WO2017088326A1 - Tcp连接的处理方法、装置及系统 - Google Patents

Tcp连接的处理方法、装置及系统 Download PDF

Info

Publication number
WO2017088326A1
WO2017088326A1 PCT/CN2016/076786 CN2016076786W WO2017088326A1 WO 2017088326 A1 WO2017088326 A1 WO 2017088326A1 CN 2016076786 W CN2016076786 W CN 2016076786W WO 2017088326 A1 WO2017088326 A1 WO 2017088326A1
Authority
WO
WIPO (PCT)
Prior art keywords
connection
packet
client
message
response message
Prior art date
Application number
PCT/CN2016/076786
Other languages
English (en)
French (fr)
Inventor
洪珂
欧怀谷
马涛
陈文生
Original Assignee
网宿科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 网宿科技股份有限公司 filed Critical 网宿科技股份有限公司
Priority to EP16867555.1A priority Critical patent/EP3361693B1/en
Priority to US15/766,567 priority patent/US20180302434A1/en
Publication of WO2017088326A1 publication Critical patent/WO2017088326A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/16—Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
    • H04L69/161—Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L1/00—Arrangements for detecting or preventing errors in the information received
    • H04L1/12—Arrangements for detecting or preventing errors in the information received by using return channel
    • H04L1/16—Arrangements for detecting or preventing errors in the information received by using return channel in which the return channel carries supervisory signals, e.g. repetition request signals
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L1/00—Arrangements for detecting or preventing errors in the information received
    • H04L1/12—Arrangements for detecting or preventing errors in the information received by using return channel
    • H04L1/16—Arrangements for detecting or preventing errors in the information received by using return channel in which the return channel carries supervisory signals, e.g. repetition request signals
    • H04L1/1607—Details of the supervisory signal
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L1/00—Arrangements for detecting or preventing errors in the information received
    • H04L1/12—Arrangements for detecting or preventing errors in the information received by using return channel
    • H04L1/16—Arrangements for detecting or preventing errors in the information received by using return channel in which the return channel carries supervisory signals, e.g. repetition request signals
    • H04L1/1607—Details of the supervisory signal
    • H04L1/1657—Implicit acknowledgement of correct or incorrect reception, e.g. with a moving window
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/16—Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/16—Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
    • H04L69/163—In-band adaptation of TCP data exchange; In-band control procedures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass

