Patent ID: 7584352

Claim:
An information processing system for protecting at least one target server computer from denial of services attacks launched by at least one source client computer, the information processing system comprising: an input/output interface configured to receive and send packets, wherein said packets comprise one selected from a group consisting of: TCP packets and non-TCP packets; generating a unique sequence number comprises an encrypted code produced by a function combining the source client computer's address and port number, the target server computer's address and port number, the source client computer's initial sequence number, and a time measurement, a hardware crypto engine adapted to create a unique sequence number for inclusion in the packet to be sent to the source client computer requesting establishment of a connection between the source client computer and the target server computer, wherein the packet comprises at least one synchronization packet that is part of a handshake process for establishing the connection between the source client computer and the target server computer; wherein the crypto engine is further adapted to validate the unique sequence number in received synchronization packets that are part of a handshake process for establishing the connection between the source client computer and the target server computer; a lookup table for storing a tuple of information from a packet header, the tuple of information defining established connections between the target server computer and a plurality of source client computers so that received packets that purport to be part of an established connection can be validated by comparing information in the packet with entries in the lookup table; a buffer coupled with the input/output interface for temporarily storing incoming non-TCP packets and passing said packets from the source client computer to the target server computer at a limited rate; and a fast hardware lookup engine for accessing the lookup table; and passing data over the connection only when it is determined that the third packet is valid.