Blended SYN cookies

• US 20030135625A1
• Filed: 01/15/2002
• Published: 07/17/2003
• Est. Priority Date: 01/15/2002
• Status: Active Grant

• Current Assignee: Trend Micro Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Fontes, Stephen M., Hind, John R., Stockton, Marcia L., Narten, Thomas
• Granted Patent: US 7,058,718 B2
• Time in Patent Office: Days
• US Class Current: 709/228
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/163 In-band adaptation of TCP data exchange; In-band control procedures

Abstract

A method of producing a blended SYN cookie can include identifying within a SYN packet a source network address and desired communications session parameters. Subsequently, an index value into a table of pre-configured sets of communications session parameters can be retrieved. Notably, the index value can reference one of the sets which approximates the desired communications parameters. A hash value can be computed based upon the source network address, a constant seed and current date and time data. Finally, the computed hash value can be combined with the index value, the combination forming the blended SYN cookie.

Claims

1. A method of producing a blended synchronization (SYN) cookie for use in a three-way handshake process comprising the steps of:

identifying within a SYN packet a source network address and desired communications session parameters;

retrieving an index value into a table of pre-configured sets of communications session parameters, said index value referencing one of said sets which approximates said desired communications parameters;

computing a hash value based upon said source network address, a constant seed and current date and time data; and

,

combining said computed hash value with said index value, said combination forming the blended SYN cookie.

2. The method of claim 1, wherein said combining step comprises:

reducing said computed hash value by N most significant binary digits to accommodate N binary digits required to represent said index value; and

,

combining said reduced hash value with said index value, said combination forming the blended SYN cookie.

3. A three-way handshake method, the three-way handshake comprising an initial request, an intermediate response to the initial request, and a final acknowledgment of the intermediate response, the method comprising the steps of:

extracting synchronization data from the initial request;

storing said synchronization data in a fixed length, wrap-around table;

based upon session parameters contained in said synchronization data, acquiring an index into a table of pre-configured sets of session parameters;

computing an initial hash value based upon at least part of said synchronization data;

combining said initial hash value and said acquired index and placing said combination into the intermediate response to the initial request; and

,

responsive to receiving the final acknowledgment of the intermediate response, extracting acknowledgment data from the final acknowledgment, identifying said initial hash value in said acknowledgment data, computing a new hash value based upon at least part of said acknowledgment data, comparing said new hash value with said initial hash value, and if said hash values do not match, discarding the final acknowledgment.

4. The three-way handshake method of claim 3, further comprising the step of, if said hash values match, locating said session parameters in said fixed length, wraparound table and establishing a communications session using said located session parameters.

5. The three-way handshake method of claim 4, further comprising the step of, if said session parameters cannot be located, identifying said acquired index in said acknowledgment data, retrieving a pre-configured set of communication parameters based upon said acquired index, and establishing a communications session using said located session parameters.

6. The three-way handshake method of claim 5, wherein said establishing step comprises:

adding a mapping in a network address translation (NAT) process between a source end-point of the initial request and a destination end-point specified in said synchronization data;

performing a three-way handshake with said destination end-point, said three-way handshake comprising the steps of generating a SYN request containing data reconstructed from said initial request, receiving a SYN/ACK response, computing a server packet sequence number offset based upon a sequence number specified in said SYN/ACK and said combination;

modifying said acknowledgment data with said offset, and forwarding said acknowledgment data as an ACK to said destination end-point, said three-way handshake establishing a communications link between said source and destination end-points; and

,

routing data in said NAT between said source and destination end-points.

7. The three-way handshake method of claim 3, further comprising the steps of:

observing said session parameters in said synchronization data; and

,

tuning said table of pre-configured sets of session parameters based upon said observed session parameters.

8. A communications handshake system comprising:

a communications process configured to receive and respond to requests to establish data communications sessions, said requests comprising synchronization (SYN) packets and acknowledgment (ACK) packets;

a fixed length, wrap-around table configured to store desired session parameters extracted from said SYN packets;

a table of pre-configured session parameters which can be used to approximate said desired session parameters; and

,

a blended SYN cookie generator configured to combine SYN cookies with an index into said table of pre-configured session parameters, said index referencing a set of pre-configured session parameters which approximate corresponding ones of said desired session parameters;

whereby said communications process both can authenticate said ACK packets by comparing hash values contained in said SYN cookies with hash values generated in response to receiving said ACK packets, and also can establish said data communication sessions using said desired session parameters in said fixed length, wrap-around table, or said approximated session parameters where said desired session parameters are not found in said fixed length wrap-around table.

9. The communications handshake system of claim 8, further comprising a network address translator configured to perform network address translation between end-points in said established communications sessions.

10. The communications handshake system of claim 8, wherein said SYN cookie comprises a hash value computed from a network address, a seed value and a date and time value.

11. A machine readable storage having stored thereon a computer program for performing a three-way handshake method, the three-way handshake comprising an initial request, an intermediate response to the initial request, and a final acknowledgment of the intermediate response, the computer program comprising a routine set of instructions for causing the machine to perform the steps of:

extracting synchronization data from the initial request;

storing said synchronization data in a fixed length, wrap-around table;

based upon session parameters contained in said synchronization data, acquiring an index into a table of pre-configured sets of session parameters;

computing an initial hash value based upon at least part of said synchronization data;

combining said initial hash value and said acquired index and placing said combination into the intermediate response to the initial request; and

,

responsive to receiving the final acknowledgment of the intermediate response, extracting acknowledgment data from the final acknowledgment, identifying said initial hash value in said acknowledgment data, computing a new hash value based upon at least part of said acknowledgment data, comparing said new hash value with said initial hash value, and if said hash values do not match, discarding the final acknowledgment.

12. The machine readable storage of claim 11, further comprising, if said hash values match, locating said session parameters in said fixed length, wrap-around table and establishing a communications session using said located session parameters.

13. The machine readable storage of claim 12, further comprising, if said session parameters cannot be located, identifying said acquired index in said acknowledgment data, retrieving a pre-configured set of communication parameters based upon said acquired index, and establishing a communications session using said located session parameters.

14. The machine readable storage of claim 13, wherein said establishing step comprises:

adding a mapping in a network address translation (NAT) process between a source end-point of the initial request and a destination end-point specified in said synchronization data;

performing a three-way handshake with said destination end-point, said three-way handshake comprising the steps of generating a SYN request containing data reconstructed from said initial request, receiving a SYN/ACK response, computing a server packet sequence number offset based upon a sequence number specified in said SYN/ACK and said combination;

modifying said acknowledgment data with said offset, and forwarding said acknowledgment data as an ACK to said destination end-point, said three-way handshake establishing a communications link between said source and destination end-points; and

,

routing data in said NAT between said source and destination end-points.

15. The machine readable storage of claim 11, further comprising the steps of:

observing said session parameters in said synchronization data; and

,

tuning said table of pre-configured sets of session parameters based upon said observed session parameters.

16. A blended SYN cookie article of manufacture, comprising:

an index value into a table of pre-configured sets of communications session parameters, said index value referencing one of said sets which approximates specified communications parameters; and

,

a hash value combined with said index value, said hash value comprising a hash of a network address, a constant seed and current date and time data.

17. The blended SYN cookie article of manufacture of claim 16, wherein said hash value comprises the N most significant binary digits of said hash value, wherein N is computed based upon a number of binary digits required to represent said index value.