一种基于无状态连接请求验证的SYN湮没攻击防御方法  

Novel Method of Defeding SYN Flooding Attack Based on State-Less Connection Authentication

作　　者：黄鑫[1] 尹宝林[1] 

机构地区：[1]北京航空航天大学计算机学院,北京100083

出　　处：《小型微型计算机系统》2005年第11期1923-1927,共5页Journal of Chinese Computer Systems

基　　金：武器装备预研基金项目(51415020201HK01)资助

摘　　要：已有SYN湮没攻击检测防御技术存在一个共性缺陷,就是在验证连接请求有效前分配一定的系统资源保存连接状态.基于无状态连接请求验证的方法可以有效地解决这一问题,但已有的方法存在验证有效后无法完整建立TCP连接、通讯双方状态不一致等问题.本文提出一种新的基于无状态连接请求验证的网关级SYN湮没攻击防御方法,该方法在解决已有问题并兼容现有TCP/IP协议栈实现的基础上,可实现对不同操作系统SYN湮没攻击的有效防御.The current detecting and defending technologies against SYN flooding attack have a common shortage which needs to allocate some system resources to save the state information before the TCP connection request is authenticated. The known state-less authentication method can solve the above problem, but unfortunately it still has some limitations which can not accommodate the system with integrated state information which is necessary to the TCP connection process and make the state variance between the client and server. A new state-less authentication method is proposed in this paper to defend SYN flood- ing attack in gateway, which can eliminate the above-mentioned drawbacks. The new mechanism can be compatible with the standard of TCP/IP protocol stack and protect all kinds of operating systems in gateway near to victim.

关 键 词：SYN湮没攻击 拒绝服务 半打开连接 网关 连接验证 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]