Method and apparatus for fault tolerant TCP handshaking

• US 20020157037A1
• Filed: 03/25/2002
• Published: 10/24/2002
• Est. Priority Date: 03/29/2001
• Status: Active Grant

• Current Assignee: Nokia Corporation
• Original Assignee: Nokia Corporation
• Inventors: Cain, Adam, Kroeger, Thomas, Watkins, Craig, Kashtan, David
• Granted Patent: US 7,454,614 B2
• Time in Patent Office: Days
• US Class Current: 714/4
• CPC Class Codes: H04L 1/1607 Details of the supervisory signal
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Abstract

Method and apparatus for fault tolerant TCP handshaking that includes a first node and a second node both connected in a network where the second node is one of at least two nodes in a cluster of nodes. The second node receives a first message from the first node where the first message includes a sequence number. The second node generates a fingerprint and replaces a portion of the sequence number with the fingerprint to form a cryptographic sequence number. The cryptographic sequence number is sent from the second node to the first node. A second message that includes the cryptographic sequence number is received from the first node at the second node. Any node in the cluster can verify that the cryptographic sequence number sent by the first node was created by one of the nodes in the cluster thereby providing fault tolerant TCP handshaking.

Claims

1. A method for fault tolerant TCP handshaking comprising:

receiving a first message from a first node in a network at a second node in the network, the second node being one of at least two nodes in a cluster of nodes, the first message including a sequence number;

generating a fingerprint;

replacing a portion of the sequence number with the fingerprint to form a cryptographic sequence number;

sending the cryptographic sequence number from the second node to the first so node; and

receiving a second message from the first node at the second node, the second message including the cryptographic sequence number,

wherein any node in the cluster can verify that the cryptographic sequence number sent by the first node was created by one of the nodes in the cluster thereby providing fault tolerant TCP handshaking.

2. The method according to claim 1, wherein the first message comprises a SYN message.

3. The method according to claim 1, further comprising generating the fingerprint using an Internet Protocol (IP) address of the first node, a port of the first node, a port of the second node, an IP address of the second node, and a cluster secret.

4. The method according to claim 3, further comprising generating the fingerprint by performing a hash function on the IP address of the first node, the port of the first node, the port of the second node, the IP address of the second node, and the cluster secret.

5. The method according to claim 3, wherein the cluster secret comprises a private key of the nodes in the cluster.

6. The method according to claim 4, wherein the hash function comprises an MD5 hash.

7. The method according to claim 1, wherein the second message comprises an acknowledge message.

8. The method according to claim 3, further comprising changing the cluster secret at periodic intervals.

9. The method according to claim 8, further comprising changing the cluster secret every two minutes.

10. The method according to claim 4, further comprising generating the fingerprint using the result from the hash function mixed with some random bits.

11. A system for fault tolerant TCP handshaking comprising:

a first node, the first node operably connected to a network; and

a second node, the second node being one of at least two nodes in a cluster of nodes operably connected to the network, the second node;

receiving a first message that includes a sequence number from the first node, generating a fingerprint, replacing a portion of the sequence number with the fingerprint to form a cryptographic sequence number, and sending the cryptographic sequence number from the second node to the first node,

wherein a second message including the cryptographic sequence number may be received from the first node at the second node, any node in the cluster capable of verifying that the cryptographic sequence number sent by the first node was created by one of the nodes in the cluster thereby providing fault tolerant TCP handshaking.

12. The system according to claim 11, wherein the second node generates the fingerprint using an Internet Protocol (IP) address of the first node, a port of the first node, a port of the second node, an IP address of the second node, and a cluster secret.

13. The system according to claim 12, wherein the second node generates the fingerprint by performing a hash function on the IP address of the first node, the port of the first node, the port of the second node, the IP address of the second node, and the cluster secret.

14. The system according to claim 12, wherein the cluster secret comprises a private key of the nodes in the cluster.

15. The system according to claim 11, wherein the first message comprises a SYN message.

16. The system according to claim 11, wherein the second message comprises an Acknowledge message.

18. The apparatus according to claim 17, wherein the fingerprint is generated using an Internet Protocol (IP) address of the first node, a port of the first node, a port of the second node, an IP address of the second node, and a cluster secret.

19. The apparatus according to claim 18, wherein the fingerprint is generated by performing a hash function on the IP address of the first node, the port of the first node, the port of the second node, the IP address of the second node, and the cluster secret.

20. The apparatus according to claim 18, wherein the cluster secret comprises a private key of the nodes in the cluster.

21. The apparatus according to claim 17, wherein the first message comprises a SYN message.

22. The apparatus according to claim 17, wherein the second message comprises an Acknowledge message.

17. An apparatus comprising a storage medium with instructions stored therein, the instructions when executed causing a computing device to perform:

receiving a first message from a node in a network, the first message including a sequence number;

generating a fingerprint;

replacing a portion of the sequence number with the fingerprint to form a cryptographic sequence number;

sending the cryptographic sequence number to the node; and

receiving a second message from the node, the second message including the cryptographic sequence number,

wherein the cryptographic sequence number may be verified as having been created by one of at least two nodes in a cluster thereby providing fault tolerant TCP handshaking.