Proxy detection systems and methods
A method includes receiving, from a client device, a first request to establish a transport-layer connection between the client device and the server, the first request containing a first source port number; in response to receiving the first request, initiating a delay timer and withholding transmission of an acknowledgement to the first request until expiry of the delay timer; receiving from the client device, prior to expiry of the delay timer, a second request to establish the transport-layer connection; determining whether the second request contains a second source port number matching the first source port number; and selecting, based on the determination, a handling action for the second request.
1 . A proxy detection method in a server, the method comprising:
receiving, from a client device, a first request to establish a transport-layer connection between the client device and the server, the first request containing a first source port number;
in response to receiving the first request and prior to establishing the transport-layer connection, initiating a delay timer and withholding transmission of an acknowledgement to the first request until expiry of the delay timer;
receiving from the client device, prior to expiry of the delay timer, a second request to establish the transport-layer connection;
in response to determining that the second request contains a second source port number matching the first source port number, initiating establishment of the transport-layer connection with the client device; and
selecting, based on the determination, a handling action for the second request.
2 . The method of claim 1 , wherein selecting the handling action includes:
when the determination is negative, discarding the first request and the second request, without sending an acknowledgement to the client device.
3 . The method of claim 1 , wherein selecting the handling action includes:
when the determination is negative, providing an indication that the client device is likely a proxy for a client endpoint to an auxiliary detector.
4 . The method of claim 1 , wherein the transport-layer connection is based on the Transport Control Protocol (TCP), wherein the first request includes a SYN message, and wherein initiating establishment of the transport-layer connection includes sending a SYN-ACK message to the client device.
5 . The method of claim 4 , further comprising:
determining a first time period associated with the transport-layer connection;
in response to receiving, from the client device over the transport-layer connection, a second request to establish a secure link between a client endpoint and the server, transmitting a second message to the client endpoint according to a handshake sequence for establishing the secure link;
determining a second time period associated with completion of the second handshake sequence; and
generating, based on the first time period and the second time period, a score indicating a likelihood that the client device is a proxy for the client endpoint.
6 . The method of claim 5 , wherein generating the score includes determining a difference between the first and second time periods.
7 . The method of claim 5 , wherein determining the first time period includes determining a time elapsed between transmission of the acknowledgement, and receipt of an ACK message from the client device.
8 . The method of claim 1 , wherein the first request contains a first sequence number;
and wherein the determination further comprises:
determining whether the second request contains a second sequence number matching the first sequence number.
9 . The method of claim 8 , wherein selecting the handling action includes:
when at least one of
(i) the first source port number does not match the second source port number,
or (ii) the first sequence number does not match the second sequence number,
discarding the first request and the second request, without sending an acknowledgement to the client device.
10 . The method of claim 1 , wherein the delay timer is between 1 second and 2 seconds.
11 . A computing device, comprising:
a communications interface; and
a processor configured to:
receive via the communications interface, from a client device, a first request to establish a transport-layer connection between the client device and the server, the first request containing a first source port number;
in response to receiving the first request and prior to establishing the transport-layer connection, initiate a delay timer and withhold transmission of an acknowledgement to the first request until expiry of the delay timer;
receive from the client device, prior to expiry of the delay timer, a second request to establish the transport-layer connection;
in response to determining that the second request contains a second source port number matching the first source port number, initiate establishment of the transport-layer connection with the client device; and
select, based on the determination, a handling action for the second request.
12 . The computing device of claim 11 , wherein the processor is configured to select the handling action by:
when the determination is negative, discarding the first request and the second request, without sending an acknowledgement to the client device.
13 . The computing device of claim 11 , wherein the processor is configured to select the handling action by:
when the determination is negative, providing an indication that the client device is likely a proxy for a client endpoint to an auxiliary detector.
14 . The computing device of claim 11 , wherein the transport-layer connection is based on the Transport Control Protocol (TCP), wherein the first request includes a SYN message, and wherein the processor is configured to initiate establishment of the transport-layer connection by sending a SYN-ACK message to the client device.
15 . The computing device of claim 14 , wherein the processor is further configured to:
determine a first time period elapsed between transmission of the acknowledgement, and receipt of an ACK message from the client device;
in response to receiving, from the client device over the transport-layer connection, a second request to establish a secure link between a client endpoint and the server, transmit a second message to the client endpoint according to a handshake sequence for establishing the secure link;
determine a second time period associated with completion of the second handshake sequence; and
generate, based on the first time period and the second time period, a score indicating a likelihood that the client device is a proxy for the client endpoint.
16 . The computing device of claim 15 , wherein the processor is configured to generate the score by determining a difference between the first and second time periods.
17 . The computing device of claim 15 , wherein the processor is configured to determine the first time period by determining a time elapsed between transmission of the acknowledgement, and receipt of an ACK message from the client device.
18 . The computing device of claim 11 , wherein the first request contains a first sequence number; and wherein the determination further comprises:
determining whether the second request contains a second sequence number matching the first sequence number.
19 . The computing device of claim 18 , wherein the processor is configured to select the handling action by:
when at least one of
(i) the first source port number does not match the second source port number,
or (ii) the first sequence number does not match the second sequence number,
discarding the first request and the second request, without sending an acknowledgement to the client device.
20 . The computing device of claim 11 , wherein the delay timer is between 1 second and 2 seconds.