access control, the method comprising:

determining, at a network device, whether a client device is a trusted source or an untrusted source for a network using a SYN packet received from the client device, the SYN packet comprising identifying information for the client device;

generating, by the network device, a SYN cookie using a cryptographic hash function computed over the identifying information of the client device received in the SYN packet from the client device;

based on determining that the client device is neither the trusted source nor the untrusted source, transmitting a SYN/ACK packet to the client device, the SYN/ACK packet comprising the SYN cookie and identifying information for the network device;

receiving an ACK packet from the client device, the ACK packet including the identifying information for the client device, identifying information for the network device, and the SYN cookie;

establishing a connection with the network for the client device;

setting an allowable connection rate policy for the client device, wherein the allowable connection rate policy specifies a maximum number of times the client device is to attempt connecting to the network in a given time period;

adding the identifying information for the client device to a black list if the client device violates the allowable connection rate policy; and

dropping subsequent SYN packets or ACK packets received from the client device.

16. The method according to claim 9 , further comprising:

performing a SYN cookie check, the SYN cookie check comprising comparing information in the SYN cookie received in the ACK packet from the client device with information in the SYN cookie provided by the network device in the SYN/ACK packet, wherein the establishing of the connection is performed based on passing, by the client device, the SYN cookie check.

17. A method for network access control, the method comprising:

determining, at a network device, whether a client device is a trusted source or an untrusted source for a network using a SYN packet received from the client device, the SYN packet comprising identifying information for the client device;

generating, by the network device, a SYN cookie using a cryptographic hash function computed over the identifying information of the client device received in the SYN packet from the client device;

based on determining that the client device is neither the trusted source nor the untrusted source, transmitting a SYN/ACK packet to the client device, the SYN/ACK packet comprising the SYN cookie and identifying information for the network device;

receiving an ACK packet from the client device, the ACK packet including the identifying information for the client device, identifying information for the network device, and the SYN cookie;

establishing a connection with the network for the client device;

setting a SYN cookie threshold, wherein the SYN cookie threshold identifies a total number of times the client device is to provide the SYN cookie to the network device;

for each time the client device provides the SYN cookie to the network device, reducing the SYN cookie threshold by one until the SYN cookie threshold is zero;

when the SYN cookie threshold is zero, adding the identifying information for the client device to a black list; and

dropping subsequent SYN packets or ACK packets received from the client device.

18. The system of claim 6 , wherein the network device is further configured to place the client device on a black list if the client device is subsequently determined to be the untrusted source.

19. The system of claim 6 , wherein the network device is further configured to drop, based on determining that the client device is the untrusted source, the SYN packet to deny network access to the client device.

20. The method of claim 14 , further comprising placing the client device on a black list if the client device is subsequently determined to be the untrusted source.