Method for packet processing, electronic device and storage medium

Patent metadata

Field	Value
Publication number	US-9313225-B2
Application number	US-201314388989-A
Country	US
Kind code	B2
Filing date	Aug 7, 2013
Priority date	Nov 1, 2012
Publication date	Apr 12, 2016
Grant date	Apr 12, 2016

Abstract

A method for processing packets, an electronic device and a storage medium are proposed. The present invention presets a defense module preventing DoS in the mobile terminal. A connection requesting side establishes connection with the defense module according to three-handshake principle of TCP, and a defense module sends a SYN packet to a mobile terminal as the connection requesting side. When the defense module successfully handshakes with the mobile terminal, connection between the connection requesting side and the mobile terminal is created, so that DoS attack, especially SYN attack can be effectively prevented. When mobile terminals, especially mobile phones are network hotspot, attack on internal mobile terminal from external network can be effectively prevented.

First claim

What is claimed is:

1. A method for packet processing, comprising:
when receiving a first handshake (SYN) packet of connection request from a connection requesting side, establishing a first handshake-acknowledge (SYN-ACK) packet using a defense module of a hardware memory of an electronic device, and responding the connection requesting side by sending the first handshake-acknowledge packet to the connection requesting side;
when receiving a first acknowledging (ACK) packet from the connection requesting side, creating a second handshake packet with the same SEQ number and the same ACK number with the first handshake packet, and sending the second handshake packet to a packet processing module of the hardware memory of the electronic device through a transmission control protocol/internet protocol (TCP/IP) protocol stack, wherein the second handshake packet comprises a SEQ number Y of the first handshake-acknowledge packet;
the TCP/IP protocol stack receiving a second handshake-acknowledge packet from the packet processing module, and modifying a SEQ number Z of the second handshake-acknowledge packet to the SEQ number Y of the first handshake-acknowledge packet, and sending the modified second handshake-acknowledge packet to the defense module, at the same time storing a difference value R of SEQ numbers, wherein R=Z−Y;
when receiving the modified second handshake-acknowledge packet, establishing a second acknowledge packet with an ACK number Y+1 by using the defense module, and sending the second acknowledge packet to the TCP/IP protocol stack; and
the TCP/IP protocol stack modifying the ACK number of the second acknowledge packet to Z+1 according to the difference value R of SEQ numbers, and sending the modified second acknowledge packet to the packet processing module, so that handshake between the defense module and the packet processing module succeeds, and connection between the connection requesting side and the packet processing module is created;
wherein if the number of first handshake packets to be processed is equal to or smaller than a first predetermined value, the defense module processes new first handshake packets;
if the number of the first handshake packets to be processed is larger than the first predetermined value and equal to or smaller than a second predetermined value, the defense module processes unrecorded first handshake packets, wherein the unrecorded first handshake packets is the first handshake packets with no packet information recorded in the defense module; and
if the number of the first handshake packets to be processed is larger than the second predetermined value, the defense module does not process the new first handshake packets.

2. The method of claim 1 , further comprising:
when connection between the connection requesting side and the packet processing module is established, receiving a packet from the connection requesting side by using the TCP/IP protocol stack, and modifying an ACK number A of the packet to A+R, and sending the modified packet to the packet processing module; and
receiving an acknowledge packet from the packet processing module by using the TCP/IP protocol stack, and modifying a SEQ number B of the acknowledge packet to B−R, and sending the modified acknowledge packet to the connection requesting side.

3. The method of claim 1 , comprising:
according to the number of the first handshake packets to be processed by the defense module, ascertaining whether to process the new first handshake packets, wherein the first handshake packets to be processed are the first handshake packets that do not receive corresponding first acknowledge packets.

4. The method of claim 1 , wherein a hash chart is set up in the defense module, if the packet information of the new first handshake packets is not recorded in the hash chart, the defense module processes the new first handshake packets.

5. The method of claim 4 , wherein the packet information comprises a source port, a source address, a destination port and a destination address of the first handshake packet.

6. The method of claim 3 , wherein the number of the first handshake packets to be processed with a given IP address is larger than a predetermined value, the defense module abandons the corresponding data connection of the first handshake packets to be processed.

7. The method of claim 1 , wherein the TCP/IP protocol stack decides whether the destination of the second acknowledge packet is the packet processing module of the electronic device or a network device connected with the electronic device according to a routing table.

8. An electronic device comprising:
one or more processors;
a memory;
one or more programs stored in the memory, being executed by the one or more processors to perform a method of processing packets, the one or more programs comprises a defense module, a TCP/IP protocol stack, and a packet processing module;
when receiving a first handshake (SYN) packet of connection request from a connection requesting side, the defense module establishes a first handshake-acknowledge (SYN-ACK) packet, and responds the connection requesting side by sending the first handshake-acknowledge packet to the connection requesting side;
when receiving a first acknowledging (ACK) packet from the connection requesting side, the defense module creates a second handshake packet with the same SEQ number and the same ACK number with the first handshake packet, and sends the second handshake packet to the packet processing module through a transmission control protocol/internet protocol (TCP/IP) protocol stack, where the second handshake packet comprises a SEQ number Y of the first handshake-acknowledge packet;
the TCP/IP protocol stack receives a second handshake-acknowledge packet from the packet processing module, and modifies a SEQ number Z of the second handshake-acknowledge packet to the SEQ number Y of the first handshake-acknowledge packet, and sends the modified second handshake-acknowledge packet to the defense module, at the same time storing a difference value R of SEQ numbers, where R=Z−Y;
when receiving the modified second handshake-acknowledge packet, the defense module establishes a second acknowledge packet with an ACK number Y+1, and sends the second acknowledge packet to the TCP/IP protocol stack; and
the TCP/IP protocol stack modifies the ACK number of the second acknowledge packet to Z+1 according to the difference value R of SEQ numbers, and sends the modified second acknowledge packet to the packet processing module, so that handshake between the defense module and the packet processing module succeeds, and connection between the connection requesting side and the packet processing module is created;
wherein if the number of first handshake packets to be processed is equal to or smaller than a first predetermined value, the defense module processes new first handshake packets;
if the number of the first handshake packets to be processed is larger than the first predetermined value and equal to or smaller than a second predetermined value, the defense module processes unrecorded first handshake packets, wherein the unrecorded first handshake packets is the first handshake packets with no packet information recorded in the defense module; and
if the number of the first handshake packets to be processed is larger than the second predetermined value, the defense module does not process the new first handshake packets.

9. The electronic device of claim 8 , wherein
when connection between the connection requesting side and the packet processing module is established, the TCP/IP protocol stack receives a packet from the connection requesting side, and modifies an ACK number A of the packet to A+R, and send

Assignees

• Huizhou Tcl Mobile Comm Co Ltd

Inventors

• Xiang Jinming
• Zhou Dan
• Lu Xiaofeng
• Wu Jun

Classifications

• H04L29/06095

  Electricity · mapped topic

• H04L69/16

  Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP] · CPC title

• H04L5/0055

  Physical resource allocation for ACK/NACK (for physical mapping arrangements in ARQ protocols H04L1/1861) · CPC title

• H04L63/1458 Primary

  Denial of Service · CPC title