KR20110009350A - Real time high speed tcp proxy signal processor and real time high speed tcp proxy signal processing method - Google Patents

Abstract

PURPOSE: A real time high speed tcp proxy signal process apparatus and a real time tcp proxy signal processing method are provided to implement the high speed real time packet process by processing the traffic with real time wire speed. CONSTITUTION: A packet input unit is transmitted with the connect request signal packet being transmitted from a client(S01). A packet parser transmits the extraction information signal including the IP information and the TCP information of the client to a CD engine unit. The CD engine unit analyzes the information of the corresponding packet through an ACK standby table and a normal session table.

Description

REAL TIME HIGH SPEED TCP PROXY SIGNAL PROCESSOR AND REAL TIME HIGH SPEED TCP PROXY SIGNAL PROCESSING METHOD}

The present invention relates to a PCP proxy signal processing apparatus, and more particularly, Proxy function to the front end of the network to protect and detect the flooding attack using the weakness of the TCP protocol among malicious attacks on the server The present invention relates to a real-time high-speed PCP proxy signal processing apparatus that installs an excitation device so that only a pre-verified session can be connected to an internal network such as a server.

In recent years, the development of the Internet has brought much convenience to humankind. Internet traffic is also growing exponentially, and servers and clients connected to the Internet are growing beyond imagination.

In this age of the Internet, hacking attacks are increasing in an attempt to negatively disrupt the services of servers or other devices connected to the Internet, such as extortion of money or interference with competing services. The typical attack methods are DoS (Denial of Service) or DDoS (Distributed Denial of Service) by flooding attacks such as Syn-Flooding.

These attacks are not intended to obtain information by obtaining an account with any attack code, but are intended to prevent normal service provision by encroaching on a service provider's traffic or incapacitating equipment such as a server.

Especially in the field of packet processing device using TCP / IP type network and attack detection blocking using network, it is implemented by software method based on Server, but this is limited in processing packets in real time and high speed, and also in server By occupying the CPU or memory resources, such as the attack detection function, the defense function is a problem that the burden on providing the desired service, such as the real server.

The present invention for solving the above problems by installing a device having a proxy function in the front of the network to protect for the purpose of detecting and defending the flooding attack using the vulnerability of the TCP protocol among malicious attacks on the server, The purpose is to allow only the verified session to be connected to the internal network such as the server.

In addition, in consideration of the rapidly increasing Internet traffic, the real-time wire-speed is used to process the traffic by realizing the hardware method so that it does not interfere with the actual use of the Internet to enable high-speed real-time packet processing.

Real time high speed PCP signal processing apparatus according to the present invention for achieving the above object, the packet input unit 25 for receiving a connection request signal (Synchronous) packet transmitted from the client 10; A packet parser unit 26 configured to transmit the extracted information signal including the IP information and TCP information of the client 10 to the CD engine unit 21 from the packet of the signal received by the packet input unit 25; The CD engine unit 21 receives the extraction information signal from the packet parser unit 26 and analyzes the information of the packet through the Ack standby table 27 and the normal session table 28, and determines the packet. ; Ack standby table 27 to store the information of the packet including the connection request / response confirmation (SYN / ACK) signal transmitted to the client 10 to determine whether the normal through the CD engine 21 ; A normal session table 28 for storing information of a corresponding packet corresponding to a normal extraction information signal through the CD engine unit 21 is included.

The CD engine unit 21 includes: a packet input block 212 which receives an extraction information signal for a packet transmitted from the packet parser unit 26 and transmits it to a CD controller 211; An ack standby data processing block 213 for processing signals transmitted and received with the ack standby table 27 under the control of the CD controller 211; A normal session data processing block (214) for processing signals transmitted and received with the normal session table (28) by the control of the CD controller (211); Receives the packet signal transmitted through the packet input block 212, the data transmission and reception to the standby table 27 or the normal session table 28, the CD controller is provided to determine the information about the packet ( 211) may be included.

In addition, the Ack standby table 27 or the normal session table 28 may be provided with a TMS memory or may be provided with an SRAM or DRAM to search using an IP address hash.

