30 results about "Sality" patented technology

Coordinated SYN denial of service (CSDoS) attacks are reduced or eliminated by a process that instructs a layer 4-7 switch to divert a small fraction of SYN packets destined to a server S to a web guard processor. The web guard processor acts as a termination point in the connection with the one or more clients from which the packets originated, and upon the establishment of a first TCP connection with a legitimate client, opens a new TCP connection to the server and transfers the data between these two connections. It also monitors the number of timed-out connections to each client. When a CSDoS attack is in progress, the number of the forged attack packets and hence the number of timed-out connections increases significantly. If this number exceeds a predetermined threshold amount, the web guard processor declares that this server is under attack. It then reprograms the switch to divert all traffic (i.e. SYN packets) destined to this server to the web guard processor, or to delete all SYN packets to the server in question. If the number of timed-out connections increases, it can also inform other web guard processor arrangements, and / or try to find the real originating hosts for the forged packets. In either event, the server is thus shielded from, and does not feel the effects of, the DoS attack. Alternatively, a simpler approach is to arrange layer 4-7 switches to forward SYN packets to respective “null-cache” TCP proxies that each are arranged to operate without an associated cache, and therefore be inexpensive to install and operate. These null-cache TCP proxies, when subject to a CSDoS attack, will not successfully establish a TCP connection with a malicious host, due to the nature of the attack itself. Accordingly, no connections will be made from the null-cache TCP proxies to the server under attack, and the server will be protected.

This disclosure describes a technique to determine whether a client computing device accessing an API is masquerading its device type (i.e., pretending to be a device that it is not). To this end, and according to this disclosure, the client performs certain processing requested by the server to reveal its actual processing capabilities and thereby its true device type, whereupon—once the server learns the true nature of the client device—it can take appropriate actions to mitigate or prevent further damage. To this end, during the API transaction the server returns information to the client device that causes the client device to perform certain computations or actions. The resulting activity is captured on the client computing and then transmitted back to the server, which then analyzes the data to inform its decision about the true client device type. Thus, when the server detects the true client device type (as opposed to the device type that the device is masquerading to be), it can take appropriate action to defend the site.

The invention discloses a privacy protection set intersection calculation method and system based on polynomial representation. According to the intersection calculation method provided by the invention, two participants (a caller B and a responder A) contain the sets of the own attributes and are not acquired by the other party, and the two participants obtain a set intersection through secure multi-party calculation, so that the common attributes of the two parties are acquired. The method specifically comprises the following steps that firstly, a participant and a participant initialize; apolynomial formed by combining the calling party with the random number encrypts the attribute set of the calling party and sends the encrypted attribute set to the responder A; the responder A receives a polynomial formed by the data information and the random numbers, encrypts the data of the two parties of the participant again and sends the data to the responder A; and an intersection set is obtaind through the calculation of two secure parties. The privacy protection set intersection calculation method based on polynomial representation can be used for the multi-party data security communication by utilizing the properties of the polynomial, so that the technical effect of improving the cracking difficulty and safety is achieved.

The present invention relates to a method for identifying node properties based on a distributed system, comprising the following steps: treating participants who apply for resources or provide resources in the distributed system as nodes; the nodes include good faith nodes and Sybil nodes (malicious nodes) and pending nodes; if there is a record of providing resources or obtaining resources between nodes, it is considered to form a connection edge; when the pending node sends out a resource application as the applicant, it is assumed that the participant that receives the resource application and provides resources is a bona fide node. In the random routing, the characteristics of the applicant node and the provider node are respectively extracted, and the nature of the pending node that sends out the resource application is identified accordingly, so as to decide whether to provide resources to it. The invention can effectively identify Sybil nodes, so as to resist Sybil attacks.