Definitions

  • the present invention relates to the field of the Internet, and in particular, to a method, an apparatus, and a system for processing a TCP connection.
  • SYN FLOOD attacks are a very important means of DDoS distributed denial of service attacks. It has the characteristics of simple startup method and obvious effect, which can quickly consume the performance of the server and cause the server service to be unavailable.
  • the SYN FLOOD attack exploits the fragile flaw of the three-way handshake process when establishing a TCP connection, and sends a large number of forged TCP connection requests, so that the server maintains a large number of half-open connections, thereby exhausting the resources of the attacked server and affecting normal conditions.
  • the establishment of the connection exploits the fragile flaw of the three-way handshake process when establishing a TCP connection, and sends a large number of forged TCP connection requests, so that the server maintains a large number of half-open connections, thereby exhausting the resources of the attacked server and affecting normal conditions.
  • the establishment of the connection exploits the fragile flaw of the three-way handshake process when establishing a TCP connection, and sends a large number of forged TCP connection requests, so that the server maintains a large number of half-open connections, thereby exhausting the resources of the attacked server and affecting normal conditions.
  • the establishment of the connection exploits the fragile flaw of the three-way handshake process when
  • each SYN synchronization packet In the normal process of establishing a connection through TCP, after each SYN synchronization packet is received, the server creates a connection entry in the kernel protocol stack, waiting for subsequent packets of the connection and further processing. An attacker often spoofs the source IP address and sends a large number of SYN synchronization packets to the server. Each SYN synchronization packet causes the server to create a connection entry in the SYN_RECV semi-connected state. The server cannot complete the TCP three times because there is no subsequent ACK packet. Handshake, so these connections will remain in the SYN_RECV semi-connected state for a period of time. After the number of connections in the semi-connected state reaches a certain level, since the server consumes a lot of resources in order to maintain a very large semi-join list, the processing speed of the server for the normal connection becomes slow or even impossible to establish.
  • a conventional protection method for responding to a SYN FLOOD attack in the prior art does not deliver the SYN synchronization packet to the server after the protection device or the protection module receives the SYN synchronization packet. Instead, it is first confirmed whether the source IP client that sent the SYN synchronization packet can establish a normal connection through the three-way handshake, and then forwards the IP packet to the server.
  • the specific processing method is to respond to the SYN COOKIE first, and after the subsequent ACK verification is passed, the source IP is whitelisted and the current connection is broken, and the client re-initiates the connection.
  • the protection device initiates a new connection to the server as a client, and passes the client's request through the server. Connect to the server.
  • the protection device needs to maintain a large number of connection information in the connected state at the same time, and also needs to forward the TCP connection, which affects the protection performance and increases the response delay.
  • the embodiment of the invention provides a method, a device and a system for processing a TCP connection, so as to at least solve the technical problem that the protection performance is low and the connection response delay is caused by the need to re-establish the connection after verifying the TCP connection sent by the client. .
  • a processing system for a TCP connection including: a protection device that establishes a communication connection with a client through the Internet, and is configured to receive a connection sent by the client for establishing a TCP connection with the server.
  • the packet is used to determine the type of the received packet, and when the packet type of the connected packet is a response packet, the response check message is used to verify the response packet, and the response packet is verified.
  • the response message is forwarded to the connected device set by the server; the connected device is set on the server, and a communication connection is established with the client and the protection device respectively, and is used for receiving the TCP forwarded by the protection device to establish a TCP with the server.
  • connection packet is connected, and the packet type of the received connection packet is determined.
  • packet type of the connection packet is a response packet
  • the response packet is verified according to a preset verification rule.
  • the response message is used to establish a TCP connection with the client that sends the response message.
  • a method for processing a TCP connection is further provided, which is applied to a protection device, comprising: receiving a connection message sent by a client for establishing a TCP connection with a server; and determining the received message
  • the packet type of the connection message wherein the message type of the connection message includes at least: a synchronization message and a response message; when the message type of the connection message is a response message, the connection verification message is used to respond to the message.
  • the message is verified, wherein the connection check information is generated according to the synchronization message; when the response message is verified, the response message is forwarded to the server.
  • the method further includes: counting, receiving the synchronization packet within a predetermined time set in advance The number of packets; whether the number of packets is greater than or equal to the preset threshold; when the number of packets is greater than or equal to the threshold, the connection check information is generated according to the synchronization packet; when the number of packets is smaller than the threshold, the synchronization packet is forwarded to Service-Terminal.
  • the method further includes: acquiring a client that sends the response message The first client address of the terminal; save the first client address to the pre-created client address table.
  • the method further includes: when the response message verification fails, obtaining a second client address of the client that sends the response message; and the second client The end address matches the client address table; when the second client address matches the address in the client address table, the response message is forwarded to the server; when the second client address and the address in the client address table If there is no match, the response message is discarded.
  • a processing device for a TCP connection including: applying to a protection device, comprising: a first receiving module, configured to receive a TCP connection sent by a client for establishing a TCP connection with a server
  • the first judging module is configured to determine the type of the received packet, wherein the packet type of the connection packet includes at least: a synchronization packet and a response packet; and the first verification module,
  • the packet type of the connection packet is a response packet
  • the connection verification message is used to verify the response message, wherein the connection verification information is generated according to the synchronization message
  • the first forwarding module is configured to respond When the packet is verified, the response packet is forwarded to the server.
  • the device further includes: a statistics module, configured to count the number of the received packets in the predetermined time set in advance; and the second determining module is configured to determine whether the number of the packets is greater than or equal to a preset threshold;
  • the generating module is configured to generate the connection check information according to the synchronization message when the number of the packets is greater than or equal to the threshold, and the second forwarding module is configured to forward the synchronization message to the server when the number of the packets is less than the threshold.
  • the device further includes: a first acquiring module, configured to acquire a first client address of the client that sends the response message; and a storage module, configured to save the first client address to the pre-created client address table.
  • the device further includes: a second obtaining module, configured to: when the response message verification fails, obtain a second client address of the client that sends the response message; and a matching module, configured to use the second client address The client address table is matched; the third forwarding module is configured to forward the response message to the server when the second client address matches the address in the client address table; and the discarding module is used to be the second client When the address does not match the address in the client address table, the response packet is discarded.
  • a second obtaining module configured to: when the response message verification fails, obtain a second client address of the client that sends the response message
  • a matching module configured to use the second client address The client address table is matched
  • the third forwarding module is configured to forward the response message to the server when the second client address matches the address in the client address table
  • the discarding module is used to be the second client When the address does not match the address in the client address table, the response packet is discarded.
  • a method for processing a TCP connection is further provided, which is applied to the server, and includes: receiving, by the protection device, a connection packet for establishing a TCP connection with the server; and determining the received message
  • the packet type of the connection packet wherein the packet type of the connection packet includes at least: a synchronization packet and a response packet; when the packet type of the connection packet is a response packet, according to a preset verification rule The response message is verified; when the response message is verified, the response message is used to establish a TCP connection with the client that sends the response message.
  • a processing device for a TCP connection including: an application On the server side, the second receiving module is configured to receive a connection message that is forwarded by the protection device to establish a TCP connection with the server, and a third determining module is configured to determine the type of the received connection message.
  • the packet type of the connection packet includes at least: a synchronization packet and a response packet, and the second verification module is configured to: when the packet type of the connection packet is a response packet, according to a preset verification rule The response packet is verified.
  • the first connection module is configured to establish a TCP connection with the client that sends the response message by using the response message when the response message is verified.
  • the connection packet sent by the receiving client for establishing a TCP connection with the server is used; and the packet type of the received connection packet is determined, wherein the packet type of the connection packet includes at least: Synchronous message and response message; when the message type of the connection message is a response message, the response check message is used to verify the response message, wherein the connection check information is generated according to the synchronization message; When the text verification is passed, the response message is forwarded to the server, and the SYN FLOOD attack is protected. The technical effect of improving the protection performance against the SYN FLOOD attack is achieved, and the solution is solved. After the TCP connection sent by the client is verified, the connection needs to be re-established, resulting in low technical performance and delayed connection response.
  • FIG. 1 is a schematic structural diagram of a processing system of a TCP connection according to an embodiment of the present application
  • FIG. 2 is a schematic flow chart of a TCP connection in the prior art
  • FIG. 3 is a schematic flowchart of processing of a TCP connection processing system according to an embodiment of the present application
  • FIG. 4 is a schematic flowchart of a method for processing a TCP connection according to an embodiment of the present application
  • FIG. 5 is a schematic flowchart of a processing method of a TCP connection according to an embodiment of the present application.
  • FIG. 6 is a schematic diagram of a processing device of a TCP connection according to an embodiment of the present application.
  • FIG. 7 is a schematic flowchart of a method for processing a TCP connection according to an embodiment of the present application.
  • FIG. 8 is a schematic flowchart of a processing method of a TCP connection according to an embodiment of the present application.
  • FIG. 9 is a schematic diagram of a processing device of a TCP connection according to an embodiment of the present application.
  • FIG. 1 Before describing further details of various embodiments of the present application, a suitable computing architecture that can be used to implement the principles of the present application will be described with reference to FIG.
  • embodiments of the present application are described with reference to the symbolic representation of acts and operations performed by one or more computers, unless otherwise indicated.
  • Such actions and operations include the manipulation of an electrical signal by a processing unit of a computer to represent data in a structured form. This manipulation transforms the data or maintains it in a location in the computer's memory system, which reconfigures or changes the operation of the computer in a manner that is understood by those skilled in the art.
  • the data structure that maintains the data is the physical location of the memory with the specific attributes defined by the format of the data.
  • the present application is described in the above context, it is not meant to be limiting, and as understood by those skilled in the art, aspects of the actions and operations described hereinafter may also be implemented in hardware.
  • FIG. 1 is a schematic structural diagram of a processing system of a TCP connection according to an embodiment of the present application.
  • the depicted architecture is only one example of a suitable environment and is not intended to limit the scope of the application.
  • the computing system be interpreted as having any dependency or requirement on any of the components shown in Figure 1, or a combination thereof.
  • the processing system of the TCP connection may include: a protection device 10 and a connection device 30.
  • the protection device 10 establishes a communication connection with the client through the Internet, and is configured to receive a connection message sent by the client for establishing a TCP connection with the server, and determine the type of the received connection message.
  • the packet type of the connection packet is a response packet
  • the response packet is verified by using the connection verification information.
  • the response packet is forwarded to the connection device set by the server.
  • the connection device 30 is disposed on the server side, and establishes a communication connection with the client and the protection device respectively, and is configured to receive the connection packet forwarded by the protection device for establishing a TCP connection with the server, and determine the received connection message.
  • the packet type where the packet type of the connection packet is a response packet, the response packet is verified according to the preset verification rule, and when the response packet is verified, the response packet is sent and sent.
  • the client that responds to the message establishes a TCP connection.
  • a TCP connection in order to transfer TCP data between the client and the server, it is necessary to first establish a virtual circuit, that is, a TCP connection.
  • the client first sends a TCP packet containing the SYN synchronization flag, that is, a SYN synchronization packet.
  • the server After receiving the synchronization message sent by the client, the server will return a SYN/ACK synchronization response message, indicating that the TCP connection request sent by the client has been received by the server. Finally, the client will return an ACK response message to the server according to the SYN/ACK synchronization response message.
  • a TCP connection is completed between the client and the server.
  • the server when establishing a TCP connection, receives at least the SYN synchronization packet and the ACK response packet sent by the client.
  • the protection device is configured on the server side, and after receiving the connection message sent by the client for establishing a TCP connection with the server, the protection device 10 and the connection device 30 respectively report the connection according to the packet type of the connection message. The text is processed.
  • the received packet type is an ACK response packet
  • the ACK response packet is verified.
  • the ACK response message passes the verification, it is forwarded to the connected device set on the server side, and a communication connection is established between the client and the server end through the connection device.
  • the protection device 10 performs the counting process on the received SYN synchronization packet when the received packet type is a SYN synchronization packet. And count the number of packets received in the synchronization packet within the preset time.
  • a SYN FLOOD attack may occur when the number of received messages within a preset time exceeds a preset threshold. Therefore, the sent SYN synchronization message is verified.
  • the number of received packets in the preset time is less than the preset threshold, it is considered that no SYN FLOOD attack occurs, and the SYN synchronization packet is directly forwarded to the connected device, and the connected device and the client are set in the server.
  • the terminal directly establishes a TCP connection.
  • the client that sends the response packet can be confirmed as a legitimate client that is normally accessed. Therefore, the client address of the client can be obtained through the protection device 10, and the client address is obtained. Join the pre-set client address table.
  • the client address table is used to record the address information of the legal client.
  • the protection device 10 acquires the second client address of the client that sends the response packet, and the second client address is in the preset client address table. The address information is matched. If the address of the second client matches the address information in the client address table, the packet is sent by the legal client. Therefore, the message information can be forwarded to the connected device. If the second client address does not match the address information in the client address table, the client is considered to be an illegal client, and the response packet sent by the client is discarded.
  • the type of the connection message is determined.
  • the packet type of the connection packet is an ACK response packet
  • the ACK response packet is verified according to a preset verification rule.
  • the response message is used to establish a TCP connection with the client.
  • the response message is not verified, the ACK response message is directly discarded.
  • the verification rule is the same as the verification rule in the protection device.
  • the ACK response packet can be verified by the SYN COOKIE check mode. The specific verification method is not described here.
  • connection device 30 establishes a TCP connection directly with the client by using the SYN synchronization message.
  • the above-mentioned TCP connection processing system can work together and cooperate with the protection device to efficiently perform verification and connection processing in the SYN FLOOD protection process.
  • the protection device is responsible for detecting and verifying the SYN FLOOD, and forwarding the ACK response message verified by the SYN COOKIE to the connected device; obtaining the client address of the ACK response message that has not passed the SYN COOKIE check, and according to The results found in the client address table are processed accordingly.
  • the protection device sends a SYN/ACK synchronization response packet to the client according to the received SYN synchronization packet, and performs the received ACK response packet. verification.
  • the connected device is responsible for checking and verifying the connection packets forwarded by the protection device. When the check passes, a join entry is created in the kernel stack. Subsequent communication requests for the connection are forwarded directly to the receiver in the server, which is sent by the receiver to the kernel protocol stack for processing. By connecting the device, you can quickly create a communication connection on the server, avoiding the connection interruption or the problem caused by the protection device to perform TCP proxy.
  • connection device receives the connection packet forwarded by the protection device for verification, and to create a corresponding connection entry in the kernel according to the packet type of the connection packet. For messages without COOKIE content, and SYN synchronization messages, they are processed by the kernel protocol stack.
