TWI397286B - Router and method for protecting tcp ports - Google Patents

Description

Router and TCP埠 defense method

The present invention relates to a computer security management apparatus and method, and more particularly to a router and a TCP (Transmission Control Protocol) defense method.

When a local computer is connected to a remote computer or host, server, etc. via a router and a network, if one or more remote computers send multiple TCP packets to the local computer to request a TCP connection, the router cannot Other remote computers forward normal packets. As a result, the router may be flooded with a large number of garbage packets and cannot be connected to the network. For example, a local computer may be subject to scans, virus attacks, etc., making the router unable to work properly.

In view of the above, it is necessary to provide a router and TCP 埠 defense method, which can solve the problem of 埠 scanning and defend against attacks initiated by using TCP connection.

A router connecting a local computer and a remote computer, the router comprising: a setting module, configured to set a first time period and a second time period, and set a maximum number of times the remote computer allows to connect the local computer a receiving module, configured to receive a TCP packet, the TCP packet includes a SYN (Synchronize) packet, a clock module, configured to time and record a timestamp of the local computer receiving each TCP packet; and a counting module, For receiving a SYN packet, calculating, according to the timestamp of the SYN packet, the remote computer that sends the SYN packet at the timestamp The number of times that the TCP connection is established with the local computer but the data is not transmitted during the first period of time; and the identification module is configured to identify the far time when the number of times calculated by the counting module exceeds the set maximum value The end computer is an attacker, and all TCP packets sent by the remote computer are discarded during the second time period starting from the time stamp of the SYN packet.

A TCP埠 defense method is applied to a router, the router is connected to a local computer and a remote computer, and the method includes: setting a first time period and a second time period, and setting a maximum number of times the remote computer allows to connect the local computer The local computer receives a SYN packet sent from the remote computer; records the timestamp of receiving the SYN packet; and calculates, according to the timestamp of the SYN packet, the first computer that sends the SYN packet before the timestamp The number of times the TCP connection is established with the local computer but the data is not transmitted during the time period; and when the calculated number exceeds the set maximum value, the remote computer is identified as an attacker and is encapsulated by the SYN. All TCP packets sent by the remote computer are discarded during the second time period in which the timestamp is used as the starting point.

Compared with the prior art, the router and the TCP 埠 defense method can solve the problem of 埠 scanning and defend against attacks initiated by using a TCP connection.

As shown in FIG. 1, it is an operational environment diagram of a preferred embodiment of the router of the present invention. A plurality of remote computers 6 (only one remote computer 6 is shown in FIG. 1) can establish a connection with the local computer 3 via the network 5, the modem 4, and the router 1. The purpose of the present invention is to prevent the remote computer 6 from scanning or attacking the Transmission Control Protocol (TCP) 30 of the local computer 3.

In order to achieve the object, in the preferred embodiment, the router 1 is configured to identify whether the remote computer 6 scans or attacks the TCP port 30 of the local computer 3.

The network 5 can be an Internet or other types of communication networks.

2 is a functional block diagram of a preferred embodiment of the router of the present invention. In the preferred embodiment, the router 1 includes a processor 10 and a memory 12. The processor 10 is configured to execute various types of software installed or embedded in the router 1. The memory 12 is used to store various types of materials, for example, various configuration parameters and the like.

In the preferred embodiment, the router 1 further includes a plurality of functional modules, namely: a setting module 20, a receiving module 21, a clock module 22, a counting module 23, and an identification module 24.

The setting module 20 is configured to set a first time period and a second time period, and set a maximum value of the number of times the remote computer 6 is allowed to connect to the local computer 3. The use of the first time period and the second time period will be described in detail below.

The receiving module 21 is configured to receive various types of TCP packets. For example, a three-way handshake is required before the remote computer 6 establishes a TCP connection with the local computer 3. As shown in FIG. 3, the remote computer 6 first transmits a SYN packet to the local computer 3, indicating that it is to communicate with the local computer 3 to establish an online connection. If the TCP port 30 of the local computer 3 is open, the local computer 3 will return a SYN ACK packet to the remote computer 6. Then, The remote computer 6 will send an ACK packet to the local computer 3 to indicate that the TCP connection has succeeded. After the TCP connection is established, the remote computer 6 and the local computer 3 can send data packets to exchange data. If the TCP port 30 of the local computer 3 is not open, the RST packet is returned to the remote computer 6.

