Preventing network data injection attacks using duplicate-ACK and reassembly gap approaches

A method of preventing an attack on a network, wherein the attack comprises injecting a spurious transmission control protocol (TCP) segment into a TCP connection between a sender and a receiver, the method comprising the computer-implemented steps of:

• receiving a particular TCP segment;
• determining a sequence value gap as between the particular TCP segment and a prior TCP segment previously placed in a re-assembly buffer maintained by the receiver;
• determining whether the sequence value gap is too large according to a specified heuristic;
• if the sequence value gap is too large, then performing the steps of:
• creating and sending a dummy segment carrying a particular sequence value that is just prior to a last properly acknowledged sequence value;
• receiving an acknowledgment of the dummy segment;
• determining whether a second sequence value carried in the acknowledgment is less than a third sequence value of the first TCP segment;
• and
• discarding the particular TCP segment from the re-assembly buffer when the
• second sequence value carried in the acknowledgment is less than the third sequence value of the particular TCP segment.

An apparatus for preventing an attack on a network, wherein the attack comprises sending a spurious transmission control protocol (TCP) segment with spurious or unwanted DATA segment, comprising:

• a processor;
• one or more stored sequences of instructions that are accessible to the processor and which, when executed by the processor, cause the processor to perform:
• receiving a duplicate TCP ACK message;
• incrementing a false duplicate ACK counter when a TCP re-transmission buffer maintained by the receiver is empty;
• when the false duplicate ACK counter is equal to a specified strike factor, and only when a TCP re-transmission buffer maintained by the receiver is empty, sending a corrective ACK message that provides a correct sequence value and ACK value.

An apparatus for preventing an attack on a network, wherein the attack comprises injecting a spurious transmission control protocol (TCP) segment into a TCP connection between a sender and a receiver, comprising:

• means for receiving a particular TCP segment;
• means for determining a sequence value gap as between the particular TCP segment and a prior TCP segment previously placed in a re-assembly buffer maintained by the receiver;
• means for determining whether the sequence value gap is too large according to a specified heuristic;
• means operable when the sequence value gap is too large for creating and sending a dununy segment carrying a particular sequence value that is just prior to a last properly acknowledged sequence value, for receiving an acknowledgment of the dummy segment, for determining whether a second sequence value carried in the acknowledgment is less than a third sequence value of the first TCP segment, and for discarding the particular TCP segment from the re-assembly buffer when the second sequence value carried in the acknowledgment is less than the third sequence value of the particular TCP segment.

An apparatus for preventing an attack on a network, wherein the attack comprises injecting a spurious transmission control protocol (TCP) segment into a TCP connection between a sender and a receiver, comprising:

• a processor;
• one or more stored sequences of instructions that are accessible to the processor and which, when executed by the processor, cause the processor to perform:
• receiving a particular TCP segment;
• determining a sequence value gap as between the particular TCP segment and a prior TCP segment previously placed in a re-assembly buffer maintained by the receiver;
• determining whether the sequence value gap is too large according to a specified heuristic;
• when the sequence value gap is too large, creating and sending a dummy segment carrying a particular sequence value that is just prior to a last properly acknowledged sequence value, receiving an acknowledgment of the dummy segment, determining whether a second sequence value carried in the acknowledgment is less than a third sequence value of the first TCP segment, and discarding the particular TCP segment from the re-assembly buffer when the second sequence value carried in the acknowledgment is less than the third sequence value of the particular TCP segment.