  • the system solves the performance problem caused by the SYN FLOOD protection process being too complicated.
  • the response delay problem for the two drawbacks of the current conventional SYN FLOOD protection, propose an improved solution for SYN FLOOD protection, the above mainly solves:
  • the existing authentication method uses the whitelist or the TCP proxy to bring about the loss of the performance of the protection device after performing the SYN COOKIE verification on the ACK response message.
  • the protection device that uses the above-mentioned TCP connection processing method replaces the handshake process in which the server establishes a TCP connection with the client, and completes the verification of the SYN message.
  • the ACK response message sent by the normal client for the TCP connection is forwarded to the connected device by the protection device, and the connected device can create a TCP connection according to the information in the ACK response message.
  • the protection device and the connection device are completed together, and the client does not perceive the process, thereby effectively completing the verification and TCP connection establishment in the SYN FLOOD protection process, thereby ensuring the customer experience.
  • FIG. 4 is a schematic flowchart diagram of a method for processing a TCP connection according to an embodiment of the present application.
  • the processing method of the foregoing TCP connection includes the following steps:
  • Step S102 Receive a connection message sent by the client for establishing a TCP connection with the server.
  • Step S104 Determine a message type of the received connection message, where the message type of the connection message includes at least: a synchronization message and a response message.
  • Step S106 When the message type of the connected message is a response message, the response message is verified by using the connection check information, where the connection check information is generated according to the synchronization message.
  • Step S108 When the response message is verified, the response message is forwarded to the server.
  • a TCP connection in order to transfer TCP data between the client and the server, it is necessary to first establish a virtual circuit, that is, a TCP connection.
  • the client first sends a TCP packet containing the SYN synchronization flag, that is, a SYN synchronization packet.
  • the server After receiving the synchronization message sent by the client, the server will return a SYN/ACK synchronization response message, indicating that the TCP connection request sent by the client has been received by the server. Finally, the client will return an ACK response message to the server according to the SYN/ACK synchronization response message.
  • a TCP connection is completed between the client and the server.
  • the server end when establishing a TCP connection, receives at least the SYN synchronization message and the ACK response message sent by the client.
  • the protection device provided on the server side, after receiving the connection message sent by the client for establishing a TCP connection with the server, according to the foregoing step S102 to step S108, performing the connection message according to the packet type of the connection message. deal with.
  • the received packet type is an ACK response packet
  • the ACK response packet is verified.
  • the ACK response message passes the verification, it is forwarded to the connected device set on the server side, and a communication connection is established between the client and the server end through the connection device.
  • the protection device that uses the above-mentioned TCP connection processing method replaces the handshake process in which the server establishes a TCP connection with the client, and completes the verification of the SYN message.
  • the ACK packet sent by the normal client for the TCP connection is forwarded to the connected device by the protection device, and the connected device can create a TCP connection according to the information in the ACK packet.
  • the protection device and the connection device are completed together, and the client does not perceive the process, thereby effectively completing the verification and TCP connection establishment in the SYN FLOOD protection process, thereby ensuring the customer experience.
  • the method further includes:
  • Step S51 Count the number of packets receiving the synchronization packet within a predetermined time set in advance.
  • step S53 it is determined whether the number of packets is greater than or equal to a preset threshold.
  • Step S55 When the number of packets is greater than or equal to the threshold, the connection verification information is generated according to the synchronization message.
  • Step S57 When the number of packets is less than the threshold, the synchronization packet is forwarded to the server.
  • the protection device when the received packet type is a SYN synchronization packet, the protection device performs a counting process on the received SYN synchronization packet. And count the number of packets received in the synchronization packet within the preset time.
  • a SYN FLOOD attack may occur when the number of received messages within a preset time exceeds a preset threshold. Therefore, the sent SYN synchronization message is verified.
  • the number of received packets in the preset time is less than the preset threshold, it is considered that no SYN FLOOD attack occurs, and the SYN synchronization packet is directly forwarded to the connected device, and the connected device and the client are set in the server.
  • the terminal directly establishes a TCP connection.
  • the threshold for judging whether a SYN FLOOD attack is received may be set according to the average daily access of the server and the processing capability of the server.
  • the scheduled time for counting the number of messages In order to detect attacks in time, you can set the scheduled time of the number of statistical packets to 1 second or A few seconds.
  • the method further includes:
  • Step S109 Acquire a first client address of the client that sends the response message.
  • step S110 the first client address is saved to the pre-created client address table.
  • the client that sends the response packet can be a legitimate client that is normally accessed. Therefore, the client address of the client can be obtained through steps S109 to S110, and the client is obtained. The end address is added to the preset first client address table.
  • the client address table is used to record the address information of the legal client.
  • the method further includes:
  • Step S71 When the response message verification fails, the second client address of the client that sends the response message is obtained.
  • Step S73 matching the second client address with the client address table.
  • Step S75 When the second client address matches the address in the client address table, the response message is forwarded to the server.
  • Step S77 When the second client address does not match the address in the client address table, the response message is discarded.
  • the second client address of the client that sends the response message is obtained through steps S71 to S77, and the second client address and the preset client address are obtained.
  • the address information in the table is matched. If the address of the second client matches the address information in the client address table, the packet is sent by the legal client. Therefore, the message information can be forwarded to the connected device. If the second client address does not match the address information in the client address table, the client is considered to be an illegal client, and the response packet sent by the client is discarded.
  • the client address table may also record the address information of the illegal client.
  • the second client address does not match the address in the client address table, the second client address is added to a preset address table for recording illegal client address information.
  • the protection device each time the protection device receives the connection message sent by the client, the protection device obtains the address information of the client that sends the connection message, and directly determines the legality of the client according to the address table and the address information.
  • the steps of performing the foregoing method in the protection device may include:
  • Step 1 Receive a connection packet sent by the client.
  • Step 2 If the connection packet is a SYN synchronization packet, the number of SYN synchronization packets received per second is counted. When the number of packets exceeds the preset threshold, protection starts, and the SYN COOKIE is sent to the client through the protection device; otherwise, the SYN synchronization packet is forwarded to the connected device.
  • Step 3 If the connection message is an ACK response message, perform a SYN COOKIE check on the ACK response message. When the check is passed, the ACK response message is forwarded to the connected device; when the check fails, the address information of the ACK response message is obtained, and the address information is queried whether the address information exists in the client address table, if the address information The ACK response packet is discarded when it is not in the client address table.
  • connection message For the connection message that is verified by the SYN COOKIE, the connection message can be notified to the connected device by the connection device in the range of the patent, which is not specifically limited herein.
  • FIG. 6 is a schematic diagram of a processing apparatus of a TCP connection according to an embodiment of the present application.
  • the apparatus may include: a first receiving module 12, a first determining module 14, a first checking module 16, and a first forwarding module 18.
  • the first receiving module 12 is configured to receive a connection message sent by the client for establishing a TCP connection with the server, where the first determining module 14 is configured to determine a packet type of the received connection message, where The packet type of the connection packet includes at least a synchronization packet and a response packet.
  • the first verification module 16 is configured to use the connection verification information to respond to the packet when the packet type of the connection packet is a response packet. The verification is performed, wherein the connection verification information is generated according to the synchronization message; the first forwarding module 18 is configured to forward the response message to the server when the response message is verified.
  • the server When a TCP connection is established, the server receives at least the SYN synchronization packet and the ACK response packet sent by the client.
  • the protection device disposed on the server side is configured to receive a TCP connection with the server by the first receiving module 12, the first determining module 14, the first checking module 16, and the first forwarding module 18.
  • the connection packet After the connection packet is received, the connection packet is processed according to the packet type of the connection packet.
  • the received packet type is an ACK response packet
  • the ACK response packet is verified.
  • the ACK response message passes the verification, it is forwarded to the connected device set on the server side, and a communication connection is established between the client and the server end through the connection device.
  • the protection device that uses the above-mentioned TCP connection processing method replaces the handshake process in which the server establishes a TCP connection with the client, and completes the verification of the SYN message.
  • the ACK packet sent by the normal client for the TCP connection is forwarded to the connected device by the protection device, and the connected device can create a TCP connection according to the information in the ACK packet.
  • the protection device and the connection device are completed together, and the client does not perceive the process, thereby effectively completing the verification and TCP connection establishment in the SYN FLOOD protection process, thereby ensuring the customer experience.
  • the foregoing apparatus may further include: a statistics module 51, a second determining module 53, a generating module 55, and a second forwarding module 57.
  • the statistic module 51 is configured to count the number of the packets receiving the synchronization packet within a predetermined time set in advance; the second determining module 53 is configured to determine whether the number of the packets is greater than or equal to a preset threshold; the generating module 55 When the number of packets is greater than or equal to the threshold, the connection verification information is generated according to the synchronization packet.
  • the second forwarding module 57 is configured to forward the synchronization packet to the server when the number of packets is less than the threshold.
  • the protection device when the received packet type is a SYN synchronization packet, the protection device performs the received SYN synchronization packet.
  • Count processing And count the number of packets received in the synchronization packet within the preset time.
  • a SYN FLOOD attack may occur when the number of received messages within a preset time exceeds a preset threshold. Therefore, the sent SYN synchronization message is verified.
  • the SYN synchronization packet is directly forwarded to the connected device, and the connected device and the client are set in the server.
  • the terminal directly establishes a TCP connection.
  • the foregoing apparatus may further include: a first acquiring module 19 and a storage module 20.
  • the first obtaining module 19 is configured to obtain a first client address of the client that sends the response message, and the storage module 20 is configured to save the first client address to the pre-created client address table.
  • the client that sends the response packet can be a legitimate client that is normally accessed. Therefore, the client address of the client can be obtained by using the first acquiring module 19 and the storage module 20. And add the client address to the pre-set first client address table.
  • the client address table is used to record the address information of the legal client.
  • the foregoing apparatus may further include: a second obtaining module 71, a matching module 73, a third forwarding module 75, and a discarding module 77.
  • the second obtaining module 71 is configured to obtain a second client address of the client that sends the response message when the response packet verification fails, and the matching module 73 is configured to use the second client address and the client address.
  • Table The third forwarding module 75 is configured to: when the second client address matches the address in the client address table, forward the response message to the server; and the discarding module 77 is configured to use the second client address and the client When the addresses in the terminal address table do not match, the response packet is discarded.
  • the second acquiring module 71, the matching module 73, the third forwarding module 75, and the discarding module 77 acquire the second client address of the client that sends the response packet. And matching the second client address with the address information in the pre-set client address table. If the address of the second client matches the address information in the client address table, the packet is sent by the legal client. Therefore, the message information can be forwarded to the connected device. If the second client address does not match the address information in the client address table, the client is considered to be an illegal client, and the response packet sent by the client is discarded.
  • FIG. 7 is a flowchart of a method of processing a TCP connection according to an embodiment of the present application.
  • the processing method of the foregoing TCP connection includes the following steps:
  • Step S201 Receive a connection packet forwarded by the protection device to establish a TCP connection with the server.
  • Step S203 Determine a packet type of the received connection message, where the message type of the connection message includes at least: a synchronization message and a response message.
  • Step S205 When the message type of the connected message is a response message, the response message is verified according to a preset verification rule.
  • Step S207 When the response message is verified, the response message is used to establish a TCP connection with the client that sends the response message.
  • the connection device determines the type of the connection message by using the step S201 to the step S207.
  • the packet type of the connection packet is an ACK response packet
  • the ACK response packet is verified according to a preset verification rule.
  • the response message is verified, the ACK response message is used to establish a TCP connection with the client; when the response message is not verified, the ACK response message is sent to the kernel protocol stack, and the kernel protocol stack further deal with.
  • the verification rule is the same as the verification rule in the protection device.
  • the ACK response packet can be verified by the SYN COOKIE check mode. The specific verification method is not described here.
  • the method may further include: after determining the packet type of the received connection packet in step S203, the method may further include:
  • Step S204 establishing a TCP connection with the client according to the synchronization message.
  • the connecting device directly establishes a TCP connection with the client by using the SYN synchronization message in step S204.
  • the steps of performing the foregoing method in the connecting device may include:
  • Step 1 Receive the connection packet forwarded by the protection device.
  • Step 2 If the connection message is a SYN synchronization message, the SYN synchronization message is directly sent to the kernel protocol stack for TCP connection processing.
  • Step 3 If the connection message is an ACK response message, perform a SYN COOKIE check on the ACK response message according to the verification mode agreed with the protection device. When the check is passed, a connection entry is created in the kernel protocol stack to establish a connection with the client according to the ACK response message; when the verification fails, the ACK response message is handed over to the kernel protocol stack for TCP connection. deal with.
  • a TCP connection processing apparatus which is applied to a connection device.
  • 9 is a schematic diagram of a processing device of a TCP connection according to an embodiment of the present application.
  • the apparatus may include: a second receiving module 21, a third determining module 23, a second verifying module 25, and a first connecting module 27.
  • the second receiving module 21 is configured to receive a connection packet that is forwarded by the protection device to establish a TCP connection with the server, and a third determining module 23 is configured to determine a packet type of the received connection message, where The packet type of the connection packet includes at least: a synchronization packet and a response packet.
  • the second verification module 25 is configured to respond to the preset verification rule when the packet type of the connection packet is a response packet. The message is checked.
  • the first connection module 27 is configured to establish a TCP connection with the client that sends the response message by using the response message when the response message is verified.
  • the connected device receives the connection packet forwarded by the protection device, and selects the type of the connected packet. Make a judgment.
  • the packet type of the connection packet is an ACK response packet
  • the ACK response packet is verified according to a preset verification rule.
  • the response message is verified, the ACK response message is used to establish a TCP connection with the client; when the verification of the response message fails, the ACK response message is sent to the kernel protocol stack, and the kernel protocol stack is used. Further processing.
  • the verification rule is the same as the verification rule in the protection device.
  • the ACK response packet can be verified by the SYN COOKIE check mode. The specific verification method is not described here.
  • the foregoing apparatus may further include: a second connection module 24.
  • the second connection module 24 is configured to establish a TCP connection with the client according to the synchronization message.
  • the second connection module 24 establishes a TCP connection directly with the client by using the SYN synchronization packet.
  • the disclosed technical contents may be implemented in other manners.
  • the device embodiments described above are only schematic.
  • the division of the unit may be a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or may be Integrate into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, unit or module, and may be electrical or otherwise.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium.
  • the technical solution of the present invention which is essential or contributes to the prior art, or all or part of the technical solution, may be embodied in the form of a software product stored in a storage medium.
  • a number of instructions are included to cause a computer device (which may be a personal computer, server or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes: a U disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a removable hard disk, a magnetic disk, or an optical disk, and the like. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

