Back to results
US 10,834,126 B2Granted
Method and system for processing forged TCP packet
AssigneeWangsu Science & Technology Co., Ltd.
InventorHong Chen
Life of this patent
Estimating the term…
Abstract
A method for processing forged TCP packets is provided. The method utilizes a window size field in a header of a to-be-processed TCP packet and a window scaling factor to calculate a receive window value of the TCP packet for comparison with an actual receive window value. Further, based on a degree of deviation between the comparison result and a threshold, whether the to-be-processed TCP packet is forged is determined, such that the probability of finding and discarding the forged TCP packet is improved.
Claims17
A method for processing forged TCP packets, comprising:
- receiving a to-be-processed TCP packet, wherein a header of the to-be-processed TCP packet includes a window size field;
- based on the to-be-processed TCP packet, searching a TCP receive window reference table to find out whether a record related to the to-be-processed TCP packet exists;
- when the record related to the to-be-processed TCP packet exists in the TCP receive window reference table, calculating a receive window value of the to-be-processed TCP packet from the window size field in the header of the to-be-processed TCP packet and a receive window scaling factor field in the record related to the to-be-processed TCP packet;
- comparing the receive window value of the to-be-processed TCP packet with an actual receive window value in the record related to the to-be-processed TCP packet to obtain a deviation therebetween;
- and
- comparing the deviation with a preset threshold to determine whether the to-be-processed TCP packet is a forged TCP packet.
3 more elements
A system for processing forged TCP packets, comprising:
- a device for receiving a to-be-processed TCP packet, wherein a header of the to-be-processed TCP packet includes a window size field;
- the device for, based on the to-be-processed TCP packet, searching a TCP receive window reference table to find out whether a record related to the to-be-processed TCP packet exists;
- the device for, when the record related to the to-be-processed TCP packet exists in the TCP receive window reference table, calculating a receive window value of the to-be-processed TCP packet from the window size field in the header of the to-be-processed TCP packet and a receive window scaling factor field in the record related to the to-be-processed TCP packet;
- the device for comparing the receive window value of the to-be-processed TCP packet and an actual receive window value in the record related to the to-be-processed TCP packet to obtain a deviation therebetween;
- and
- the device for comparing the deviation with a preset threshold to determine whether the to-be-processed TCP packet is a forged TCP packet.
3 more elements
Dependencies are inferred from the claim text.