Secret hashing for TCP SYN/FIN correspondence
A mechanism for detecting denial of service attacks in a digital communications system is described. A probabilistically determined portion of input packets of a connection are processed using a hash function to determine whether the packets belong to the flow initiated by a TCP SYN packet. The hash function includes a secret key for additional security. The result of the hash function is added to a value which is dependent on the sequence number of a packet being processed.
1. A method of detecting a denial of service attack on a connection in a digital communications system, the method comprising the steps of:
providing a hash table, said hash table having a corresponding hash function and for storing a plurality of counters, each counter associated with an index of the hash table, each index calculated with use of said hash function;
determining for a TCP SYN packet received, a first index of said hash table by adding a value dependent upon an initial sequence number of said TCP SYN packet to the hash function of a secret key and at least one header field of said TCP SYN packet;
incrementing a first counter associated with said first index;
selecting, based on a probability per packet received other than a SYN, FIN, or RST packet, a subsequent packet;
determining for said subsequent packet selected, a second index of said hash table by adding a value dependent upon a sequence number of said subsequent packet to the hash function of said secret key and the at least one header field of said subsequent packet; and
determining that there is a denial of service attack, if:
a second counter associated with said second index;
a third counter associated with a third index calculated from said second index minus one; and
a fourth counter associated with a fourth index calculated from said second index plus one
are all zero.
2. A method according to claim 1 wherein if it is determined that there is a denial of service attack, the subsequent packet is discarded.
3. A method according to claim 1 wherein said hash table supports insertion, deletion, and query operations.
4. A method according to claim 1 wherein said at least one header field of said TCP SYN packet comprises source IP address, destination IP address, source port, and destination port header fields of the TCP SYN packet, and wherein said at least one header field of said subsequent packet comprises source IP address, destination IP address, source port, and destination port header fields of the subsequent packet.
5. A method according to claim 1 wherein said secret key is a random number known only to a detection system performing said detecting of a denial of service attack.
6. A method according to claim 1 further comprising:
determining for a TCP FIN packet received, a fifth index of said hash table by adding a value dependent upon a sequence number of said TCP FIN packet to the hash function of the secret key and the at least one header field of said TCP FIN packet;
decrementing a fifth counter associated with the fifth index if said fifth counter is nonzero;
decrementing a sixth counter associated with a sixth index calculated from said fifth index minus one, if said fifth counter is zero and said sixth counter is nonzero; and
discarding said TCP FIN packet if said fifth counter and said sixth counter are both zero.
7. A method according to claim 1 wherein said value dependent upon an initial sequence number of said TCP SYN packet is calculated according to Floor(initial sequence number/(TCP window size*t)) and wherein said value dependent upon a sequence number of said subsequent packet is calculated according to Floor(sequence number/(TCP window size*t)).
8. A method according to claim 7 wherein t is a confidence number equal to 2 to the power of 10.
9. A method according to claim 1 wherein the probability per packet received is 0.01.
10. A method according to claim 1 further comprising:
determining for a TCP FIN packet received, a fifth index of said hash table by adding a value dependent upon a sequence number of said TCP FIN packet to the hash function of the secret key and the at least one header field of said TCP FIN packet;
decrementing a fifth counter associated with the fifth index if said fifth counter is nonzero;
decrementing a sixth counter associated with a sixth index calculated from said fifth index minus one, if said fifth counter is zero and said sixth counter is nonzero; and
discarding said TCP FIN packet if said fifth counter and said sixth counter are both zero;
wherein if it is determined that there is a denial of service attack, the subsequent packet is discarded, wherein said at least one header field of said TCP SYN packet comprises source IP address, destination IP address, source port, and destination port header fields of the TCP SYN packet, wherein said at least one header field of said subsequent packet comprises source IP address, destination IP address, source port, and destination port header fields of the subsequent packet, wherein said at least one header field of said TCP FIN packet comprises source IP address, destination IP address, source port, and destination port header fields of the TCP FIN packet, wherein said secret key is a random number known only to a detection system performing said detecting of a denial of service attack, wherein said value dependent upon an initial sequence number of said TCP SYN packet is calculated according to Floor(initial sequence number/(TCP window size*t)), wherein said value dependent upon a sequence number of said subsequent packet is calculated according to Floor(sequence number/(TCP window size*t)), and wherein said value dependent upon a sequence number of said TCP PIN packet is calculated according to Floor(sequence number of said TCP FIN packet/(TCP window size*t)).
11. A method of detecting a denial of service attack on a connection in a digital communications system, the method comprising the steps of:
providing a hash table, said hash table having a corresponding hash function and for storing a plurality of counters, each counter associated with an index of the hash table, each index calculated with use of said hash function;
determining for a TCP SYN packet received, a first index of said hash table by adding a value dependent upon said TCP SYN packet to the hash function of a secret key and at least one header field of said TCP SYN packet;
incrementing a first counter associated with said first index;
selecting, based on a probability per packet received other than a SYN, FIN, or RST packet, a subsequent packet;
determining for said subsequent packet selected, a second index of said hash table by adding a value dependent upon an acknowledgement number of said subsequent packet to the hash function of said secret key and the at least one header field of said subsequent packet; and
determining that there is a denial of service attack, if:
a second counter associated with said second index;
a third counter associated with a third index calculated from said second index minus one; and
a fourth counter associated with a fourth index calculated from said second index plus one
are all zero.