本发明公开了一种TCP连接的处理方法、装置及系统。其中，该方法包括：接收客户端发送的用于与服务器端建立TCP连接的连接报文；判断接收到的连接报文的报文类型，其中，连接报文的报文类型至少包括：同步报文和应答报文；当连接报文的报文类型为应答报文时，利用连接校验信息对应答报文进行校验，其中，连接校验信息根据同步报文生成；当应答报文校验通过时，将应答报文转发至服务器端。本发明解决了由于在对客户端发送的TCP连接进行验证后需要重新建立连接，导致的防护性能低、连接响应延迟的技术问题。

Description

TCP连接的处理方法、装置及系统 技术领域
本发明涉及互联网领域，具体而言，涉及一种TCP连接的处理方法、装置及系统。
背景技术
SYN FLOOD攻击是DDoS分布式拒绝服务攻击中非常重要的一种手段。其拥有发动方法简单且效果明显等特点，能够快速消耗服务器的性能，导致服务器的服务不可用。
SYN FLOOD攻击利用了在建立TCP连接时的三次握手处理过程的协议脆弱的缺陷，发送大量伪造的TCP连接请求，使服务器维持大量的半开连接，从而使被攻击服务器的资源耗尽，影响正常连接的建立。
在正常的通过TCP建立连接的处理过程当中，服务器在每收到一个SYN同步包之后，会在内核协议栈中创建一个连接表项，等待该连接后续的报文并做进一步处理。攻击者往往通过伪造源IP，向服务器发起大量SYN同步包，每个SYN同步包都会使服务器创建一个处于SYN_RECV半连接状态的连接表项，由于没有后续的ACK报文，服务器无法完成TCP的三次握手，因此这些连接就会在一段时间内一直保持在SYN_RECV半连接状态。当处于半连接状态的连接数量达到一定程度之后，由于服务器为了维护一个非常庞大的半连接列表而消耗非常多的资源，因此，服务器对于正常连接的处理速度就变得很慢，甚至无法建立。
目前，在现有技术中常规的用于应对SYN FLOOD攻击的防护方法，包括基于SYN COOKIE验证的方式，在防护设备或者防护模块收到SYN同步包后，并不将SYN同步包交给服务器，而是先确认发送SYN同步包的源IP客户端是否能够通过三次握手建立正常的连接，然后再把该IP的报文转发给服务器。其具体的处理方式，一种是先回应SYN COOKIE，等后续的ACK验证通过之后，把该源IP加白名单并把当前连接断掉，由客户端重新发起连接，由于已经加了白名单，该IP后续的报文会被转发到服务器；另一种是做TCP代理，等SYN COOKIE验证通过之后，由防护设备向服务器作为客户端向服务器发起一个新的连接，并把客户端的请求通过该连接转到服务器。
上述现有的防护方法存在如下两个弊端：
1、在通过ACK验证之后利用白名单的方式，将使通过验证的正常的客户端连接中断并且需要客户端重新向服务器发起连接和请求，增大了响应时间，影响客户体验。
2、通过TCP代理的方式，防护设备需要同时维护大量处于连接状态中的连接信息，并且还需要对TCP连接进行转发，在对防护性能造成影响，也会增加响应延迟。
针对上述由于在对客户端发送的TCP连接进行验证后需要重新建立连接，导致的防护性能低、连接响应延迟的问题，目前尚未提出有效的解决方案。
发明内容
本发明实施例提供了一种TCP连接的处理方法、装置及系统，以至少解决由于在对客户端发送的TCP连接进行验证后需要重新建立连接，导致的防护性能低、连接响应延迟的技术问题。
根据本发明实施例的一个方面，提供了一种TCP连接的处理系统，包括：防护设备，通过互联网与客户端建立通讯连接，用于接收客户端发送的用于与服务器端建立TCP连接的连接报文，并判断接收到的连接报文的报文类型，其中，当连接报文的报文类型为应答报文时，利用连接校验信息对应答报文进行校验，当应答报文校验通过时，将应答报文转发至服务器端设置的连接设备；连接设备，设置于服务器端，分别与客户端和防护设备建立通讯连接，用于接收防护设备转发的用于与服务器端建立TCP连接的连接报文，并判断接收到的连接报文的报文类型，其中，当连接报文的报文类型为应答报文时，按照预先设置的校验规则对应答报文进行校验，当应答报文校验通过时，利用应答报文与发送应答报文的客户端建立TCP连接。
根据本发明实施例的另一方面，还提供了一种TCP连接的处理方法，应用于防护设备，包括：接收客户端发送的用于与服务器端建立TCP连接的连接报文；判断接收到的连接报文的报文类型，其中，连接报文的报文类型至少包括：同步报文和应答报文；当连接报文的报文类型为应答报文时，利用连接校验信息对应答报文进行校验，其中，连接校验信息根据同步报文生成；当应答报文校验通过时，将应答报文转发至服务器端。
进一步地，当连接报文的报文类型为同步报文时，在判断接收到的连接报文的报文类型之后，方法还包括：统计在预先设置的预定时间内，接收到同步报文的报文数量；判断报文数量是否大于等于预先设置的阈值；当报文数量大于或等于阈值时，根据同步报文生成连接校验信息；当报文数量小于阈值时，将同步报文转发至服务器端。
进一步地，在当应答报文校验通过之后，方法还包括：获取发送应答报文的客户 端的第一客户端地址；将第一客户端地址保存至预先创建的客户端地址表。
进一步地，在利用连接校验信息对应答报文进行校验之后，方法还包括：当应答报文校验未通过时，获取发送应答报文的客户端的第二客户端地址；将第二客户端地址与客户端地址表进行匹配；当第二客户端地址与客户端地址表中的地址匹配时，将应答报文转发至服务器端；当第二客户端地址与客户端地址表中的地址不匹配时，丢弃应答报文。
根据本发明实施例的另一方面，还提供了一种TCP连接的处理装置，包括：应用于防护设备，包括：第一接收模块，用于接收客户端发送的用于与服务器端建立TCP连接的连接报文；第一判断模块，用于判断接收到的连接报文的报文类型，其中，连接报文的报文类型至少包括：同步报文和应答报文；第一校验模块，用于当连接报文的报文类型为应答报文时，利用连接校验信息对应答报文进行校验，其中，连接校验信息根据同步报文生成；第一转发模块，用于当应答报文校验通过时，将应答报文转发至服务器端。
进一步地，装置还包括：统计模块，用于统计在预先设置的预定时间内，接收到同步报文的报文数量；第二判断模块，用于判断报文数量是否大于等于预先设置的阈值；生成模块，用于当报文数量大于或等于阈值时，根据同步报文生成连接校验信息；第二转发模块，用于当报文数量小于阈值时，将同步报文转发至服务器端。
进一步地，装置还包括：第一获取模块，用于获取发送应答报文的客户端的第一客户端地址；存储模块，用于将第一客户端地址保存至预先创建的客户端地址表。
进一步地，装置还包括：第二获取模块，用于当应答报文校验未通过时，获取发送应答报文的客户端的第二客户端地址；匹配模块，用于将第二客户端地址与客户端地址表进行匹配；第三转发模块，用于当第二客户端地址与客户端地址表中的地址匹配时，将应答报文转发至服务器端；丢弃模块，用于当第二客户端地址与客户端地址表中的地址不匹配时，丢弃应答报文。
根据本发明实施例的另一方面，还提供了一种TCP连接的处理方法，应用于服务器端，包括：接收防护设备转发的用于与服务器端建立TCP连接的连接报文；判断接收到的连接报文的报文类型，其中，连接报文的报文类型至少包括：同步报文和应答报文；当连接报文的报文类型为应答报文时，按照预先设置的校验规则对应答报文进行校验；当应答报文校验通过时，利用应答报文与发送应答报文的客户端建立TCP连接。
根据本发明实施例的另一方面，还提供了一种TCP连接的处理装置，包括：应用 于服务器端，包括：第二接收模块，用于接收防护设备转发的用于与服务器端建立TCP连接的连接报文；第三判断模块，用于判断接收到的连接报文的报文类型，其中，连接报文的报文类型至少包括：同步报文和应答报文；第二校验模块，用于当连接报文的报文类型为应答报文时，按照预先设置的校验规则对应答报文进行校验；第一连接模块，用于当应答报文校验通过时，利用应答报文与发送应答报文的客户端建立TCP连接。
在本发明实施例中，采用接收客户端发送的用于与服务器端建立TCP连接的连接报文；判断接收到的连接报文的报文类型，其中，连接报文的报文类型至少包括：同步报文和应答报文；当连接报文的报文类型为应答报文时，利用连接校验信息对应答报文进行校验，其中，连接校验信息根据同步报文生成；当应答报文校验通过时，将应答报文转发至服务器端的方式，达到了对SYN FLOOD攻击进行防护的目的，从而实现了提升对SYN FLOOD攻击进行防护的防护性能的技术效果，进而解决了由于在对客户端发送的TCP连接进行验证后需要重新建立连接，导致的防护性能低、连接响应延迟的技术问题。
附图说明
此处所说明的附图用来提供对本发明的进一步理解，构成本申请的一部分，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1是根据本申请实施例的TCP连接的处理系统结构示意图；
图2是现有技术中的TCP连接的流程示意图；
图3是根据本申请实施例的TCP连接的处理系统的处理流程示意图；
图4是根据本申请实施例的TCP连接的处理方法的流程示意图；
图5是基于本申请实施例的TCP连接的处理方法的处理流程示意图；
图6是根据本申请实施例的TCP连接的处理装置的示意图；
图7是根据本申请实施例的TCP连接的处理方法的流程示意图；
图8是基于本申请实施例的TCP连接的处理方法的处理流程示意图；以及
图9是根据本申请实施例的TCP连接的处理装置的示意图。
具体实施方式
为了使本技术领域的人员更好地理解本发明方案，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分的实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都应当属于本发明保护的范围。
需要说明的是，本发明的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的本发明的实施例能够以除了在这里图示或描述的那些以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
实施例1：
在描述本申请的各实施例的进一步细节之前，将参考图1来描述可用于实现本申请的原理的一个合适的计算体系结构。在以下描述中，除非另外指明，否则将参考由一个或多个计算机执行的动作和操作的符号表示来描述本申请的各实施例。由此，可以理解，有时被称为计算机执行的这类动作和操作包括计算机的处理单元对以结构化形式表示数据的电信号的操纵。这一操纵转换了数据或在计算机的存储器系统中的位置上维护它，这以本领域的技术人员都理解的方式重配置或改变了计算机的操作。维护数据的数据结构是具有数据的格式所定义的特定属性的存储器的物理位置。然而，尽管在上述上下文中描述本申请，但它并不意味着限制性的，如本领域的技术人员所理解的，后文所描述的动作和操作的各方面也可用硬件来实现。
在其最基本的配置中，图1是根据本申请实施例的TCP连接的处理系统结构示意图。出于描述的目的，所绘的体系结构仅为合适环境的一个示例，并非对本申请的使用范围或功能提出任何局限。也不应将该计算系统解释为对图1所示的任一组件或其组合具有任何依赖或需求。
如图1所示，本申请提供的TCP连接的处理系统可以包括：防护设备10和连接设备30。