The Ack standby table 27 or the normal session table 28 is provided with an SRAM or DRAM to search by using the eye dress hash, but has a Time Threshold for the Session that has exceeded the Threshold. The data may be deleted so that the handshaking process may be continuously performed. Also, the waiting table 27 or the normal session table 28 may be provided as an SRAM or DRAM for searching using an IP address hash. However, when multiple entries are grouped into a group and a full entry in the group is used, the oldest entry may be updated to be used.

In addition, the Ack standby table 27 or the normal session table 28 is provided with a TMC memory, for the Session exceeding the number of entries of the TMC memory to be updated from the oldest entry using the registration time information It may be provided.

In addition, in the real-time high-speed PCP proxy signal processing method using the PCP proxy signal processing apparatus, a connection request signal receiving step of receiving a connection request signal transmitted from the client 10 from the packet input unit 25 (S01). ; The packet parser 26 extracts an information signal for extracting information on a packet including IP information and TCP information from the packet parser 26 with respect to the connection request signal SYN transmitted from the client 10. A packet information extraction step (S02) which is extracted at 26 and transmitted to the CD engine unit 21; The extracted information signal of the packet is transmitted from the CD engine unit 21 to the normal session table 28, the normal session table 28 searches whether the information of the packet is included, and the search information searched for the packet. A normal session table retrieving step (S03) for causing a signal to be transmitted from the normal session table 28 to the CD engine unit 21; The CD engine 21 determines whether the information on the packet exists in the normal session table 28 among the search information signals searched through the normal session table 28, and the information on the packet is normal. If included in the session table 28, there is provided a real-time high speed PCP proxy signal processing method characterized in that it comprises a normal session discrimination step (S04) for transmitting the information signal corresponding to the packet to the server. .

In the normal session discrimination step (S04), if the information on the packet does not exist in the normal session table 28, the extracted information signal of the packet is transmitted from the CD engine 21 to the wait table 27. And a waiting table search step (S05) of searching for whether information of a corresponding packet is included in the waiting table 27 and transmitting the retrieved information signal from the waiting table 27 to the CD engine unit 21 (S05); When the information on the packet is present in the waiting table 27, the hack diagnosis step S06 may be included to discard the information of the packet.

In addition, when the information on the packet does not exist in the waiting table 27, the CD engine 21 connects to the client 10 corresponding to the packet. A request acknowledgment (SYN / ACK), a response acknowledgment sequence number (Sequence Number) is transmitted, and the acknowledgment information transmitting step (S07) for registering information on the corresponding packet to the standby table 27 is included. It may be provided.

When the information on the packet exists in the waiting table 27, the extracting information signal of the corresponding packet is transferred from the waiting table 27 to the normal session table 28. And a reset signal is transmitted to the client 10 side so that a new session can be made again.

The present invention configured as described above has been verified in advance by installing a device having a proxy function in front of a network to be protected for the purpose of detecting and defending a flooding attack using a vulnerability of a TCP protocol among malicious attacks on a server. The effect is that only the session can be connected to the internal network such as a server.

In addition, considering the rapidly increasing Internet traffic, it has the advantage of enabling high-speed real-time packet processing implemented by hardware method that processes traffic with real-time wire-speed so that it does not interfere with actual internet use.

Hereinafter, with reference to the accompanying drawings will be described in detail.

1 is a schematic configuration diagram of a PCP proxy signal processing apparatus according to the present invention, Figure 2 is a schematic illustration of the signal transmission in the PCP proxy signal processing apparatus according to the present invention, Figure 3 4 is a signal processing flowchart of a PCP signal processing apparatus according to the present invention, FIG. 4 is a signal processing flowchart of a PCP signal processing apparatus according to the present invention, and FIG. 5 is a CD engine part of the PC signal processing apparatus according to the present invention. 6 and 7 show schematic diagrams of the memory of the Ack standby table or the normal session table of the PCC proxy signal processing apparatus according to the present invention, respectively.

