Systems and methods for protecting cluster systems from TCP SYN attack
The present solution is directed to systems and methods for synchronizing a random seed value among a plurality of multi-core nodes in a cluster of nodes for generating a cookie signature. The cookie signature may be used for protection from SYN flood attacks. A cluster of nodes comprises one master node and one or more other nodes. Each node comprises one master core and one or more other cores. A random number is generated at the master core of the master node. The random number is synchronized across every other core. The random number is used to generated a secret key value that is attached in the encoded initial sequence number of a SYN-ACK packet. If the responding ACK packet does not contain the secret key value, then the ACK packet is dropped.
1. A method for synchronizing a random seed value among a plurality of multi-core nodes in a cluster of nodes for generating a cookie signature, the method comprising:
(a) generating, by a master core on a master node of a cluster of nodes comprising a plurality of cores, a random seed to be synchronized across each core of each node in the cluster of nodes;
(b) storing, by the master core on the master node, the random seed to memory on the master node accessible by each core in the master node;
(c) receiving, by each master core on each other node in the cluster, the random seed sent by the master core of the master node;
(d) storing, by each master core on each other node in the cluster, the random seed to memory on each node accessible by each core in each node; and
(e) generating, by each core of each node in the cluster of nodes, a cookie signature based on the random seed responsive to a predetermined timer.
2. The method of claim 1 , wherein (c) further comprises:
receiving, by a receiving core on each other node in the cluster, the random seed sent by the master core of the master node; and
steering, by each receiving core, the random seed to a master core in each other node in the cluster.
3. The method of claim 1 , further comprising
storing, at each core of each node in the cluster of nodes, a current cookie signature as a previous cookie signature, and the generated cookie signature as the current cookie signature.
4. The method of claim 1 , wherein (a) further comprises
generating, by the master core on the master node of the cluster of nodes, the random seed, responsive to a second predetermined timer set to expire longer than the predetermined timer.
5. The method of claim 1 , wherein (e) further comprises
generating, by each core of each node in the cluster of nodes, an array of cookie signatures.
6. The method of claim 1 , wherein (e) further comprises
generating, by each core of each node in the cluster of nodes, an array of cookie signatures, by using the random seed as an initial seed of a pseudo-random number function to generate a first cookie signature, and generating each successive cookie signature by using a preceding cookie signature as a seed for the pseudo-random number function.
7. The method of claim 6 , further comprising
generating a cookie by concatenating one or more cookie signatures in the array of cookie signatures.
8. The method of claim 1 , further comprising
using the generated cookie signature as part of a SYN cookie or a HTTP DoS cookie.
9. The method of claim 1 , further comprising:
receiving from a client, a SYN request at a first core of a node in the cluster;
responding to the client with a SYN-ACK message comprising a cookie with the cookie signature;
receiving from the client, an ACK message at a second core of the node in the cluster, the ACK message comprising a client cookie signature; and
accepting the ACK message in response to matching the client cookie signature with the cookie signature.
10. The method of claim 9 , further comprising
storing, at each core of each node in the cluster of nodes, a current cookie signature as a previous cookie signature, and the generated cookie signature as the current cookie signature;
comparing the client cookie signature with the current cookie signature and the previous cookie signature;
determining whether a new random seed is stored in a memory accessible by the second core;
storing, at the second core, the current cookie signature as the previous cookie signature;
generating a new current cookie signature based on the new random seed in the memory accessible by the second core; and
allocating resources in response to matching the client cookie signature with the new current cookie signature.
11. A system for synchronizing a random seed value among a plurality of multi-core nodes in a cluster of nodes for generating a cookie signature, the system comprising:
a cluster of nodes, each node comprising a plurality of cores;
a master core on a master node of the cluster of nodes, configured to:
generate a random seed to be synchronized across each core of each node in the cluster of nodes; and
store the random seed to memory on the master node accessible by each core in the master node;
each other node in the cluster, configured to:
receive, by each master core of each node, the random seed sent by the master core of the master node; and
store the random seed to memory on each node accessible by each core in the each node; and
a packet engine on each core of each node in the cluster of nodes, configured to
generate a cookie signature based on the random seed responsive to a predetermined timer.
12. The system of claim 11 , wherein each other node in the cluster further comprises
a receiving core configured to:
receive the random seed sent by the master core of the master node; and
steer the random seed to each node's master core.
13. The system of claim 11 , wherein each node in the cluster of nodes is further configured to
store, at each core of each node in the cluster of nodes, a current cookie signature as a previous cookie signature, and the generated cookie signature as the current cookie signature.
14. The system of claim 11 , wherein the master core of the master node is further configured to
generate the random seed to be synchronized across each core of each node in the cluster of nodes, responsive to a second predetermined timer set to expire longer than the predetermined timer.
15. The system of claim 11 , wherein the packet engine is further configured to generate an array of cookie signatures.
16. The system of claim 15 , wherein the packet engine is further configured to
generate, an array of cookie signatures, by using the random seed as an initial seed of a pseudo-random number function to generate a first cookie signature, and generate each successive cookie signature by using a preceding cookie signature as a seed for the pseudo-random number function.
17. The system of claim 16 , wherein the packet engine is further configured to
generate a cookie by concatenating one or more cookie signatures in the array.
18. The system of claim 11 , wherein the packet engine is further configured to
use the generated cookie signature as part of a SYN cookie or a HTTP DoS cookie.
19. The system of claim 11 , wherein the packet engine is further configured to:
receive from a client, a SYN request at a first core of a node in the cluster;
respond to the client with a SYN-ACK message comprising a cookie with the cookie signature;
receive from the client, an ACK message at a second core of the node in the cluster, the ACK message comprising a client cookie signature; and
accept the ACK message in response to matching the client cookie signature with the cookie signature.
20. The system of claim 19 , wherein the packet engine is further configured to
store a current cookie signature as a previous cookie signature, and the generated cookie signature as the current cookie signature;
compare the client cookie signature with the current cookie signature and the previous cookie signature;
determine whether a new random seed is stored in a memory accessible by a second core;
store, at the second core, the current cookie signature as the previous cookie signature;
generate a new current cookie signature based on the new random seed in the memory accessible by the second core; and
allocate resources in response to matching the client cookie signature with the new current cookie signature.