In addition, if you need to disconnect the TCP connection, you still need to send multiple packets for confirmation.

The clock module 22 is configured to time and record the time stamp of the local computer 3 to receive each TCP packet.

If the remote computer 6 needs to establish a TCP connection with the local computer 3, the remote computer 6 first sends a SYN packet, the receiving module 21 receives the SYN packet, and the clock module 22 records and receives. The timestamp of the SYN packet.

The counting module 23 is configured to calculate, according to the timestamp of the SYN packet, that the remote computer that sends the SYN packet establishes a TCP connection with the local computer 3 in the first time period before the time stamp but does not transmit The number of times of data, that is, how many TCP connections are calculated, does not transmit any data packets after the remote computer 6 and the local computer 3 complete the three-way handshake.

For example, if the first time period is set to 10 seconds, and the time stamp for receiving the SYN packet is 9:5:12, the counting module 23 will calculate 9 points, 5 minutes, 2 seconds, and 9:5 minutes. The number of times that the remote computer 6 and the local computer 3 established a TCP connection but did not transmit data between 12 seconds.

The identification module 24 is configured to identify the remote computer 6 as an attacker when the number of times calculated by the counting module 23 exceeds the set maximum value, and All TCP packets sent by the remote computer 6 are discarded during the second time period starting with the timestamp of the SYN packet. For example, the remote computer 6 provided by the setting module 20 allows the maximum number of times of connecting the local computer 3 to 20, and the set second time period is 10 minutes. If the number of times calculated by the counting module 23 exceeds 20, the identification module 24 confirms that the remote computer 6 is an attacker, and all the TCPs sent by the remote computer 6 within 10 minutes from the time stamp of receiving the SYN packet from 9:5:12. The packet is discarded.

In other embodiments, the router 1 further includes a packet counter 25, a timer 26, and a connection counter 27.

The setting module 20 is further configured to set a time threshold and a minimum number of TCP packet transmissions to determine whether the TCP connection between the remote computer 6 and the local computer 3 is idle, and set an idle connection limit. number.

The timer 26 is configured to start timing after the remote computer 6 establishes a TCP connection with the local computer 3. If the local computer 3 receives the TCP packet from the remote computer 6 by using the TCP connection, The timer is cleared and the timing is started again. For a detailed procedure, reference may be made to the flow descriptions of FIG. 5 and FIG. 6 below.

The packet counter 25 is configured to calculate the number of TCP packets received by the local computer 3 after establishing a TCP connection with the remote computer 6, and the local computer 3 establishes a TCP connection with the remote computer 6 The number of packets sent to the handshake is not counted.

The identification module 24 is further configured to calculate the time when the timer 26 is calculated. When the set time threshold is reached and the number of TCP packets calculated by the packet counter 25 is less than or equal to the set minimum number, it is confirmed that the TCP connection is in an idle state.

The connection counter 27 is configured to calculate the number of TCP connections that are in an idle state between the remote computer 6 and the local computer 3.

The identification module 24 is further configured to identify the remote computer 6 as an attacker when the number of TCP connections in the idle state calculated by the connection counter 27 exceeds the set number of idle connection limits, and All TCP packets sent by the remote computer 6 are discarded during the second period after the identification.

In practical applications, a plurality of remote computers 6 are often connected to the local computer 3. Therefore, the number of the packet counter 25, the timer 26, and the connection counter 27 can be one to calculate each remote computer 6 and The number of TCP connections, the number of packet transmissions, and the corresponding time between the local computers 3 may also be plural to correspond to the number of the remote computers 6.

As shown in FIG. 4, it is a flowchart of the first embodiment of the TCP埠 defense method of the present invention. First, in step S2, the setting module 20 sets a first time period and a second time period.

In step S4, the setting module 20 sets the maximum value of the number of times the remote computer 6 is allowed to connect to the local computer 3.

In step S6, the receiving module 21 receives a SYN packet from the remote computer 6.

In step S8, the clock module 22 records the timestamp of receiving the SYN packet.

Step S10, the counting module 23 calculates, according to the timestamp of the SYN packet, that the remote computer that sends the SYN packet establishes a TCP connection with the local computer 3 in the first time period before the timestamp but does not transmit. The number of times of data, that is, how many TCP connections are calculated, does not transmit any data packets after the remote computer 6 and the local computer 3 complete the three-way handshake.

