Patent ID: 8887280

Claim:
A system for providing denial-of-service protection during a SYN flood attack, the system comprising a gateway device configured to: process, at a second network by the gateway device, received data packets from a first network by forwarding on the second network the received data packet to a computing device corresponding to the IP address in the packet's destination address; examine, by the gateway device, the received packets for a packet containing a request to initiate a connection to the computing device on the second network; in response to receiving the packet containing the request to initiate the connection, transmit, by the gateway device at the second network, to the source address of the first network a packet containing an acknowledgement of the request to initiate the connection, the acknowledgement comprising sequence information sufficient to establish the requested connection with the computing device on the second network, the sequence information including a unique identifier that is generated using a function shared by the computing device and the gateway device, wherein the function is changed on a periodic basis; and process, by the gateway device at the second network, subsequently received packets from the source address of the first network addressed to the computing device by forwarding the subsequently received packets to the IP address of the computing device on the second network for processing by the computing device; wherein: the packet containing the request to initiate the connection is not forwarded to the IP address of the computing device on the second network; the subsequently received packets from the source address of the first network addressed to the computing device on the second network is forwarded to the computing device on the second network for processing by the computing device only when a response to the acknowledgement comprising sequence information is received by the gateway device; and the response to the acknowledgement is verified by determining that the response includes an incremented sequence number.