其中，防护设备10，通过互联网与客户端建立通讯连接，用于接收客户端发送的用于与服务器端建立TCP连接的连接报文，并判断接收到的连接报文的报文类型，其 中，当连接报文的报文类型为应答报文时，利用连接校验信息对应答报文进行校验，当应答报文校验通过时，将应答报文转发至服务器端设置的连接设备；连接设备30，设置于服务器端，分别与客户端和防护设备建立通讯连接，用于接收防护设备转发的用于与服务器端建立TCP连接的连接报文，并判断接收到的连接报文的报文类型，其中，当连接报文的报文类型为应答报文时，按照预先设置的校验规则对应答报文进行校验，当应答报文校验通过时，利用应答报文与发送应答报文的客户端建立TCP连接。
具体的，如图2所示，为了在客户端与服务器端之间传输TCP数据，需要首先建立一个虚拟电路，即TCP连接。而在建立TCP连接时，首先由客户端发送一个包含SYN同步标志的TCP报文，即SYN同步报文。然后服务器端在接收到客户端发送的同步报文后，将返回一个SYN/ACK同步应答报文，表示由客户端发送的TCP连接请求已被服务器端接收。最后，客户端会根据SYN/ACK同步应答报文，返回ACK应答报文至服务器端。至此，客户端与服务器端之间完成一个TCP连接。
如图3所示，在建立TCP连接时，服务器端至少会接收到客户端发送的SYN同步报文和ACK应答报文。设置于服务器侧的防护设备，通过上述防护设备10和连接设备30，在接收到客户端发送的用于与服务器端建立TCP连接的连接报文后，根据连接报文的报文类型对连接报文进行处理。当接收到的报文类型为ACK应答报文时，对ACK应答报文进行校验。当ACK应答报文通过校验时，将其转发至设置于服务器端的连接设备，通过连接设备在客户端和服务器端之间建立通讯连接。达到了对SYN FLOOD攻击进行防护的目的，从而实现了提升对SYN FLOOD攻击进行防护的防护性能的技术效果，进而解决了由于在对客户端发送的TCP连接进行验证后需要重新建立连接，导致的防护性能低、连接响应延迟的技术问题。
进一步的，防护设备10当接收到的报文类型为SYN同步报文时，防护设备对接收到的SYN同步报文进行计数处理。并且统计在预先设置的时间内接收到的同步报文的报文数量。当在预设时间内接收到的报文数量超过预先设置的阈值时，有可能发生SYN FLOOD攻击。因此，对发送的SYN同步报文进行验证。当在预设时间内接收到的报文数量小于超过预先设置的阈值时，则认为没有发生SYN FLOOD攻击，将SYN同步报文直接转发至连接设备，并由设置于服务器中的连接设备与客户端直接建立TCP连接。
进一步的，当应答报文校验通过，可以确认发送该应答报文的客户端为正常访问的合法客户端，因此，可以通过防护设备10获取该客户端的客户端地址，并将该客户端地址加入预先设置的客户端地址表当中。其中，客户端地址表用于记录合法客户端的地址信息。
进一步的，当应答报文校验未通过时，通过防护设备10对发送该应答报文的客户端的第二客户端地址进行获取，并将第二客户端地址与预先设置的客户端地址表中的地址信息进行匹配。如果第二客户端地址与客户端地址表中的地址信息匹配时，说明该报文为合法客户端发送的。因此，可以将该报文信息转发至连接设备。如果第二客户端地址与客户端地址表中的地址信息不匹配时，认为该客户端为非法客户端，并将该客户端发送的应答报文丢弃。
进一步的，通过连接设备30，在接收到防护设备转发的连接报文后，对连接报文的类型进行判断。当连接报文的报文类型为ACK应答报文时，对ACK应答报文按照预先设置的校验规则进行校验。当对应答报文校验通过时，利用ACK应答报文与客户端建立TCP连接；当对应答报文校验未通过时，直接将ACK应答报文丢弃。其中，校验规则与防护设备中的校验规则一致，可以通过SYN COOKIE的校验方式，对ACK应答报文进行验证，具体验证方法此处不做赘述。
进一步的，当连接报文的报文类型为SYN同步报文时，通过连接设备30，利用SYN同步报文由连接设备直接与客户端建立TCP连接。
上述TCP连接的处理系统通过防护设备与连接设备协同工作、共同配合，可以高效完成SYN FLOOD防护过程中的校验及连接处理。
其中，防护设备负责对SYN FLOOD进行检测和校验，将通过SYN COOKIE校验的ACK应答报文转发至连接设备；获取发送没有通过SYN COOKIE校验的ACK应答报文的客户端地址，并根据在客户端地址表中查找的结果做相应处理。
具体的，上述防护设备在完成SYN同步报文的检查和校验工作后，根据接收到的SYN同步报文向客户端发送SYN/ACK同步应答报文，并对接收到的ACK应答报文进行验证。
连接设备负责在接收到防护设备转发的连接报文后，再做一次检查和校验。当校验通过时，则在内核协议栈中创建连接表项。对于该连接的后续通讯请求，直接转发至服务器中的接收器，由接收器送入内核协议栈进行处理。通过连接设备的处理，可以快速在服务器上创建通讯连接，避免了连接中断或者有防护设备进行TCP代理带来的问题。
具体的，上述连接设备的主要功能是负责接收防护设备转发过来的连接报文进行验证，并对通过验证的连接报文，根据连接报文的报文类型在内核创建相应的连接表项。对于不带COOKIE内容的报文，及SYN同步报文，交由内核协议栈进行处理。
综上所述，本系统为了解决SYN FLOOD防护过程过于复杂从而导致的性能问题 和响应延迟的问题，针对当前常规SYN FLOOD防护的两个弊端，提出对于SYN FLOOD防护的改进方案，上述主要解决了：
(1)目前常规的TCP连接的处理方法在对SYN COOKIE进行验证后，由于第一次连接用于验证，需要断开该次连接或者通过TCP代理服务器进行代理，从而导致响应延迟。
(2)目前现有验证方式，在对ACK应答报文进行SYN COOKIE验证后，利用白名单或者通过TCP代理会带来防护设备的性能的损耗。
由采用上述TCP连接的处理方法的防护设备，代替服务器与客户端建立TCP连接的握手过程，完成对SYN报文的验证。由防护设备将正常客户端发送的用于TCP连接的ACK应答报文转发至连接设备，连接设备可以根据ACK应答报文中的信息，创建TCP连接。在一个完整的TCP连接建立过程，由防护设备与连接设备共同完成，客户端不会感知到该过程，从而在SYN FLOOD防护过程中高效完成了验证和TCP连接建立，保障了客户体验。
实施例2
根据本发明实施例，还提供了一种TCP连接的处理方法，该方法应用于防护设备。图4是根据本申请实施例的TCP连接的处理方法的流程示意图。
如图4所示，上述TCP连接的处理方法包括如下步骤：
步骤S102，接收客户端发送的用于与服务器端建立TCP连接的连接报文。
步骤S104，判断接收到的连接报文的报文类型，其中，连接报文的报文类型至少包括：同步报文和应答报文。
步骤S106，当连接报文的报文类型为应答报文时，利用连接校验信息对应答报文进行校验，其中，连接校验信息根据同步报文生成。
步骤S108，当应答报文校验通过时，将应答报文转发至服务器端。
具体的，如图2所示，为了在客户端与服务器端之间传输TCP数据，需要首先建立一个虚拟电路，即TCP连接。而在建立TCP连接时，首先由客户端发送一个包含SYN同步标志的TCP报文，即SYN同步报文。然后服务器端在接收到客户端发送的同步报文后，将返回一个SYN/ACK同步应答报文，表示由客户端发送的TCP连接请求已被服务器端接收。最后，客户端会根据SYN/ACK同步应答报文，返回ACK应答报文至服务器端。至此，客户端与服务器端之间完成一个TCP连接。
因此，如图3所示，在建立TCP连接时，服务器端至少会接收到客户端发送的SYN同步报文和ACK应答报文。设置于服务器侧的防护设备，通过上述步骤S102至步骤S108，在接收到客户端发送的用于与服务器端建立TCP连接的连接报文后，根据连接报文的报文类型对连接报文进行处理。当接收到的报文类型为ACK应答报文时，对ACK应答报文进行校验。当ACK应答报文通过校验时，将其转发至设置于服务器端的连接设备，通过连接设备在客户端和服务器端之间建立通讯连接。达到了对SYN FLOOD攻击进行防护的目的，从而实现了提升对SYN FLOOD攻击进行防护的防护性能的技术效果，进而解决了由于在对客户端发送的TCP连接进行验证后需要重新建立连接，导致的防护性能低、连接响应延迟的技术问题。
由采用上述TCP连接的处理方法的防护设备，代替服务器与客户端建立TCP连接的握手过程，完成对SYN报文的验证。由防护设备将正常客户端发送的用于TCP连接的ACK报文转发至连接设备，连接设备可以根据ACK报文中的信息，创建TCP连接。在一个完整的TCP连接建立过程，由防护设备与连接设备共同完成，客户端不会感知到该过程，从而在SYN FLOOD防护过程中高效完成了验证和TCP连接建立，保障了客户体验。
作为一种可选的实施方式，当连接报文的报文类型为同步报文时，在步骤S104判断接收到的连接报文的报文类型之后，方法还包括：
步骤S51，统计在预先设置的预定时间内，接收到同步报文的报文数量。
步骤S53，判断报文数量是否大于等于预先设置的阈值。
步骤S55，当报文数量大于或等于阈值时，根据同步报文生成连接校验信息。
步骤S57，当报文数量小于阈值时，将同步报文转发至服务器端。
具体的，通过步骤S51至步骤S57，当接收到的报文类型为SYN同步报文时，防护设备对接收到的SYN同步报文进行计数处理。并且统计在预先设置的时间内接收到的同步报文的报文数量。当在预设时间内接收到的报文数量超过预先设置的阈值时，有可能发生SYN FLOOD攻击。因此，对发送的SYN同步报文进行验证。当在预设时间内接收到的报文数量小于超过预先设置的阈值时，则认为没有发生SYN FLOOD攻击，将SYN同步报文直接转发至连接设备，并由设置于服务器中的连接设备与客户端直接建立TCP连接。
在实际应用当中，用于判断是否收到SYN FLOOD攻击的阈值，可以根据服务器日常的平均访问量以及服务器的处理能力进行设置。用于统计报文数量的预定时间。在进行设置时，为了及时发现攻击，可以将统计报文数量的预定时间设置为1秒或者 几秒。
作为一种可选的实施方式，在步骤S108当应答报文校验通过之后，方法还包括：
步骤S109，获取发送应答报文的客户端的第一客户端地址。
步骤S110，将第一客户端地址保存至预先创建的客户端地址表。
具体的，当应答报文校验通过，可以确认发送该应答报文的客户端为正常访问的合法客户端，因此，可以通过步骤S109至步骤S110获取该客户端的客户端地址，并将该客户端地址加入预先设置的第一客户端地址表当中。其中，客户端地址表用于记录合法客户端的地址信息。
作为一种可选的实施方式，在步骤S106利用连接校验信息对应答报文进行校验之后，上述方法还包括：
步骤S71，当应答报文校验未通过时，获取发送应答报文的客户端的第二客户端地址。
步骤S73，将第二客户端地址与客户端地址表进行匹配。
步骤S75，当第二客户端地址与客户端地址表中的地址匹配时，将应答报文转发至服务器端。
步骤S77，当第二客户端地址与客户端地址表中的地址不匹配时，丢弃应答报文。
具体的，当应答报文校验未通过时，通过步骤S71至步骤S77对发送该应答报文的客户端的第二客户端地址进行获取，并将第二客户端地址与预先设置的客户端地址表中的地址信息进行匹配。如果第二客户端地址与客户端地址表中的地址信息匹配时，说明该报文为合法客户端发送的。因此，可以将该报文信息转发至连接设备。如果第二客户端地址与客户端地址表中的地址信息不匹配时，认为该客户端为非法客户端，并将该客户端发送的应答报文丢弃。
