WO2012153948A2

WO2012153948A2 - Session maintenance system in ddos attack

Info

Publication number: WO2012153948A2
Application number: PCT/KR2012/003525
Authority: WO
Inventors: 권오헌; 김항진
Original assignee: 주식회사 비씨클라우드
Priority date: 2011-05-06
Filing date: 2012-05-04
Publication date: 2012-11-15
Also published as: KR101112150B1; WO2012153948A3

Abstract

A session maintenance system in a DDoS (Distributed Deny of Service) attack can include a user terminal, a control server, an origin server, and a plurality of proxy servers. A session maintenance method can include the steps of: generating a plurality of sessions by connecting a plurality of proxy servers with each other and connecting the plurality of proxy servers with the origin server; setting a communication session with the origin server through a first proxy server; and resetting the session through one of the second to n-th proxy servers according to a request of the control server. The plurality of proxy servers can include first to n-th proxy servers.

Description

Session Maintenance System in DDoS Attacks

The disclosed technique relates to a session maintenance system, and more particularly, to a session maintenance system using a proxy server in a DDoS attack situation.

Distributed Denial of Service (DDoS) attacks distribute multiple attackers, generating massive traffic that cannot be handled by a particular server and overloading that server. In particular, distributed denial-of-service attacks target major government agencies, portal servers, bank servers, etc. and prevent normal users from accessing the server.

An object of the present invention is to provide a session maintenance system and a session maintenance method in a DDoS attack situation.

Among the embodiments, the session maintaining method in a Distributed Deny of Service (DDoS) attack situation performed in a control terminal, an origin server, and a user terminal that may be connected to a plurality of proxy servers may be configured to perform each of the plurality of proxy servers. Connecting and allowing each of the plurality of proxy servers to connect to the origin server, creating a plurality of sessions, establishing a session with the origin server through a first proxy server, and requesting the control server. Resetting the session through one of the second to nth proxy servers. The plurality of proxy servers includes the first through n-th proxy servers, and the plurality of proxy servers are mapped one-to-one with the plurality of sessions.

Among the embodiments, the session maintenance system may perform each of the plurality of proxy servers in a Distributed Deny of Service (DDoS) attack situation performed at a user terminal that may be connected to a control server, an origin server, and a plurality of proxy servers. A session generator configured to connect and each of the plurality of proxy servers to connect to the origin server, establish a plurality of sessions, establish a session with the origin server through a first proxy server, and at the request of the control server And a session controller for resetting the session through one of the second to nth proxy servers. The plurality of proxy servers includes the first through n-th proxy servers, and the plurality of proxy servers are mapped one-to-one with the plurality of sessions.

Since the session maintenance system according to an embodiment of the present invention controls the packet path in the user terminal, there is no inconvenience such as temporary disconnection of a service or user reauthentication. For example, the user terminal may set the packet flow information value for the packet not to change.

In addition, the session maintenance system according to an embodiment of the present invention may include a plurality of proxy servers and maintain a communication session with the origin server by creating a plurality of sessions. This is because when an attack occurs while the user terminal communicates with the origin server through one proxy server, the user terminal may communicate with the origin server through the other proxy server.

1 is a diagram illustrating a session maintenance system in accordance with the disclosed technology.

FIG. 2 is a block diagram illustrating a user terminal of FIG. 1.

FIG. 3 is a flowchart illustrating a session maintaining method performed by the user terminal of FIG. 2.

FIG. 4 is a flowchart illustrating a session maintaining method performed by the control server of FIG. 1.

Description of the disclosed technology is only an embodiment for structural or functional description, the scope of the disclosed technology should not be construed as limited by the embodiments described in the text. That is, the embodiments may be variously modified and may have various forms, and thus the scope of the disclosed technology should be understood to include equivalents capable of realizing the technical idea.

On the other hand, the meaning of the terms described in the present application should be understood as follows.

Terms such as "first" and "second" are intended to distinguish one component from another component, and the scope of rights should not be limited by these terms. For example, the first component may be named a second component, and similarly, the second component may also be named a first component.

The term “and / or” should be understood to include all combinations that can be presented from one or more related items. For example, the meaning of "first item, second item and / or third item" may be given from two or more of the first, second or third items as well as the first, second or third items. Any combination of the possible items.