That is, the real-time high speed PCP proxy signal processing apparatus A according to the present invention receives a signal transmitted from the client 10 connected to the Internet (Internet), a network facility, etc. as shown in Figs. The packet is processed and transmitted to the server 15 connected to each other, so that signals such as content and various information are transmitted and received between the client 10 and the server 15.

The network information packet including the IP information and the TCP information is transmitted and received between the client 10, the TCP PROXY DATA PROCESSOR, and the server 15, which are provided as described above, by a handshaking method. First, the connection request signal (SYN, Synchronous) is transmitted from the client 10 to the PCP proxy signal processing apparatus A, the server 15, and the like, and the PCP proxy signal processing apparatus A and the server 15 are transmitted. For example, a SYN / ACK signal, which is a connection request signal / response acknowledgment (SYN / ACK, Acknowledge), is transmitted as a response signal, and a response acknowledgment (ACK) signal is transmitted from the client 10 by a handshaking method. . After such a series of processes, the PCP proxy signal processing apparatus A, the server 15, and the client 10 are established to transmit and receive data.

Looking at the detailed configuration of the real-time high-speed transmission PCC signal processing apparatus (A) according to the present invention as follows.

That is, as shown in FIG. 1, a packet input unit 25 connected to the client 10 and receiving a synchronous packet transmitted from the client 10 is provided, and the packet input unit 25 is provided. The packet parser 26 is provided to transmit the extracted information signal including the IP information and the TCP information of the client 10 to the CD engine 21 in the packet of the signal received by the. The packet parser 26 extracts information related to the client 10 including IP information and TCP information of the input packet, and transmits the information to the CD engine 21 (CD engine, check and decision engine). The information related to the client 10 is to be utilized.

The CD engine unit 21 receives the extraction information signal from the packet parser unit 26 and analyzes the information of the packet through the Ack standby table 27 and the normal session table 28, and checks the corresponding information. It is provided to determine the packet (Decision). That is, the engine that executes the flow chart as shown in FIG. 3 with respect to the IP information and the TCP information related to the client 10 transmitted from the packet parser 26, the queuing will be described later. The packet information related to the client 10 is identified through the table 27 (ACK waiting table) and the normal session table 28 (normal session table), and the processing direction of the packet is determined. .

Therefore, the wait table for storing the information of the packet including the connection request / response confirmation (SYN / ACK) signal transmitted to the client 10 to determine whether the normal packet through the CD engine 21 ( 27) is provided.

In addition, the CD engine 21 includes a normal session table 28 for storing the information of the packet corresponding to the normal extraction information signal, the real-time high-speed PCP proxy signal processing apparatus (A) according to the present invention It is provided.

The normal session table 28 may be provided as an IP pool that can access the internal network to be protected without interference of the CD engine unit 21 (Check and Decision Engine). In the normal session table 28, the entry update method may use a circle loop method, and data such as IP information registered first may be used in such a manner as to be a target to be deleted first.

In addition, the time-over IP information is assigned a Time Threshold value so that it is deleted when the corresponding Threshold is exceeded. Therefore, when receiving the SYN flag from the IP information that is not in the normal IP table, the verification procedure must be passed through the ACK waiting table to be newly registered in the normal session table. Could be.

The ACK wait table 27 is an IP pool for the IP waiting for the ACK response, for the IP transmitting the SYN / ACK response after receiving the connection request signal SYN for the verification process. The entry update method of the waiting table 27 may use the Circle Loop method, and the IP registered first may be used in such a manner as to be deleted first. And Time-Over IP can set Time Threshold value so that it can be deleted when the threshold is exceeded. When the new SYN information is received from the IP waiting for the ACK response, the corresponding SYN packet is discarded.

In addition, the S / W Inspection Engine 23 provided as shown in FIG. 1 is a software for determining whether an attack is made after software inspection of a packet that has passed through the CD engine unit 21 (Check and Decision Engine). Device. The S / W Inspection Engine 23 is provided such that the remaining attack detection and blocking functions are performed except for functions by the CD engine unit 21, the standby table 27, and the normal session table 28 according to the present invention. It could be.

