Patent Application
20090235359
Security and vulnerability scanning services provide valuable information about the security of a network, potential threats to the network, and other problems associated with devices and computers connected to a network. Scanning services offer assistance in locating and remedying vulnerabilities and security-holes in a variety of devices, including, but not limited to, computers connected to a network, servers, routers, firewalls, and other peripheral devices (each of these are referred to herein as a “device”). Scanning services are vital in ensuring the safety and security of consumers while conducting online transactions.
In some cases, vulnerability scanning services are mandated in order to do online business. The PCI counsel requires online merchants to receive scanning services prior to accepting credit cards online. Any merchants that have not received proper scanning may not process credit card payments. If a company is large enough, then PCI scanning must be performed daily. Because of the significant amount of scanning required and the complexity of the PCI and other scanning requirements, most merchants turn to a third party scanning provider who can perform the services remotely.
Third party scanning services operate by having a scanning customer specify to the scanning server a device that requires vulnerability scanning. This is usually done by providing information such as an IP address or domain name to a third party scanning server. The scanning server then initiates a scan over the Internet by barraging the IP address or domain name with simulated attacks. Upon completion of the simulation, the scanning server delivers a report detailing any security flaws detected to the scan requester. Many scanning service providers include detailed information on how to remedy the vulnerability and some even offer remediation services.
One of the biggest obstacles in performing scanning services is scanning devices connected to the internet that are behind a network security device such as a firewall. The problem is that any device connected through a network security device is not actually visible to the scanning server. The user cannot simply specify an IP address or domain name and expect to achieve adequate results. If the scanning service tries to scan the device while it is behind the network security device, the scan will actually occur on the network security device instead of on the device that the customer wants scanned. Scanning devices behind a network work device is important in case of primary domain failure, portable computers, or in order to ensure multi-hierarchal safety. Because of the strict guidelines of vulnerability scanners and the regulations and industry standards surrounding vulnerability scanning, there is a real need for an efficient method of scanning devices that are located behind a network security device.
One method previously used to overcome this limitation is to connect to the device that requires scanning through an established VPN connection and then perform the scanning services on the device directly over the established VPN. VPNs are a well known system for connecting to computers through firewalls and have been described in U.S. Pat. Nos. 7,197,550, 6,662,221, and 6,980,556, all of which describe methods for automated creation of secure VPN connections.
The problem with the current known VPN arrangement for providing scanning services is that the VPN connection must be established and maintained on the device that needs to be scanned prior to the initiation of the vulnerability scan. In addition, if daily scanning is necessary, the VPN connection must be permanently established and not disconnected. This is inefficient and not practical as a permanent VPN connections wastes bandwidth and severely limits the total number of computers that may be scanned by each scanning server. In addition, some devices may not support a VPN connection or allow any third party software to be installed. A VPN connection may be forbidden on the device by manufacture, design, or by the security policies set by a network administrator. These devices still require scanning services, but cannot use known methods.
Another solution in the industry has been to sell the scanning software outside of the separate scanning server and then let users run the scan on their local network. This is inefficient as updates to the security scans need to be made regularly. As threats change and grow, there is a strong need to keep all of the scanning services located in a single location so that the scanning services can be altered quickly in order to respond to changing needs. In addition, local scanning requires customers to have knowledge of scanning practices and a computer or server dedicated to the software. This wastes valuable local system resources for daily scanning that should be provided by the third party scanning service. These resources are often more efficient if allocated to other tasks.
A third party scanning provider that performs scans over the Internet is usually preferable over an internal scanning service as a third party can provide extra assurance to the public that the scans have been performed in a professional and expert manner. A third party scanner ensures the public that the scans performed and the results obtained are legitimate and not manipulated internally in order to achieve the necessary security compliance. Most companies already use third party scanning for its external devices so having internal scanning is a duplication of services and is inefficient.
Thus, there is a real need for a method and system that allows a party to perform or receive vulnerability scanning services on devices that are behind a network security device in a manner that is not restricted to an established VPN and that can be performed on-demand rather than through a permanent server connection.