When a component is referred to as being "connected" to another component, it should be understood that there may be other components in between, although it may be directly connected to the other component. On the other hand, it should be understood that no component exists. On the other hand, other expressions describing the relationship between the components, such as "between" and "immediately between" or "neighboring to" and "directly neighboring to", should be interpreted as well.

Singular expressions should be understood to include plural expressions unless the context clearly indicates otherwise, and terms such as "comprise" or "have" refer to features, numbers, steps, operations, components, parts, or parts thereof described. It is to be understood that the combination is intended to be present and does not exclude in advance the possibility of the presence or addition of one or more other features or numbers, steps, operations, components, parts or combinations thereof.

For each step, the identifiers (e.g., a, b, c, ... are used for convenience of explanation, and the identifiers do not describe the order of the steps, and each step is clearly contextual. Unless stated otherwise, they may occur out of the specified order, ie, each step may occur in the same order as described, may be performed substantially simultaneously, or may be performed in the reverse order.

All terms used herein have the same meaning as commonly understood by one of ordinary skill in the art unless otherwise defined. Generally, the terms defined in the dictionary used are to be interpreted to coincide with the meanings in the context of the related art, and should not be interpreted as having ideal or excessively formal meanings unless clearly defined in the present application.

1 is a diagram illustrating a session maintaining system in a DDoS attack situation according to the disclosed technology.

Referring to FIG. 1, the session maintaining system 100 includes a user terminal 110, a plurality of proxy servers 120, an origin server 130, and a control server 140. The user terminal 110 may be connected to the plurality of proxy servers 120 and the control server 140 through the Internet. The plurality of proxy servers 120 may be connected to the origin server 130 through the Internet.

The user terminal 110 transmits at least one packet to one of the plurality of proxy servers 120. The user terminal 110 may be implemented as a desktop, a notebook, or a smartphone. In one embodiment, at least one packet may comprise a packet flow information value. For example, the packet flow information value may include a source IP, a destination IP, a source port, a destination port, and a protocol.

The user terminal 110 may generate a plurality of sessions by connecting each of the plurality of proxy servers 120 and allowing each of the plurality of proxy servers 120 to connect to the origin server 130. In this case, the plurality of proxy servers 120 may be mapped one-to-one with the plurality of sessions. The user terminal 110 may communicate with the origin server 130 through one of the generated sessions.

The plurality of proxy servers 120 may transmit the packet received from the user terminal 110 to the origin server 130, and transmit the packet received from the origin server 130 to the user terminal 110.

In one embodiment, the plurality of proxy servers 120 may be implemented as a backup proxy server. The backup proxy server may receive data from the origin server 130 and store the data on the hard disk. When a service request is received from the user terminal 110, the origin server 130 may check whether the data is modified or not, and if not, the data of the hard disk may be transmitted to the user terminal 110.

The origin server 130 provides a corresponding service when a service request comes from the user terminal 110. The user terminal 110 may set one of the plurality of proxy servers 120 to request a service from the origin server 130, and the origin server 130 may request the user terminal 110 for data requested through the set proxy server. Can be sent to.

The control server 140 monitors the traffic flowing into the plurality of proxy servers 120. The control server 140 may transmit a session change request to the user terminal 110 when attack traffic is detected at the proxy server that receives the packet from the user terminal 110.

When the attack traffic disappears from the proxy server where the attack traffic is detected, the control server 140 may transmit a session block release request for the corresponding proxy server to the user terminal 110.

FIG. 2 is a block diagram illustrating a user terminal of FIG. 1.

Referring to FIG. 2, the user terminal 110 includes a receiver 210, a session generator 220, a session controller 230, and a transmitter 240.

The session generator 220 connects each of the plurality of proxy servers 120 and generates a plurality of sessions so that each of the plurality of proxy servers 120 connects to the origin server 130. The plurality of proxy servers 120 may be mapped one-to-one with the plurality of sessions.

When the user terminal 110 attempts to access the origin server 130, the user terminal 110 may generate a plurality of sessions. The plurality of sessions may be open at the same time or some of the plurality of sessions may be waiting for the opening.

The plurality of sessions may be implemented with a tunneling technique. In this case, tunneling may be set such that packet flow information values (origin IP, destination IP, origin port, destination port, protocol) are not changed to maintain the session.

The session controller 230 changes the session when receiving the session change request from the control server 140.