The CD engine unit 21 includes a packet input block 212 that receives the extraction information signal for the packet transmitted from the packet parser unit 26 and transmits it to the CD controller 211 as shown in FIG. 5. Will be.

In addition, an Ack standby data processing block 213 for processing signals transmitted and received with the Ack standby table 27 side by the control of the CD controller 211 is provided, and by the control of the CD controller 211 The normal session data processing block 214 is provided for processing signals transmitted and received with the normal session table 28 side.

Thus, the CD controller 211 receives the packet signal transmitted through the packet input block 212, transmits and receives data to the standby table 27 or the normal session table 28, and transmits information on the packet. It is provided to determine.

The real-time high-speed PCP proxy signal processing apparatus (A) according to the present invention provided in this way is located in front of the software inspection in the network security equipment such as DDoS security equipment and IPS, and performs packet inspection in the DDoS security equipment or IPS equipment. Previously, the hardware stage was performed to perform the related functions. Therefore, it is provided to reduce the burden on the CPU or memory of the software processing unit.

In the packet transmission with the client 10, the TCP / IP information data is basically configured to form a session by a handshaking method, which is a Connection-Oriented Protocol. Thus, the real-time high-speed PCP proxy signal processing apparatus (A) of the present invention is provided to detect an attack of an attacker who violates this by using a basic handshaking method of TCP / IP.

That is, the handshaking process of first receiving and processing the connection request signal SYN transmitted from the client 10 in the PCP proxy signal processing apparatus A is performed. The client 10 in the normal session table 28 is processed. ), And then search the information associated with the client 10 in the wait table 27 to determine whether the client 10 is related to hacking.

In this case, when the connection is normal, the client 10 re-requests the connection request signal SYN so that the subsequent process may be connected by the handshaking method between the server 15 and the client 10.

Accordingly, the Ack standby table 27 or the normal session table 28 is provided as a TCAM memory (TCAM Memory), as shown in Figure 6 or 7 or search using an IP Address Hash (IP Address Hash) It may be provided with an SRAM or a DRAM.

Thus, the real-time high-speed TPC pipe signal processing method using the TPC proxy signal processing device A will be described below.

First, a connection request signal receiving step (S01) of receiving a connection request signal transmitted from the client 10 at the packet input unit 25 is performed. That is, the connection request signal (SYN, Synchronous) is sent from the client (10, Client) to the server (15, Server) side as a normal session of TCP in the TCP / IP Protocol, such a connection request signal (SYN) in the present invention The packet input unit 25 of the PD proxy signal processing apparatus A according to the present invention.

In addition, the packet parser 26 extracts an information signal for extracting information about a packet including IP information and TCP information from a packet request unit SYN transmitted from the client 10. A packet information extraction step (S02) for extracting from the western part 26 to be transmitted to the CD engine part 21 is performed, and extracting the extracted information signal of the packet from the CD engine part 21 to the normal session table 28. A normal session table which transmits and searches whether the information of the packet is included in the normal session table 28, and the search information signal searched for the packet is transmitted from the normal session table 28 to the CD engine 21 side. The search step S03 is performed.

The CD engine 21 determines whether the information on the packet exists in the normal session table 28 among the search information signals searched through the normal session table 28, and the information on the packet is normal. When included in the session table 28, the normal session discrimination step S04 is performed to transmit the information signal corresponding to the packet to the server. This is the process of 'SYN'-> 'SYN / ACK'-> 'ACK'-> 'RST' between the client 10 and the real-time high speed PCP proxy signal processing device A by the above process. After passing through, the connection request signal SYN is transmitted from the client 10 to the session through the normal packet, so that the handshaking signal between the server 15 and the client 10 is transmitted. In the handshaking process between the client 10 and the PCP proxy signal processing device A, the data of the packet information regarding the TCP / IP information of the client 10 is stored in the normal session table 28. Accordingly, in the handshaking between the newly developed client 10 and the server 15, packet information regarding the TCP / IP information of the client 10 is retrieved from the normal session table 28 and determined. Thus, when the information of the received packet exists in the normal session table 28, the client 10 has already been hardware verified, and the packet information for the client 10 It is to be transmitted to the server (15).