作为一种可选的实施方式，客户端地址表也可以记录非法客户端的地址信息。在当第二客户端地址与客户端地址表中的地址不匹配时，将第二客户端地址加入预先设置的用于记录非法客户端地址信息的地址表中。进一步的，在防护设备每次接收到客户端发送的连接报文时，获取发送连接报文的客户端的地址信息，根据上述地址表和上述地址信息，即可直接对客户端的合法性进行判断。
作为一种可选的实施方式，如图5所示，在实际应用当中，在防护设备中执行上述方法的步骤可以包括：
步骤1，接收客户端发送的连接报文。
步骤2，连接报文若是SYN同步报文，统计每秒接收到的SYN同步报文的报文数量。当报文数量超过预先设置设定的阈值时开始进行防护，通过防护装置向客户端回应SYN COOKIE；否则将SYN同步报文转发至连接设备。
步骤3，连接报文若是ACK应答报文，则对ACK应答报文进行SYN COOKIE校验。当校验通过时，将ACK应答报文转发至连接设备；当校验不通过时，获取发送ACK应答报文的地址信息，并查询该地址信息是否存在客户端地址表中，如果该地址信息不在于客户端地址表中时，将该ACK应答报文丢弃。
其中，对于通过SYN COOKIE校验的连接报文，可以有多种方式通知连接设备该连接报文为已通过校验的连接报文，均在该专利范围之内，此处不做具体限定。
实施例3：
根据本发明实施例，还提供了一种TCP连接的处理装置，该装置应用于防护设备。图6是根据本申请实施例的TCP连接的处理装置的示意图。
如图6所示，该装置可以包括：第一接收模块12、第一判断模块14、第一校验模块16和第一转发模块18。
其中，第一接收模块12，用于接收客户端发送的用于与服务器端建立TCP连接的连接报文；第一判断模块14，用于判断接收到的连接报文的报文类型，其中，连接报文的报文类型至少包括：同步报文和应答报文；第一校验模块16，用于当连接报文的报文类型为应答报文时，利用连接校验信息对应答报文进行校验，其中，连接校验信息根据同步报文生成；第一转发模块18，用于当应答报文校验通过时，将应答报文转发至服务器端。
在建立TCP连接时，服务器端至少会接收到客户端发送的SYN同步报文和ACK应答报文。设置于服务器侧的防护设备，通过上述第一接收模块12、第一判断模块14、第一校验模块16和第一转发模块18，在接收到客户端发送的用于与服务器端建立TCP连接的连接报文后，根据连接报文的报文类型对连接报文进行处理。当接收到的报文类型为ACK应答报文时，对ACK应答报文进行校验。当ACK应答报文通过校验时，将其转发至设置于服务器端的连接设备，通过连接设备在客户端和服务器端之间建立通讯连接。达到了对SYN FLOOD攻击进行防护的目的，从而实现了提升对SYN FLOOD攻击进行防护的防护性能的技术效果，进而解决了由于在对客户端发送的TCP连接进行验证后需要重新建立连接，导致的防护性能低、连接响应延迟的技术问题。
由采用上述TCP连接的处理方法的防护设备，代替服务器与客户端建立TCP连接的握手过程，完成对SYN报文的验证。由防护设备将正常客户端发送的用于TCP连接的ACK报文转发至连接设备，连接设备可以根据ACK报文中的信息，创建TCP连接。在一个完整的TCP连接建立过程，由防护设备与连接设备共同完成，客户端不会感知到该过程，从而在SYN FLOOD防护过程中高效完成了验证和TCP连接建立，保障了客户体验。
作为一种可选的实施方式，上述装置还可以包括：统计模块51、第二判断模块53、生成模块55和第二转发模块57。
其中，统计模块51，用于统计在预先设置的预定时间内，接收到同步报文的报文数量；第二判断模块53，用于判断报文数量是否大于等于预先设置的阈值；生成模块55，用于当报文数量大于或等于阈值时，根据同步报文生成连接校验信息；第二转发模块57，用于当报文数量小于阈值时，将同步报文转发至服务器端。
具体的，通过上述统计模块51、第二判断模块53、生成模块55和第二转发模块57，当接收到的报文类型为SYN同步报文时，防护设备对接收到的SYN同步报文进行计数处理。并且统计在预先设置的时间内接收到的同步报文的报文数量。当在预设时间内接收到的报文数量超过预先设置的阈值时，有可能发生SYN FLOOD攻击。因此，对发送的SYN同步报文进行验证。当在预设时间内接收到的报文数量小于超过预先设置的阈值时，则认为没有发生SYN FLOOD攻击，将SYN同步报文直接转发至连接设备，并由设置于服务器中的连接设备与客户端直接建立TCP连接。
作为一种可选的实施方式，上述装置还可以包括：第一获取模块19和存储模块20。
其中，第一获取模块19，用于获取发送应答报文的客户端的第一客户端地址；存储模块20，用于将第一客户端地址保存至预先创建的客户端地址表。
具体的，当应答报文校验通过，可以确认发送该应答报文的客户端为正常访问的合法客户端，因此，可以通过上述第一获取模块19和存储模块20获取该客户端的客户端地址，并将该客户端地址加入预先设置的第一客户端地址表当中。其中，客户端地址表用于记录合法客户端的地址信息。
作为一种可选的实施方式，上述装置还可以包括：第二获取模块71、匹配模块73、第三转发模块75和丢弃模块77。
其中，第二获取模块71，用于当应答报文校验未通过时，获取发送应答报文的客户端的第二客户端地址；匹配模块73，用于将第二客户端地址与客户端地址表进行匹 配；第三转发模块75，用于当第二客户端地址与客户端地址表中的地址匹配时，将应答报文转发至服务器端；丢弃模块77，用于当第二客户端地址与客户端地址表中的地址不匹配时，丢弃应答报文。
具体的，当应答报文校验未通过时，通过上述第二获取模块71、匹配模块73、第三转发模块75和丢弃模块77对发送该应答报文的客户端的第二客户端地址进行获取，并将第二客户端地址与预先设置的客户端地址表中的地址信息进行匹配。如果第二客户端地址与客户端地址表中的地址信息匹配时，说明该报文为合法客户端发送的。因此，可以将该报文信息转发至连接设备。如果第二客户端地址与客户端地址表中的地址信息不匹配时，认为该客户端为非法客户端，并将该客户端发送的应答报文丢弃。
实施例4
根据本发明实施例，还提供了一种TCP连接的处理方法，该方法应用于连接设备。图7是根据本申请实施例的TCP连接的处理方法的流程图。
如图7所示，上述TCP连接的处理方法包括如下步骤：
步骤S201，接收防护设备转发的用于与服务器端建立TCP连接的连接报文。
步骤S203，判断接收到的连接报文的报文类型，其中，连接报文的报文类型至少包括：同步报文和应答报文。
步骤S205，当连接报文的报文类型为应答报文时，按照预先设置的校验规则对应答报文进行校验。
步骤S207，当应答报文校验通过时，利用应答报文与发送应答报文的客户端建立TCP连接。
具体的，通过步骤S201至步骤S207，连接设备在接收到防护设备转发的连接报文后，对连接报文的类型进行判断。当连接报文的报文类型为ACK应答报文时，对ACK应答报文按照预先设置的校验规则进行校验。当对应答报文校验通过时，利用ACK应答报文与客户端建立TCP连接；当对应答报文校验未通过时，将ACK应答报文发送至内核协议栈，由内核协议栈做进一步处理。其中，校验规则与防护设备中的校验规则一致，可以通过SYN COOKIE的校验方式，对ACK应答报文进行验证，具体验证方法此处不做赘述。
作为一种可选的实施方式，当连接报文的报文类型为同步报文时，在步骤S203判断接收到的连接报文的报文类型之后，上述方法还可以包括：
步骤S204，根据同步报文与客户端建立TCP连接。
具体的，当连接报文的报文类型为SYN同步报文时，通过步骤S204，利用SYN同步报文由连接设备直接与客户端建立TCP连接。
作为一种可选的实施方式，如图8所示，在实际应用当中，在连接设备中执行上述方法的步骤可以包括：
步骤1，接收防护设备转发的连接报文。
步骤2，连接报文若是SYN同步报文，直接将SYN同步报文交由内核协议栈进行TCP连接处理。
步骤3，连接报文若是ACK应答报文，按照与防护设备约定的校验方式，对ACK应答报文进行SYN COOKIE校验。当校验通过时，则在内核协议栈中创建连接表项，从而根据ACK应答报文与客户端建立连接；当校验未通过时，将该ACK应答报文交由内核协议栈进行TCP连接处理。
实施例5：
根据本发明实施例，还提供了一种TCP连接的处理装置，该装置应用于连接设备。图9是根据本申请实施例的TCP连接的处理装置的示意图。
如图9所示，该装置可以包括：第二接收模块21、第三判断模块23、第二校验模块25和第一连接模块27。
其中，第二接收模块21，用于接收防护设备转发的用于与服务器端建立TCP连接的连接报文；第三判断模块23，用于判断接收到的连接报文的报文类型，其中，连接报文的报文类型至少包括：同步报文和应答报文；第二校验模块25，用于当连接报文的报文类型为应答报文时，按照预先设置的校验规则对应答报文进行校验；第一连接模块27，用于当应答报文校验通过时，利用应答报文与发送应答报文的客户端建立TCP连接。
具体的，通过上述第二接收模块21、第三判断模块23、第二校验模块25和第一连接模块27，连接设备在接收到防护设备转发的连接报文后，对连接报文的类型进行判断。当连接报文的报文类型为ACK应答报文时，对ACK应答报文按照预先设置的校验规则进行校验。当对应答报文校验通过时，利用ACK应答报文与客户端建立TCP连接；当对应答报文的校验未通过时，将ACK应答报文发送至内核协议栈，由内核协议栈做进一步处理。其中，校验规则与防护设备中的校验规则一致，可以通过SYN COOKIE的校验方式，对ACK应答报文进行验证，具体验证方法此处不做赘述。
作为一种可选的实施方式，上述装置还可以包括：第二连接模块24。其中，第二连接模块24，用于根据同步报文与客户端建立TCP连接。
具体的，当连接报文的报文类型为SYN同步报文时，通过第二连接模块24，利用SYN同步报文由连接设备直接与客户端建立TCP连接。
上述本发明实施例序号仅仅为了描述，不代表实施例的优劣。
在本发明的上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述的部分，可以参见其他实施例的相关描述。
在本申请所提供的几个实施例中，应该理解到，所揭露的技术内容，可通过其它的方式实现。其中，以上所描述的装置实施例仅仅是示意性的，例如所述单元的划分，可以为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，单元或模块的间接耦合或通信连接，可以是电性或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可为个人计算机、服务器或者网络设备等)执行本发明各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述仅是本发明的优选实施方式，应当指出，对于本技术领域的普通技术人员来说，在不脱离本发明原理的前提下，还可以做出若干改进和润饰，这些改进和润饰也应视为本发明的保护范围。