When the user terminal 110 requests a service from the origin server 130, the session controller 230 may establish a communication session with the origin server 130 through one of the plurality of proxy servers 120. If the user terminal 110 receives a session change request from the control server 140 while transmitting a packet to one of the plurality of proxy servers 120, the session controller 230 is one of the remaining proxy servers 120 It is possible to reset the communication session with the origin server 130 through.

For example, when the user terminal 110 receives a session change request from the control server 140 while transmitting a packet to one proxy server 120a, the session controller 230 may connect with one proxy server 120a. The connected session may be blocked and the packet may be transmitted to the other proxy server 120b. When the user terminal 110 receives a session change request from the control server 140 while transmitting a packet to the other proxy server 120b, the session controller 230 connects to the other proxy server 120b. Block and transmit a packet to another proxy server 120c.

The plurality of proxy servers 120 may be divided into a group in which the session is blocked and a group in which the session is not blocked. When the session controller 230 receives the session change request from the control server 140, the session controller 230 may reset the communication session with the origin server 130 through one proxy server of the group in which the session is not blocked.

For example, when the user terminal 110 receives a session change request from the control server 140 while transmitting a packet to one proxy server 120a, the session controller 230 controls one proxy server 120a. The proxy server 120b may be selected from the group in which the session is blocked and the session is not blocked.

The transmitter 240 transmits a packet to the origin server 130 through a communication session. The plurality of sessions generated by the session generator 220 may include a communication session. In the communication session, actual data between the user terminal 110 and the origin server 130 is moved.

When the session is changed by the session controller 230, the transmitter 240 transmits a packet to the origin server 130 through the changed communication session.

For example, the user terminal 110 may transmit a packet to one proxy server 120a. When the session change request is received from the control server 140 while transmitting the packet, the user terminal 110 may transmit the packet to the other proxy server 120b.

In one embodiment, the packet may comprise a new packet. In another embodiment, the packet may include an unreceived packet transmitted to the origin server 130 but not received at the origin server 130. When the origin server 130 receives a packet from the user terminal 110, the origin server 130 may transmit a confirmation packet to the user terminal 110.

In this case, the packet may not change the packet flow information value. In this case, the user terminal 110 may receive a service from the origin server 130 without temporarily disconnecting.

The receiver 210 receives a packet from the origin server 130 through a communication session. In one embodiment, the receiver 210 may receive a session change request or a session unblocking request for the proxy server from the control server 140.

The control server 140 may monitor the traffic flowing into the plurality of proxy servers 120. When the traffic flowing into the proxy server receiving the packet from the user terminal 110 exceeds a predetermined value, the control server 140 may transmit a session change request to the user terminal 110.

When the attack on the proxy server in which the session is blocked is released, the control server 140 may transmit a session block release request for the corresponding proxy server to the user terminal 110. In this case, the session controller 230 may receive a request from the control server 140 and set the proxy server as a group in which the session is not blocked.

In FIG. 3, when the user terminal 110 attempts to access the origin server 130, the user terminal 110 may create a plurality of sessions (step S310). The user terminal 110 may connect each of the plurality of proxy servers 120 and allow each of the plurality of proxy servers 120 to connect to the origin server 130. The plurality of sessions may be open at the same time or some of the plurality of sessions may be waiting for the opening.

The user terminal 110 transmits a packet to the origin server 130 through one of the plurality of sessions (step S320). The user terminal 110 may establish a communication session with the origin server 130 through the first proxy server. The origin server 130 may provide a service to the user terminal 110 through a communication session.

When the user terminal 110 receives a session change request from the control server 140 (step S330), the user terminal 110 transmits a packet to the origin server 130 through one of the remaining sessions (step S340). .

The control server 140 may monitor the traffic flowing into the first proxy server and transmit a session change request to the user terminal 110 when abnormal traffic occurs. The user terminal 110 may reestablish a communication session with the origin server 130 through one of the second to n th proxy servers. The origin server 130 may provide a service to the user terminal 110 through the reset communication session.

In one embodiment, user terminal 110 may reestablish a communication session through one of a group of proxy servers for which the session is not blocked. In this case, the user terminal 110 may set the first proxy server as a proxy server group in which the session is blocked.

In one embodiment, when the user terminal 110 receives a request for unblocking a session from the control server 140, the user terminal 110 may set a proxy server included in the session as a proxy server group in which the session is not blocked. The control server 140 may monitor the traffic flowing into the plurality of proxy servers 120 and may transmit a session block release request to the user terminal 110 when the attack is released to the attacked proxy server.

