Protection against denial of service attacks

A method for protecting at least one target server computer from denial of services attacks launched by at least one source client computer, the method comprising:

• receiving a first packet destined for the at least one target server computer, the first packet being part of a handshake process for requesting establishment of a connection between the source client computer and the target server computer, wherein said first packet comprises one selected from a group consisting of:
• TCP packet and non-TCP packet;
• generating a sequence number comprising an encrypted code produced by a function combining the source client computer's address and port number, the target server computer's address and port number, the source client computer's initial sequence number and a time measurement, wherein the sequence number is generated by a hardware crypto engine;
• sending the source client computer a second packet including the sequence number generated by the hardware crypto engine;
• receiving a third packet from the source client computer;
• validating the sequence number of the third packet, wherein the hardware crypto engine is used to validate the sequence number;
• storing information from the packet header in a lookup table so that subsequently received packets that purport to be part of an established connection can be validated by using a fast hardware lookup engine to access the lookup table and comparing identifying information in the packet with the entries in the lookup table;
• temporarily storing incoming non-TCP packets in a buffer;
• passing the non-TCP packets to the protected server at a limited rate;
• and
• opening a connection from the source client computer to the target server computer and passing data over the connection only when it is determined that the third packet is valid.

A computer readable storage medium for execution by an information processing system for protecting at least one target server computer from denial of services attacks launched by at least one source client computer, the medium comprising instructions for:

• receiving a first packet destined for the at least one target server computer, the packet being part of a handshake process for requesting establishment of a connection between the source client computer and the target server computer;
• wherein the first packet comprises one selected from a group consisting of:
• TCP packet and non-TCP packet;
• generating a sequence number comprising an encrypted code produced by a function combining the source client computer's address and port number, the target server computer's address and port number, the source client computer's initial sequence number and a time measurement, wherein the sequence number is generated by a hardware crypto engine;
• sending the source client computer a second packet including the sequence number generated by the hardware crypto engine;
• receiving a third packet from the source client computer;
• validating the sequence number of the third packet, wherein the hardware crypto engine is used to validate the sequence number;
• storing the tuple of information from the packet header in a lookup table so that subsequently received packets that purport to be part of the connection can be validated by using a fast hardware lookup engine to access the lookup table and comparing identifying information in the packet with the entries in the lookup table;
• opening a connection from the source client computer to the target server computer;
• temporarily storing incoming non-TCP packets in a buffer;
• passing the non-TCP packets to the protected server at a limited rate;
• and
• passing data over the connection only when it is determined that the third packet is valid.