In step S12, the identification module 24 determines whether the number of times calculated by the counting module 23 exceeds the set maximum value. If the number of calculations does not exceed the set maximum value, the flow returns to step S6.

If the number of calculations exceeds the set maximum value, the identification module 24 identifies the remote computer 6 as an attacker in step S14.

In step S16, the identification module 24 discards all the TCP packets sent by the remote computer 6 in the second time period starting from the time stamp of the SYN packet, and ends the process.

As shown in FIG. 5, it is a flowchart of the idle connection confirmation of the second embodiment of the TCP埠 defense method of the present invention. First, in step S20, the setting module 20 sets a time threshold and a minimum number of TCP packet transmissions to determine whether the TCP connection between the remote computer 6 and the local computer 3 is idle.

In step S22, the setting module 20 sets an idle connection limit number.

In step S24, the packet counter 25 is started after the remote computer 6 establishes a TCP connection with the local computer 3.

In step S26, the timer 26 is also started after the TCP connection is established to start timing.

In step S28, the receiving module 22 determines whether a TCP packet is received. If a TCP packet is received, the flow returns to step S26, and the timer 26 is restarted, that is, the timer is restarted after being cleared.

If the TCP packet is not received, in step S30, the identification module 24 determines whether the time calculated by the timer 26 has reached the set time threshold. If the set time threshold is not reached, the flow returns to step S28.

If the set time threshold is reached, in step S32, the identification module 24 determines whether the number of TCP packets calculated by the packet counter 25 is less than or equal to the set minimum number. If the calculated number of TCP packets is greater than the minimum number set, the process ends.

If the calculated number of TCP packets is less than or equal to the set minimum number, in step S34, the identification module 24 confirms that the TCP connection is in an idle state, and then ends the process.

As shown in FIG. 6, it is a flowchart of the second embodiment of the TCP埠 defense method of the present invention. First, in step S40, the connection counter 27 is started after the remote computer 6 establishes a TCP connection with the local computer 3.

In step S42, the identification module 24 determines whether the number of TCP connections in the idle state between the remote computer 6 and the local computer 3 calculated by the connection counter 27 exceeds the set number of idle connection limits. If the number of TCP connections in the idle state calculated by the connection counter 27 does not exceed the set number of idle connection limits, the flow returns to step 40.

If the number of TCP connections in the idle state calculated by the connection counter 27 exceeds the set number of idle connection limits, the identification module 24 identifies the remote computer 6 as an attacker in step S44.

In step S46, the identification module 24 discards all the TCP packets sent by the remote computer 6 in the second time period after the identification, and then ends the process.

In summary, the present invention complies with the requirements of the invention patent and submits a patent application according to law. The above is only the preferred embodiment of the present invention, and the scope of the present invention is not limited to the above-described embodiments, and equivalent modifications or variations made by those skilled in the art in light of the spirit of the present invention are It should be covered by the following patent application.

1‧‧‧ router

10‧‧‧ processor

12‧‧‧ memory

20‧‧‧Setup module

21‧‧‧ receiving module

22‧‧‧clock module

23‧‧‧Counting module

24‧‧‧ Identification module

25‧‧‧Packing counter

26‧‧‧Timer

27‧‧‧Connected counter

3‧‧‧Local computer

30‧‧‧TCP埠

4‧‧‧Modulation demodulator

5‧‧‧Network

6‧‧‧Remote computer

1 is a diagram showing the operating environment of a preferred embodiment of a router of the present invention.

2 is a functional block diagram of a preferred embodiment of the router of the present invention.

3 is a schematic diagram of establishing a TCP connection of a preferred embodiment of a router of the present invention.

4 is a flow chart of a first embodiment of a TCP埠 defense method of the present invention.

FIG. 5 is a flow chart of the idle connection confirmation of the second embodiment of the TCP埠 defense method of the present invention.

6 is a flow chart of a second embodiment of the TCP埠 defense method of the present invention.

