Patent ID: 9742732
Date: 2017-08-22
CPC Classifications: H04L

Claim:
1. A distributed TCP SYN flood protection arrangement comprising: a first device, wherein the first device is a hardware device, that processes packet input and output functions for sender verification of new TCP connections, including performing sender verification with respect to a connection initiation from a sender for a first TCP connection with the first device for communicating TCP packets between the sender and a destination server and capturing session information comprising a first sequence number of the first TCP connection, run-time data indicative of an application type establishing the new TCP connections, and metadata that describes the new TCP connections; and a second device, wherein the second device is a hardware device separate from the first device, that performs security processing operations for TCP connections following sender verification by the first device, wherein the second device: receives session information captured by the first device, receives TCP packets forwarded by the first device to the second device from the first TCP connection after the first device verifies the sender is legitimate, establishes a second TCP connection with the destination server using the sender as the source of the second TCP connection including determining an offset based on a difference of the first sequence number and a second sequence number for the second TCP connection, performs one or more security processing operations on the TCP packets of the first TCP connection received from the sender based on the session information and content of the TCP packets, modifies the first sequence number for the TCP packets based on the offset, and provides the TCP packets to the destination server using the second TCP connection based on results of the security processing operations.