However, in contrast, when the information on the packet does not exist in the normal session table 28 in the normal session determination step (S04), the extracting information signal of the packet is sent from the CD engine unit 21 to the standby table 27. Ack standby table retrieval step (S05) to search whether the information in the packet is included in the standby table 27, and transmits the retrieved information signal to the CD engine 21 from the standby table 27 (S05) Will be performed.

When the information on the packet exists in the waiting table 27, the hack diagnosis step S06 is performed to discard the information of the packet.

In addition, in the case where it is determined that the information on the packet does not exist in the normal session table 28 in the normal session discrimination step S04 before the acknowledgment table search step S05, the CD engine unit 21 It is determined whether the SYN signal is included in the packet, and if such a SYN signal is present, it is determined whether SYN signal data of the packet exists in the Ack standby table 27 in the Ack standby table search step S05. Thus, if the packet information for the packet exists in the wait table 27, the client 10 determines that it corresponds to a kind of DDoS that only sends a SYN signal, and discards the packet.

When the information on the packet does not exist in the waiting table 27, the CD engine 21 connects to the client 10 corresponding to the corresponding packet. Send a request signal / response acknowledgment (SYN / ACK), a response acknowledgment sequence number (D 'part of FIG. 3), and confirm acknowledgment to register the information on the packet to the wait queue table 27 side. The information transmission step S07 is performed.

With this information, the packet information (IP information, etc.) of the client 10 is registered in the waiting table 27.

The sequence number transmitted in this way sends an arbitrary value (eg 0x00005000, etc.) determined by the verification engine.

When receiving the SYN / ACK signal, the client 10 normally transmits a packet including an ACK flag as a response, and transmits an acknowledgment number as an arbitrary value (eg, 0x00005000) sent by the verification engine. In the case of an aggressive SYN Packet (SYN-Flooding), it does not transmit an acknowledgment for the SYN-ACK, so the data for the packet is discarded.

On the other hand, if the information on the packet exists in the waiting table 27 by the step of searching for the standby table S05, the normal information table 28 extracts the extracted information signal of the corresponding packet from the waiting table 27. It is to be moved to the side, and the reset (RST, Reset) signal is transmitted to the client 10 side is provided so that a new session (Session) is made again.

That is, when a packet having a normal acknowledgment number is received, the packet is discarded and the packet is discarded when the packet is registered in the ACK wait table 27 (ACK wait table). Information is registered in the normal session table 28. In addition, the client 10 also sends an RST (RESET) Flag for the corresponding session. In response, the client 10 starts a session of a new handshaking process. And the information of the packet for the client 10 is to be deleted from the wait table 27.

In the subsequent process, since the corresponding packet information for the client 10 is registered in the normal session table 28, the packet information is transmitted to the server 15 without any separate verification engine, and the client (after the handshaking process) 10) and server 15 are to be established.

Therefore, in the real-time high-speed PCC proxy signal processing apparatus A according to the present invention, the packet information transmitted from the client 10 side is transmitted to the normal session table 28 or the Ack standby table 27, and thus By determining where the information is stored or whether it is transmitted abnormally, the TCP proxy implementation is implemented in a hardware manner, and in real time without using resources such as CPU and memory of the server 15. To make it work. Therefore, it does not affect the traffic of the actual network, and it is possible to process the packet at a higher speed than the conventional software.

The actuation standby table 27 or the normal session table 28 may be provided as a TCAM memory or searched using an IP address hash as shown in FIGS. 6 and 7. It may be provided with such as SRAM (SDRAM) or DRAM (DRAM).

Accordingly, when the Ack standby table 27 or the normal session table 28 is provided with an SRAM or DRAM for searching by using an IP address hash, a Session for a Session whose Threshold has been exceeded by setting a Time Threshold It may be provided with a time threshold entry management method so that the data of the data is deleted so that the handshaking process is continuously performed.

In addition, when the Ack standby table 27 or the normal session table 28 is provided with an SRAM or DRAM for searching using an IP address hash, grouping multiple entries into a group to use a full entry in the group City, it may be provided in a group entry management system to be provided to be used to update from the oldest entry.

