System and method for an adaptive TCP SYN cookie with time validation

A system for TCP SYN cookie validation at a host server comprising:

• a session SYN packet receiver for receiving a session SYN packet;
• a transition cookie generator operating to generate a transition cookie with the use of a transition cookie secret key, the transition cookie comprising a time value representing the actual time, wherein the transition cookie generator generates the transition cookie by (i) generating an encrypted data element of the generator by applying a cryptographic method on the transition cookie secret key and a transition cookie data element, (ii) performing an unsigned binary addition on the encrypted data element of the generator and a sequence number of a TCP header in the received session SYN packet, and (iii) storing the result in the transition cookie;
• a session SYN/ACK packet sender for sending the transition cookie in response to the received session SYN packet;
• a session ACK packet receiver for receiving a session ACK packet, the session ACK packet including a candidate transition cookie;
• and
• a transition cookie validator, for determining whether the candidate transition cookie in the received session ACK packet comprises a time value representing a time within a predetermined time interval from the time the session ACK packet is received.

A system for TCP SYN cookie validation at a host server comprising:

• a session SYN packet receiver for receiving a session SYN packet;
• a transition cookie generator operating to generate a transition cookie with the use of a transition cookie secret key, the transition cookie comprising a time value representing the actual time;
• a session SYN/ACK packet sender for sending the transition cookie in response to the received session SYN packet;
• a session ACK packet receiver for receiving a session ACK packet, the session ACK packet including a candidate transition cookie;
• and
• a transition cookie validator, for determining whether the candidate transition cookie in the received session ACK packet comprises a time value representing a time within a predetermined time interval from the time the session ACK packet is received, wherein the transition cookie validator generates:
• a candidate sequence number such that a sequence number of a TCP header in the received session ACK packet equals the sum of the candidate sequence number and a value of 1,
• a candidate encrypted data element such that the result of performing an unsigned binary addition of the candidate encrypted data element and a candidate sequence number equals the candidate transition cookie, and
• a candidate transition cookie data element by applying a cryptographic method on a candidate transition cookie secret key and the candidate encrypted data element.

A system for TCP SYN cookie validation at a host server, the system comprising:

• a session SYN packet receiver hardware configured to receive a session SYN packet;
• a transition cookie generator hardware configured to generate a transition cookie using a transition cookie secret key, the transition cookie comprising a time value representing the actual time, wherein the transition cookie generator hardware generates the transition cookie secret key based on data obtained from the received session SYN packet, wherein the transition cookie generator hardware generates the transition cookie secret key by:
• (i) generating an encrypted data element of the transition cookie generator hardware by applying a cryptographic method on the transition cookie secret key and a transition cookie data element;
• (ii) performing an unsigned binary addition on the encrypted data element of the transition cookie generator hardware and a sequence number of a TCP header in the session SYN packet to obtain a result;
• and
• (iii) storing the result in the transition cookie;
• a session SYN/ACK packet sender hardware configured to send the transition cookie in response to the received session SYN packet;
• a session ACK packet receiver hardware configured to receive a session ACK packet including a candidate transition cookie;
• and
• a transition cookie validator hardware configured to determine whether the candidate transition cookie in the received session ACK packet comprises a time value representing a time within a predetermined time interval from the time the session ACK packet is received, wherein the transition cookie validator hardware generates a candidate transition cookie secret key based on data obtained from the received session ACK packet.

A host for validating a TCP SYN cookie, comprising:

• a memory device storing instructions;
• and
• a processor that, when executing the instructions, configures the host to:
• receive a session SYN packet;
• generate a transition cookie using a transition cookie secret key, the transition cookie comprising a time value representing the actual time, the transition cookie secret key being generated based on data obtained from the session SYN packet, the transition cookie secret key being generated by:
• (i) generating an encrypted data element by applying a cryptographic method on the transition cookie secret key and a transition cookie data element;
• (ii) performing an unsigned binary addition on the encrypted data element and a sequence number of a TCP header in the session SYN packet to obtain a result;
• and
• (iii) storing the result in the transition cookie;
• send the transition cookie in response to the received session SYN packet;
• receive a session ACK packet including a candidate transition cookie;
• and
• determine whether the candidate transition cookie in the received session ACK packet comprises a time value representing a time within a predetermined time interval from the time the session ACK packet is received, wherein the processor generates a candidate transition cookie secret key based on data obtained from the received session ACK packet.

A non-transitory computer-readable medium storing instructions that, when executed, cause a computing device to perform a method for validating a TCP SYN cookie, the method comprising:

• receiving a session SYN packet;
• generating a transition cookie using a transition cookie secret key, the transition cookie comprising a time value representing the actual time, the transition cookie secret key being generated based on data obtained from the session SYN packet, the transition cookie secret key being generated by:
• (i) generating an encrypted data element by applying a cryptographic method on the transition cookie secret key and a transition cookie data element;
• (ii) performing an unsigned binary addition on the encrypted data element and a sequence number of a TCP header in the session SYN packet to obtain a result;
• and
• (iii) storing the result in the transition cookie;
• sending the transition cookie in response to the received session SYN packet;
• receiving a session ACK packet including a candidate transition cookie;
• and
• determining whether the candidate transition cookie in the received session ACK packet comprises a time value representing a time within a predetermined time interval from the time the session ACK packet is received, wherein a candidate transition cookie secret key is generated based on data obtained from the received session ACK packet.