The user terminal 110 may repeat steps S320 to S340 until all generated sessions are blocked.

In FIG. 4, the control server 140 monitors traffic flowing into the plurality of proxy servers 120 (step S410).

The control server 140 transmits a session change request to the user terminal 110 when an attack on the proxy server is detected (step S420). The control server 140 may determine that an attack has occurred in the corresponding proxy server when the traffic flowing into one proxy server instantly increases or exceeds a predetermined value.

The control server 140 transmits a session block release request to the user terminal 110 when the attack release is detected by the proxy server under attack (step S430). The control server 140 may determine that the attack on the corresponding proxy server is released when the traffic flowing into the attacked proxy server is reduced or less than a predetermined value.

The disclosed technique can have the following effects. However, since a specific embodiment does not mean to include all of the following effects or only the following effects, it should not be understood that the scope of the disclosed technology is limited by this.

Since the session maintenance system according to an embodiment controls the packet path at the user terminal, there is no inconvenience such as temporary disconnection of a service or user reauthentication. For example, the user terminal may set the packet flow information value for the packet not to change.

The session maintenance system according to an embodiment may include a plurality of proxy servers and create a plurality of sessions to maintain a communication session with the origin server. This is because when an attack occurs while the user terminal communicates with the origin server through one proxy server, the user terminal may communicate with the origin server through the other proxy server.

Although described above with reference to the preferred embodiment of the present application, those skilled in the art various modifications and changes to the present application without departing from the spirit and scope of the present application described in the claims below I can understand that you can.

Claims

In the session maintenance method in a Distributed Deny of Service (DDoS) attack situation performed in the user terminal that can be connected to the control server, origin server and a plurality of proxy servers,

Connecting each of the plurality of proxy servers and allowing each of the plurality of proxy servers to connect with the origin server, wherein the plurality of sessions are mapped one-to-one with the plurality of sessions; ;

Establishing a communication session with the origin server through a first proxy server; And

Resetting the communication session through one of the second to nth proxy servers at the request of the control server,

And the plurality of proxy servers comprises the first to nth proxy servers.
The method of claim 1, wherein the plurality of proxy servers

And a plurality of backup proxy servers.
The method of claim 1, wherein the plurality of proxy servers

Session maintenance method characterized in that the session is divided into a proxy server group and the session is not blocked proxy server group.
The method of claim 3, wherein resetting the communication session through one of the second to nth proxy servers at the request of the control server comprises:

Resetting the communication session through one of the proxy server groups in which the session is not blocked at the request of the control server; And

And including the first proxy server in the proxy server group where the session is blocked.
The method of claim 3, wherein the session maintenance method is

And including at least one of the proxy server groups in which the session is blocked, according to a request of the control server, in the proxy server group in which the session is not blocked.
In the session maintenance system in a Distributed Deny of Service (DDoS) attack situation performed in the user terminal that can be connected to the control server, origin server and a plurality of proxy servers,

A session generator configured to connect each of the plurality of proxy servers and to connect each of the plurality of proxy servers with the origin server to generate a plurality of sessions, wherein the plurality of proxy servers are mapped one-to-one with the plurality of sessions; being-;

A session control unit for establishing a communication session with the origin server through a first proxy server, and resetting the communication session through one of second to nth proxy servers according to a request of the control server;

And the plurality of proxy servers comprises the first to nth proxy servers.
Generating a plurality of sessions by the user terminal connecting each of the plurality of proxy servers and connecting each of the plurality of proxy servers with an origin server, wherein the plurality of proxy servers are mapped one-to-one with the plurality of sessions. being-;

Establishing, by the user terminal, a communication session with the origin server through a first proxy server; And

The monitoring server monitors the traffic flowing into the first proxy server, and transmits a session change request to the user terminal when abnormal traffic occurs; And

The user terminal resetting the communication session through one of the second to nth proxy servers at the request of the control server;

And the plurality of proxy servers comprises the first to nth proxy servers.
In the session maintenance method in the Distributed Deny of Service (DDoS) attack situation performed in the control server that can be connected to the user terminal and a plurality of proxy servers,

Monitoring the traffic flowing into the plurality of proxy servers; And

And transmitting a session change request to the user terminal when the incoming traffic is abnormal traffic.