In addition, when the Ack standby table 27 or the normal session table 28 is provided as a TMC memory, for the Session exceeding the number of entries in the TMC memory, the oldest entry is registered using the registration time information. It may be provided in the TCAM Entry update management method provided to be updated from.

Thus, the Ack standby table 27, the normal session table 28, and the like used to manage the table with the IP address information of the client 10 that sent the SYN. Such a table is composed of a table manager that plays the role of inquiry / update / delete. The Table Manager is initialized through the Server Software of the real-time high-speed PCP proxy signal processing apparatus A according to the present invention, performs registration and update with the IP extracted from the CD engine 21, and responds to the input packet. To work. In hardware, various methods may be applied to manage the table according to the type of memory device.

As an example, the Ack standby table 27 or the normal session table 28 may use the TCAM memory described above. This can be used when you want to limit the management by using a limited entry of the TMC memory. Sessions exceeding the number of entries in the TMC memory may be managed to be updated from the oldest entry using the registration time information.

Next, the Ack Wait Table 27 or the Normal Session Table 28 searches for the IP address hash using IP address hash, and retrieves relevant information using general memory such as SRAM and DRAM. It may be performed to store and manage. In this case, more simultaneous entries can be managed than TMC's. However, when Hash collision occurs, the problem of DoS and DDoS does not cause any problem with the opening of Session due to Hash collision. In addition, in the method using Hash, all sessions are opened when full entry is used. Therefore, it is necessary to set a time threshold and delete the session for the session that has exceeded the threshold, and then go through the handshaking process again.

Thus, the oldest entry is deleted using the registration time information. In addition, the IP address hash value for checking whether the IP address is matched can be placed in the data area of the memory so that accurate matching can be performed by checking the IP address matching in case of a hash collision. Each entry is grouped into 16 groups, and when a new entry is created when full use of 16 entries is made, it may be prepared to update and use the oldest entry with time information in the entry.

The embodiments of the present invention have been described in detail above, but since the embodiments have been described so that those skilled in the art to which the present invention pertains can easily carry out the present invention, The technical spirit of the present invention should not be interpreted limitedly.

1 is a schematic configuration diagram of a PCP proxy signal processing apparatus according to the present invention.

Figure 2 is a schematic illustration of the signal transmission in the PCP proxy signal processing apparatus according to the present invention.

3 is a signal processing flowchart in a PCP proxy signal processing apparatus according to the present invention.

Figure 4 is a signal processing flowchart for the PCP proxy signal processing apparatus according to the present invention.

5 is a schematic configuration diagram of a CD engine unit of a PCP proxy signal processing apparatus according to the present invention;

6 and 7 are schematic configuration diagrams of the memory of the Ack standby table or the normal session table of the PCP proxy signal processing apparatus according to the present invention.

<Description of the symbols for the main parts of the drawings>

A: TPC proxy signal processing device

10: client 15: server

21: CD engine 25: packet input

26: Packet 27: Ack standby table

28: normal session table 211: CD controller

212: Packet input block 213: Ack standby data processing block

214: normal session data processing block

Claims (10)