The current application discloses a method of performing security scanning services over the Internet on devices that are protected by a firewall or other network security device. The invention discloses that an agent (a computer program) on the local intranet of the device to be scanned establishes a secure connection to the scanning server using a VPN tunnel. The agent can establish the VPN tunnel by having a user manually initiate the connection, by automatically or manually downloading instructions for the agent from a server outside of the network, or by including the instructions to start a VPN connection directly in the agent's software or in a database or instruction file that is shipped with the agent. Upon activation of a VPN initiation request, the agent automatically establishes the VPN connection using any known method, such as through the methods listed in U.S. Pat. Nos. 7,197,550, 6,662,221, and 6,980,556. After the VPN connection is established, the agent then requests the scanning services from a scanning server. Upon receipt of the scanning request from the agent, the scanning services are initiated over the Internet on the devices that require scanning over the VPN.
In one embodiment of the invention, an agent on a computer establishes the VPN connection with the scanning server. Through the VPN connection, the scanning server is assigned an IP address associated with the intranet on which the device requiring scanning is located during or after the VPN tunnel has been established. The IP address can be assigned by having the agent configure the network bridge or set up enabling the Proxy ARP for the IP address being assigned. As a result, the IP address of the scanning server appears to be a local IP address in relation to the device requiring scanning. The scanning server can be treated as a local computer and can run the scanning services on all of the devices connected to the local network without interference from the network security device. Once the scanning services are complete, the VPN connection is terminated in order to free system resources and allow the scanning server to connect to other networks.
In a second embodiment, after establishing the VPN connection, the agent is assigned an IP address (or multiple IP addresses). The assigned IP addresses are IP addresses associated with the scanning server's network. The scanning server then initiates scans on any devices on the agent's network that needs to be scanned. During the scan, all packets sent from the scanning server are sent to the agent instead of directly to the device. The agent then forwards the packets using DNAT. Replies to the scan by the device are sent back from the device being scanned to the agent and then forwarded by the agent to the scanning server.
The scanning services may be performed in parallel for multiple intranets by having a mediator server automatically select a single scanning server from a group of scanning servers where the single scanning server is currently not performing a scan. Alternatively, for the first embodiment, the agent can automatically bring up the scanning software on a virtual private server (“VPS”) and then have each agent requesting scans connect to the VPS.
Scanning speeds can be increased by having the agent configured to connect to multiple scanning servers and allowing each scanning server to run simultaneous scans on different devices. Alternatively, a mediator server can assign to each scanning server a separate set of IP addresses associated with devices that are in the scanning queue and then have each scanning server perform scans on the various connected devices.
The following description includes specific details in order to provide a thorough understanding of the present method and system of performing security and vulnerability scanning services on devices behind network security devices. The skilled artisan will understand, however, that the products and methods described below can be practiced without employing these specific details, or that they can be used for purposes other than those described herein. Indeed, they can be modified and used in conjunction with products and techniques known to those of skill in the art in light of the present disclosure.
Reference in the specification to “one embodiment” or “an embodiment” means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. The appearances of the phrase “in one embodiment” in various places in the specification are not necessarily all referring to the same embodiment.
Referring now to
A VPN tunnel 12 is a well known term of art and is any connection used to conduct private communications between two computer terminals. The VPN tunnel 12 can be any kind of VPN that will allow IP packets to travel through it, including, but not limited to, SSL, IPSEC, or p2p VPN. A scanning server is any computer, server, or other device located outside of the network that will is configured to run vulnerability scanning or security tests on devices. Typically, this is a server box with vulnerability scanning software, but could be a computer with a hacker on the other side that is testing security settings or a computer-like device that executes a single security test.
In step 101, the agent 4 is instructed to create the VPN tunnel 12 by obtaining and using settings and instructions on how to connect to the scanning server 8. These instructions can be stored within the agent 4 or may be retrieved from an outside server, the scanning server itself, from a file or setting within the agent itself, or from any other location. Alternatively, the configuration file and certificate for creating the VPN can be downloaded from a website via HTTPS (or another method of transport) and then the login information can be inserted into the configuration file via a string substitution command by the agent. The exact configuration of how the agent executes and initiates the VPN connection would depend on the VPN tunnel being used. Instructions may be entered manually by the user and then stored for later use.
One example of how the agent enables the VPN connection is to have the agent contain an OpenVPN client, access OpenVPN settings, and download a certificate for connecting to the OpenVPN server. The agent would start the OpenVPN client which would read the settings and connect to the OpenVPN server.
In step 102, the scanning server 8 announces itself to the local network and is assigned an IP address within the local network 10. The IP address is assigned by having the agent 4 configure the network bridge per any known method of configuring a network bridge or by having the agent activate or enable a Proxy ARP for the IP address being assigned. Once the scanning server 8 is assigned an IP address within the local network 10, the scanning server 8 appears to be part of the local network 10 on which the devices to be scanned 2 or the agent 4 are located. Any known method may be used to assign the IP address and the invention is not limited to the two methods of IP address assignment described above. Once the scanning server 8 is assigned an IP address, the scanning server is considered to be part of the local network 10 and can act just like a server on the network.