Claims (11)

  1. 一种TCP连接的处理方法，应用于防护设备，其特征在于，包括：
    接收客户端发送的用于与服务器端建立TCP连接的连接报文；
    判断接收到的所述连接报文的报文类型，其中，所述连接报文的报文类型至少包括：同步报文和应答报文；
    当所述连接报文的报文类型为所述应答报文时，利用连接校验信息对所述应答报文进行校验，其中，所述连接校验信息根据所述同步报文生成；
    当所述应答报文校验通过时，将所述应答报文转发至所述服务器端。
  2. 根据权利要求1所述的方法，其特征在于，当所述连接报文的报文类型为所述同步报文时，在判断接收到的所述连接报文的报文类型之后，所述方法还包括：
    统计在预先设置的预定时间内，接收到所述同步报文的报文数量；
    判断所述报文数量是否大于等于预先设置的阈值；
    当所述报文数量大于或等于所述阈值时，根据所述同步报文生成所述连接校验信息；
    当所述报文数量小于所述阈值时，将所述同步报文转发至所述服务器端。
  3. 根据权利要求1所述的方法，其特征在于，在当所述应答报文校验通过之后，所述方法还包括：
    获取发送所述应答报文的所述客户端的第一客户端地址；
    将所述第一客户端地址保存至预先创建的客户端地址表。
  4. 根据权利要求3所述的方法，其特征在于，在利用连接校验信息对所述应答报文进行校验之后，所述方法还包括：
    当所述应答报文校验未通过时，获取发送所述应答报文的所述客户端的第二客户端地址；
    将所述第二客户端地址与所述客户端地址表进行匹配；
    当所述第二客户端地址与所述客户端地址表中的地址匹配时，将所述应答报文转发至所述服务器端；
    当所述第二客户端地址与所述客户端地址表中的地址不匹配时，丢弃所述应答报文。
  5. 一种TCP连接的处理装置，应用于防护设备，其特征在于，包括：
    第一接收模块，用于接收客户端发送的用于与服务器端建立TCP连接的连接报文；
    第一判断模块，用于判断接收到的所述连接报文的报文类型，其中，所述连接报文的报文类型至少包括：同步报文和应答报文；
    第一校验模块，用于当所述连接报文的报文类型为所述应答报文时，利用连接校验信息对所述应答报文进行校验，其中，所述连接校验信息根据所述同步报文生成；
    第一转发模块，用于当所述应答报文校验通过时，将所述应答报文转发至所述服务器端。
  6. 根据权利要求5所述的装置，所述装置还包括：
    统计模块，用于统计在预先设置的预定时间内，接收到所述同步报文的报文数量；
    第二判断模块，用于判断所述报文数量是否大于等于预先设置的阈值；
    生成模块，用于当所述报文数量大于或等于所述阈值时，根据所述同步报文生成所述连接校验信息；
    第二转发模块，用于当所述报文数量小于所述阈值时，将所述同步报文转发至所述服务器端。
  7. 根据权利要求5所述的装置，其特征在于，所述装置还包括：
    第一获取模块，用于获取发送所述应答报文的所述客户端的第一客户端地址；
    存储模块，用于将所述第一客户端地址保存至预先创建的客户端地址表。
  8. 根据权利要求7所述的装置，其特征在于，所述装置还包括：
    第二获取模块，用于当所述应答报文校验未通过时，获取发送所述应答报文的所述客户端的第二客户端地址；
    匹配模块，用于将所述第二客户端地址与所述客户端地址表进行匹配；
    第三转发模块，用于当所述第二客户端地址与所述客户端地址表中的地址匹配时，将所述应答报文转发至所述服务器端；
    丢弃模块，用于当所述第二客户端地址与所述客户端地址表中的地址不匹配时，丢弃所述应答报文。
  9. 一种TCP连接的处理方法，应用于服务器端，其特征在于，包括：
    接收防护设备转发的用于与所述服务器端建立TCP连接的连接报文；
    判断接收到的所述连接报文的报文类型，其中，所述连接报文的报文类型至少包括：同步报文和应答报文；
    当所述连接报文的报文类型为所述应答报文时，按照预先设置的校验规则对所述应答报文进行校验；
    当所述应答报文校验通过时，利用所述应答报文与发送所述应答报文的客户端建立TCP连接。
  10. 一种TCP连接的处理装置，应用于服务器端，其特征在于，包括：
    第二接收模块，用于接收防护设备转发的用于与所述服务器端建立TCP连接的连接报文；
    第三判断模块，用于判断接收到的所述连接报文的报文类型，其中，所述连接报文的报文类型至少包括：同步报文和应答报文；
    第二校验模块，用于当所述连接报文的报文类型为所述应答报文时，按照预先设置的校验规则对所述应答报文进行校验；
    第一连接模块，用于当所述应答报文校验通过时，利用所述应答报文与发送所述应答报文的客户端建立TCP连接。
  11. 一种TCP连接的处理系统，其特征在于，包括：
    防护设备，通过互联网与客户端建立通讯连接，用于接收所述客户端发送的用于与服务器端建立TCP连接的连接报文，并判断接收到的所述连接报文的报文类型，其中，当所述连接报文的报文类型为应答报文时，利用连接校验信息对所述应答报文进行校验，当所述应答报文校验通过时，将所述应答报文转发至所述服务器端设置的连接设备；
    所述连接设备，设置于所述服务器端，分别与所述客户端和所述防护设备建 立通讯连接，用于接收所述防护设备转发的用于与所述服务器端建立TCP连接的连接报文，并判断接收到的所述连接报文的报文类型，其中，当所述连接报文的报文类型为所述应答报文时，按照预先设置的校验规则对所述应答报文进行校验，当所述应答报文校验通过时，利用所述应答报文与发送所述应答报文的客户端建立TCP连接。
PCT/CN2016/076786 2015-11-24 2016-03-18 Tcp连接的处理方法、装置及系统 WO2017088326A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP16867555.1A EP3361693B1 (en) 2015-11-24 2016-03-18 Tcp connection processing method, device and system
US15/766,567 US20180302434A1 (en) 2015-11-24 2016-03-18 Processing method, device and system for tcp connection