A packet input unit 25 for receiving a connection request signal (Synchronous) packet transmitted from the client 10; A packet parser unit 26 configured to transmit the extracted information signal including the IP information and TCP information of the client 10 to the CD engine unit 21 from the packet of the signal received by the packet input unit 25; The CD engine unit 21 receives the extraction information signal from the packet parser unit 26 and analyzes the information of the packet through the Ack standby table 27 and the normal session table 28, and determines the packet. ; Ack standby table 27 to store the information of the packet including the connection request / response confirmation (SYN / ACK) signal transmitted to the client 10 to determine whether the normal through the CD engine 21 ; And a normal session table (28) for storing information of a corresponding packet corresponding to a normal extraction information signal through the CD engine unit (21). The method of claim 1, The CD engine unit 21, A packet input block 212 which receives the extraction information signal for the packet transmitted from the packet parser 26 and transmits it to the CD controller 211; An ack standby data processing block 213 for processing signals transmitted and received with the ack standby table 27 under the control of the CD controller 211; A normal session data processing block (214) for processing signals transmitted and received with the normal session table (28) by the control of the CD controller (211); Receives the packet signal transmitted through the packet input block 212, the data transmission and reception to the standby table 27 or the normal session table 28, the CD controller is provided to determine the information about the packet ( 211) is included, the real-time high-speed PCP proxy signal processing apparatus characterized in that it is provided. The method of claim 1, The Ack standby table 27 or the normal session table 28 is a real-time high-speed PCPI signal, characterized in that provided with the TMS memory or SRAM or DRAM to search using the IP address hash Processing unit. The method of claim 1, The Ack standby table 27 or the normal session table 28 is provided with an SRAM or DRAM for searching by using an IP address hash, and the data of the session is stored for a session in which a threshold is exceeded by setting a time threshold. Real-time high-speed PCP proxy signal processing apparatus characterized in that the handshaking process is to be carried out to be deleted. The method of claim 1, The Ack standby table 27 or the normal session table 28 is provided with an SRAM or DRAM for searching by using an IP address hash, and when multiple entries are grouped into groups, a full entry in a group is used. Real-time high-speed PCP proxy signal processing apparatus characterized in that it is provided to be used to update from the old entry. The method of claim 1, The Ack standby table 27 or the normal session table 28 is provided with a TMC memory, but for the Session exceeding the number of entries in the TMC memory is provided to be updated from the oldest entry using the registration time information Real-time high-speed PCP proxy signal processing apparatus characterized in that the. In the real-time high-speed TPC pipe signal processing method using the TPC pipe signal processing apparatus of any one of claims 1 to 6, A connection request signal receiving step of receiving the connection request signal transmitted from the client 10 at the packet input unit 25 (S01); The packet parser 26 extracts an information signal for extracting information on a packet including IP information and TCP information from the packet parser 26 with respect to the connection request signal SYN transmitted from the client 10. A packet information extraction step (S02) which is extracted at 26 and transmitted to the CD engine unit 21; The extracted information signal of the packet is transmitted from the CD engine unit 21 to the normal session table 28, the normal session table 28 searches whether the information of the packet is included, and the search information signal searched for the packet. A normal session table retrieving step (S03) in which the normal session table 28 is transmitted from the normal session table 28 to the CD engine unit 21; The CD engine 21 determines whether the information on the packet exists in the normal session table 28 among the search information signals searched through the normal session table 28, and the information on the packet is normal. When included in the session table 28, a real-time high-speed tee using a PCP proxy signal processing apparatus, characterized in that the normal session discrimination step (S04) is provided to ensure that the information signal corresponding to the packet is transmitted to the server. CPM proxy signal processing method. The method of claim 7, wherein If the information on the packet does not exist in the normal session table 28 in the normal session determination step (S04), the extracted information signal of the packet is transmitted from the CD engine 21 to the standby table 27. A standby table search step (S05) of searching for whether information of a corresponding packet is included in the standby table 27 and transmitting the retrieved information signal from the standby table 27 to the CD engine unit 21; In the waiting table search step (S05), if the information on the packet is present in the waiting table 27, the hacking diagnostic step (S06) for discarding the information of the packet is included, characterized in that it is provided Real-time high-speed PCP proxy signal processing method using a PCP proxy signal processing apparatus. The method of claim 8, If the information on the packet does not exist in the wait table 27 by the acknowledgment table search step (S05), the CD engine 21 connects to the client 10 corresponding to the packet. A signal / response acknowledgment (SYN / ACK), a response acknowledgment sequence number (Sequence Number) is transmitted, and the acknowledgment information transmitting step (S07) for registering information on the packet to the wait table 27 is provided. Real-time high-speed PCP proxy signal processing method using a PCP proxy signal processing apparatus, characterized in that. The method of claim 8, When the information on the packet exists in the waiting table 27, the extracting information signal of the corresponding packet is moved from the waiting table 27 to the normal session table 28. And a reset (RST) signal is transmitted to the client 10 so that a new session is made again.

Images