In Step 103, the scanning server 8 then performs the security and vulnerability scanning services behind the network security device 6 through the VPN tunnel 12 using the assigned IP address.
If multiple devices on the local network 10 require scanning, the scanning server 8 can accept a list of IP addresses associated with the devices to be scanned 2 and can use the list perform the scanning services on each listed IP address. The generation, creation, distribution, and use of the list of IP addresses can be done in any known manner, including, but not limited to, maintaining a static list, searching the network for attached devices, or by manually feeding the IP addresses to the scanning server. The list can be stored directly on the scanning server, provided over the VPN tunnel 12, or provided through a network management interface which then sends the list to the scanning server 8. Distribution of this list of IP addresses can be through the agent 4 or by separate software. The scanning server 8 will select each IP address from the list, connect to the device to be scanned 2 corresponding to the selected IP address, and perform the scanning services.
Once the scanning services are completed, the VPN tunnel 2 is terminated which frees up system resources and allows other networks to connect to the same scanning server.
In an alternate embodiment shown in
If multiple devices 2 are required to be scanned, in Step 206, the DNAT 16 is automatically reconfigured to scan a separate device 2 upon completion of the previous scan. If several devices need to be scanned at the same time, the agent 4 can assume multiple IP addresses that are local to the scanning server 8 and provide DNAT 16 for each device 2. The agent 4 forwards each packet from the scanning server 8 to the appropriate device to be scanned 2. This allows a single agent 4 to be installed on the network 10 and have it serve as the DNAT 16 for the scanning services for every device to be scanned 2.
As in the first embodiment, a list of IP addresses to be scanned can be used by the scanning server 8 to determine which devices 2 on the network 10 need to be scanned.
In step 207, after the scanning is complete, the VPN 12 is terminated to free up network resources.
As shown in
Optionally, the agent 4 could automatically bring up the scanning services on virtual private server (“VPS”) 32 and then have the agent 4 connect to the VPS. The VPS then selects the scanning server 8 from the pool of scanning servers 30 for the agent 4. The agent 4 then establishes the VPN tunnel 12 through either the VPS 32 or directly to the scanning servers 8 in the pool of scanning servers 30.
Optionally, if several devices need to be scanned 2, then the total scanning speed may be increased by having a mediator server 22 or the agent 4 assign each scanning server 8 connected to the network a separate set of IP addresses. Each scanning server 8 would then take care of scanning the devices 2 associated with the assigned set of IP addresses. Multiple VPN tunnels 12 can be created between the agent 4 and the scanning servers 8 in the pool of scanning servers 30 in order to allow each scanning server 8 access to the local network 10.
In order to increase the speed of performing the scans, the agent 4 can be configured to connect to multiple scanning servers 8 which run simultaneous scans on the various devices to be scanned 2. If the first embodiment is being used to connect to the scanning servers 8, then each separate scanning server in the pool of scanning servers 30 is assigned its own intranet IP address by the agent 4.
If the second embodiment is being used to connect to the scanning servers 8, then each scanning server 8 uses the DNAT 16 that is part of the agent 4 to act as part of the local network 10. The DNAT 16 would forward the scanning server queries and responses made to the appropriate device to be scanned 2.
In addition, the previous embodiments may be set up in an enterprise situation where a plurality of agents 4 exist over many networks 10. Some networks may have more than one agent. The plurality of agents 4 connects via VPN tunnels 12 to a plurality of scanning servers 8. This may be one agent per server, multiple servers per agent, or multiple agents per server. The scanning servers 8 then perform the scanning over the VPN tunnels 4 to multiple devices 2 on the networks. Such an embodiment works well for mass scanning of devices and can be created using a pool of servers.
The invention is not restricted to the details of the foregoing embodiments. The invention extend to any novel one, or any novel combination, of the features disclosed in this specification (including any accompanying claims, abstract and drawings), or to any novel one, or any novel combination, of the steps of any method or process so disclosed.
This application claims the benefit of provisional application Ser. No. 61/035,935, filed Mar. 12, 2008, which is incorporated entirely herein by reference.
| Number | Date | Country | |
|---|---|---|---|
| 61035935 | Mar 2008 | US |