1‧‧‧ router

10‧‧‧ processor

12‧‧‧ memory

20‧‧‧Setup module

21‧‧‧ receiving module

22‧‧‧clock module

23‧‧‧Counting module

24‧‧‧ Identification module

25‧‧‧Packing counter

26‧‧‧Timer

27‧‧‧Connected counter

Claims (9)

A router connecting a local computer and a remote computer, the router comprising: a setting module, configured to set a first time period and a second time period, and set a maximum number of times the remote computer allows to connect the local computer a receiving module, configured to receive a Transmission Control Protocol (TCP) packet, the TCP packet includes a Synchronize (SYN) packet, and a clock module for timing and recording, the local computer receives each TCP a timestamp of the packet; the counting module is configured to calculate, according to the timestamp of the SYN packet, the remote computer that sends the SYN packet in the first time period before the timestamp and the local time when receiving a SYN packet The number of times the computer establishes a TCP connection but does not transmit data; and the identification module is configured to identify the remote computer as an attacker when the number of times the counting module calculates exceeds the set maximum value, and use the SYN All TCP packets sent by the remote computer are discarded during the second period of time when the timestamp of the packet is used as the starting point. The router of claim 1, wherein: the router further includes a timer and a packet counter; and the setting module is further configured to set a time threshold and a minimum number of TCP packet transmissions to determine the far Whether the TCP connection between the end computer and the local computer is idle; the timer is used to start timing after the remote computer establishes a TCP connection with the local computer, if the local computer uses the TCP connection from the remote computer After receiving the TCP packet, the timer is cleared and starts timing again; the packet counter is used to calculate the number of TCP packets received by the local computer after establishing a TCP connection with the remote computer; The identification module is further configured to confirm that the TCP connection is in an idle state when the time calculated by the timer reaches the set time threshold and the number of TCP packets calculated by the packet counter is less than or equal to the set minimum number. The router of claim 2, wherein: the router further includes a connection counter; the setting module is further configured to set an idle connection limit number; and the connection counter is used for calculating The number of TCP connections in the idle state between the remote computer and the local computer; and the identification module is further configured to: when the connection counter calculates the number of idle TCP connections exceeds the set idle connection When the number of lines is limited, the remote computer is identified as an attacker, and all TCP packets sent by the remote computer are discarded in the second time period after the identification. The router of claim 1, wherein the local computer and the remote computer establish a TCP connection by three-way handshake. A Transmission Control Protocol (TCP) defense method is applied to a router, and the router is connected to a local computer and a remote computer, and the method includes: setting a first time period and a second time period, and setting a remote computer The maximum number of times the local computer is allowed to connect; the local computer receives a Synchronize (SYN) packet sent from the remote computer; and records the timestamp of receiving the SYN packet; Calculating, according to a timestamp of the SYN packet, a number of times that a remote computer that sends the SYN packet establishes a TCP connection with the local computer but does not transmit data in a first time period before the timestamp; and when the calculated number of times exceeds When the set maximum value is reached, the remote computer is identified as an attacker, and all TCP packets sent by the remote computer are discarded during the second time period starting from the time stamp of the SYN packet. For example, the TCP/defense method described in claim 5, the method further includes: setting a time threshold and a minimum number of TCP packet transmissions to determine whether the TCP connection between the remote computer and the local computer is idle; Starting a packet counter after the remote computer establishes a TCP connection with the local computer; starting a timer to start timing; determining whether the local computer receives a TCP packet from the remote computer; if the local computer does not receive a TCP packet from the remote computer And determining whether the time calculated by the timer reaches a set time threshold; if the time calculated by the timer reaches the set time threshold, determining whether the number of TCP packets calculated by the packet counter is less than or equal to The minimum number set; and if the number of TCP packets calculated by the packet counter is less than or equal to the set minimum number, then the TCP connection is confirmed to be idle. The TCP/defense method according to claim 6, wherein the method further comprises: setting an idle connection limit number; and starting a connection counter after the local computer establishes a TCP connection with the remote computer; The number of TCP connections in the idle state calculated by the line counter is super When the number of idle connection restrictions is set, the remote computer is identified as an attacker, and all TCP packets sent by the remote computer are discarded in the second time period after the identification. The TCP/defense method of claim 6, wherein the method further comprises: if the local computer receives the TCP packet from the remote computer, the timer is cleared and the timing is restarted. For example, in the TCP/defense method described in claim 5, the local computer and the remote computer establish a TCP connection by three-way handshake.