US 2019/0058730 A1 · SYSTEM AND METHOD TO SPOOF A TCP RESET FOR AN OUT-OF-BAND SECURITY DEVICE

Abstract

Systems and methods are provided to reset a TCP connection such as in response to a security policy violation. To address reset conditions under RFC 5961, for example, TCP RST segments may be spoofed and injected into communications between endpoints (e.g. client and server). In one example, three segments may be spoofed with two having respective predicted sequence numbers to invoke a reset and the third having a sequence number to invoke a challenge ACK. If a challenge ACK is received, one or more additional TCP RST segments may be injected using segment information from the challenge ACK to predict new sequence numbers, one to invoke a reset and the other, if used, to invoke a further challenge ACK. Further responsive pairs of additional TCP RST segments may be sent in response to any further challenge ACK observed until the reset is successful.

Claims22

Dependent claims

A computing device comprising hardware and/or software to inject spoofed Transmission Control Protocol (TCP) RST (reset) segments into communication traffic between sender and receiver endpoints of a TCP connection, the computing device configured to:

define spoofed TCP RST segments (RST-SEG_1, RST-SEG_2) to inject into the traffic to communicate to the receiver endpoint, each having a predicted sequence number (SEQ) determined using observed segments of traffic between the endpoints, such that:
RST-SEG_1.SEQ=SEG.SEQ;
and
RST-SEG_2.SEQ=SEG.SEQ+SEG.LEN;
where SEG represents that last segment observed from the sending endpoint and SEG.LEN is a segment length of SEG;
and
inject segments RST-SEG_1, RST-SEG_2 for communication to the receiver endpoint.

4 more elements

Dependencies are inferred from the claim text.

System and method to spoof a tcp reset for an out-of-band security device

Life of this patent

System and method to spoof a tcp reset for an out-of-band security device

Life of this patent

Abstract

Claims22