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510827413.1 2015-11-24
CN201510827413.1A CN105516080B (zh) 2015-11-24 2015-11-24 Tcp连接的处理方法、装置及系统

Publications (1)

Publication Number Publication Date
WO2017088326A1 true WO2017088326A1 (zh) 2017-06-01

Family

ID=55723718

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/076786 WO2017088326A1 (zh) 2015-11-24 2016-03-18 Tcp连接的处理方法、装置及系统

Country Status (4)

Country Link
US (1) US20180302434A1 (zh)
EP (1) EP3361693B1 (zh)
CN (1) CN105516080B (zh)
WO (1) WO2017088326A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114979237A (zh) * 2022-05-16 2022-08-30 咪咕文化科技有限公司 一种长连接验证方法、装置、设备及可读存储介质
CN116074401A (zh) * 2023-04-06 2023-05-05 合肥综合性国家科学中心人工智能研究院(安徽省人工智能实验室) 一种在可编程交换机上的传输层协议实现方法

Families Citing this family (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107026828B (zh) * 2016-02-02 2020-02-21 中国移动通信集团辽宁有限公司 一种基于互联网缓存的防盗链方法及互联网缓存
CN106685930B (zh) * 2016-12-06 2020-03-31 深信服科技股份有限公司 一种传输控制协议选项的处理方法及装置
CN106790310B (zh) * 2017-03-31 2021-02-02 网宿科技股份有限公司 分布式拒绝服务攻击防护与负载均衡一体化的方法和系统
CN110035041B (zh) * 2018-01-12 2020-11-17 华为技术有限公司 一种识别应用攻击源的方法和设备
CN108737413B (zh) * 2018-05-15 2021-08-24 奇安信科技集团股份有限公司 传输层的数据处理方法、装置及计算机可读存储介质
CN109413037B (zh) * 2018-09-12 2021-11-16 奇安信科技集团股份有限公司 一种Modbus业务处理方法及装置
CN108848196B (zh) * 2018-09-25 2021-01-26 四川长虹电器股份有限公司 一种基于tcp连接数的通用业务监控方法
CN109150919B (zh) * 2018-10-31 2021-06-08 北京天融信网络安全技术有限公司 一种网络防攻击的方法及网络设备
US11159652B2 (en) 2019-12-31 2021-10-26 Cloudflare, Inc. Transmission control protocol (TCP) intermediate device implementing a TCP fast open (TFO) connection
US11349934B2 (en) * 2019-12-31 2022-05-31 Cloudflare, Inc. Opportunistic transmission control protocol (TCP) connection establishment
CN111314447B (zh) * 2020-02-03 2023-01-31 杭州迪普科技股份有限公司 代理服务器及其处理访问请求的方法
CN112165447B (zh) * 2020-08-21 2023-12-19 杭州安恒信息技术股份有限公司 基于waf设备的网络安全监测方法、系统和电子装置
CN112055028B (zh) * 2020-09-11 2023-08-08 北京知道创宇信息技术股份有限公司 网络攻击防御方法、装置、电子设备及存储介质
CN112565307B (zh) * 2021-02-25 2021-05-25 清华大学 一种对DDoS攻击进行入口管控的方法及装置
CN114301653B (zh) * 2021-12-22 2024-02-02 山石网科通信技术股份有限公司 抵御半连接攻击的方法、装置、存储介质以及处理器

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060230129A1 (en) * 2005-02-04 2006-10-12 Nokia Corporation Apparatus, method and computer program product to reduce TCP flooding attacks while conserving wireless network bandwidth
CN101436958A (zh) * 2007-11-16 2009-05-20 太极计算机股份有限公司 抵御拒绝服务攻击的方法
CN101478537A (zh) * 2008-12-31 2009-07-08 成都市华为赛门铁克科技有限公司 一种单向环境中的网络安全防护方法和装置
CN101594359A (zh) * 2009-07-01 2009-12-02 杭州华三通信技术有限公司 防御传输控制协议同步洪泛攻击方法及传输控制协议代理
CN102780688A (zh) * 2012-04-26 2012-11-14 华为技术有限公司 在传输控制协议tcp下防止攻击的方法和装置
CN103475657A (zh) * 2013-09-10 2013-12-25 网神信息技术（北京）股份有限公司 防syn泛洪攻击的处理方法和装置

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8224976B2 (en) * 2008-12-24 2012-07-17 Juniper Networks, Inc. Using a server's capability profile to establish a connection
CN102427452B (zh) * 2011-12-06 2014-07-30 北京星网锐捷网络技术有限公司 同步报文发送方法、装置和网络设备
US9027129B1 (en) * 2012-04-30 2015-05-05 Brocade Communications Systems, Inc. Techniques for protecting against denial of service attacks
WO2014087738A1 (ja) * 2012-12-05 2014-06-12 ソニー株式会社 情報処理装置、検証処理装置、情報処理方法、検証処理方法、およびプログラム
US8978138B2 (en) * 2013-03-15 2015-03-10 Mehdi Mahvi TCP validation via systematic transmission regulation and regeneration
CN103546486A (zh) * 2013-11-04 2014-01-29 北京荣之联科技股份有限公司 一种防DDOS攻击的SYN Cookie源认证方法及其装置
US9628503B2 (en) * 2014-01-17 2017-04-18 F5 Networks, Inc. Systems and methods for network destination based flood attack mitigation

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060230129A1 (en) * 2005-02-04 2006-10-12 Nokia Corporation Apparatus, method and computer program product to reduce TCP flooding attacks while conserving wireless network bandwidth
CN101436958A (zh) * 2007-11-16 2009-05-20 太极计算机股份有限公司 抵御拒绝服务攻击的方法
CN101478537A (zh) * 2008-12-31 2009-07-08 成都市华为赛门铁克科技有限公司 一种单向环境中的网络安全防护方法和装置
CN101594359A (zh) * 2009-07-01 2009-12-02 杭州华三通信技术有限公司 防御传输控制协议同步洪泛攻击方法及传输控制协议代理
CN102780688A (zh) * 2012-04-26 2012-11-14 华为技术有限公司 在传输控制协议tcp下防止攻击的方法和装置
CN103475657A (zh) * 2013-09-10 2013-12-25 网神信息技术（北京）股份有限公司 防syn泛洪攻击的处理方法和装置

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114979237A (zh) * 2022-05-16 2022-08-30 咪咕文化科技有限公司 一种长连接验证方法、装置、设备及可读存储介质
CN114979237B (zh) * 2022-05-16 2024-05-24 咪咕文化科技有限公司 一种长连接验证方法、装置、设备及可读存储介质
CN116074401A (zh) * 2023-04-06 2023-05-05 合肥综合性国家科学中心人工智能研究院(安徽省人工智能实验室) 一种在可编程交换机上的传输层协议实现方法
CN116074401B (zh) * 2023-04-06 2023-07-18 合肥综合性国家科学中心人工智能研究院(安徽省人工智能实验室) 一种在可编程交换机上的传输层协议实现方法

Also Published As

Publication number Publication date
CN105516080B (zh) 2019-03-15
EP3361693A4 (en) 2018-10-31
US20180302434A1 (en) 2018-10-18
CN105516080A (zh) 2016-04-20
EP3361693A1 (en) 2018-08-15
EP3361693B1 (en) 2019-12-25

Similar Documents

Publication Publication Date Title
WO2017088326A1 (zh) Tcp连接的处理方法、装置及系统
WO2021008028A1 (zh) 网络攻击源定位及防护方法、电子设备及计算机存储介质
CN105827646B (zh) Syn攻击防护的方法及装置
US9628441B2 (en) Attack defense method and device
CN108173812B (zh) 防止网络攻击的方法、装置、存储介质和设备
US20130055375A1 (en) Method and Protection System for Mitigating Slow HTTP Attacks Using Rate and Time Monitoring
CN107547503B (zh) 一种会话表项处理方法、装置、防火墙设备及存储介质
US20120227088A1 (en) Method for authenticating communication traffic, communication system and protective apparatus
US10505952B2 (en) Attack detection device, attack detection method, and attack detection program
JP6435695B2 (ja) コントローラ，及びその攻撃者検知方法
CN110519265B (zh) 一种防御攻击的方法及装置
CN110266678B (zh) 安全攻击检测方法、装置、计算机设备及存储介质
WO2008131658A1 (fr) Procédé et dispositif pour fureter le dhcp
WO2020037781A1 (zh) 一种实现服务器防攻击方法及装置
WO2019085923A1 (zh) 数据处理方法、装置及计算机
US20230275924A1 (en) Network security protection method and protection device
CN108737344B (zh) 一种网络攻击防护方法和装置
WO2019096104A1 (zh) 攻击防范
WO2008131650A1 (fr) Procédé de furetage de dhcp et dispositif associé
WO2017071511A1 (zh) 防攻击数据传输方法及装置
CN109818912B (zh) 防范泛洪攻击的方法、装置、负载均衡设备和存储介质
WO2019242053A1 (zh) 一种针对HTTP Flood攻击的防护方法及系统
US10182071B2 (en) Probabilistic tracking of host characteristics
JP2007074087A (ja) ＤＤｏＳ攻撃に対する不正アクセス検知システム及びプログラム
KR20180102884A (ko) 방화벽 및 이의 패킷 처리 방법

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16867555

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 15766567

Country of ref document: US

WWE Wipo information: entry into national phase

Ref document number: 2016867555

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE