The invention relates to network communications. More particularly, the invention relates to protecting networks against attacks that use forged messages, or impersonation attacks.
In a communications network, an attacker can attempt to forge a message belonging to any protocol being used by the nodes on the network. Successfully forged messages may be used by the attacker to achieve a variety of objectives, such as denial-of-service and diversion of traffic. Cryptographic authentication mechanisms are well known, and offer very strong protection against forged messages. However, cryptography is computationally complex and can be administratively difficult to deploy, which means that in many cases cryptographic authentication may not be practical.
It would be desirable to provide a way to protect networks against attacks that use forged messages that is relatively simple and does not require the use of cryptographic authentication techniques.
The invention provides methods, apparatuses and computer programs for use in a network for determining whether a forged message has been detected and for sending out a forgery declaration over the network when a forged message has been detected.
In accordance with one embodiment, the apparatus comprises an input/output (I/O) interface and a processor. The processor is configured to determine whether a communication received over the network via the I/O interface is a forged message, and causes a forgery declaration to be sent out over the network if it determines that the message is a forged message.
In accordance with another embodiment, the apparatus comprises an I/O interface and a processor. The processor is configured to determine whether a communication received over the network via the I/O interface comprises a forgery declaration indicating that a forged message has been transmitted over the network.
In accordance with one embodiment, the method comprises receiving a message sent over the network, determining whether the message is a forged message, and, if a determination is made that the message is a forged message, causing a forgery declaration to be sent over the network.
In accordance with another embodiment, the method comprises receiving a message sent over the network, determining whether the received message comprises a forgery declaration declaring that a forged message has been detected on the network, and, if a forgery has been detected, taking some action to protect the network.
In accordance with one embodiment, a computer program comprises instructions for receiving a message sent over the network, instructions for determining whether the message is a forged message, and instructions for causing a forgery declaration to be sent over the network if a determination is made that the message is a forged message.
In accordance with another embodiment, the computer program comprises instructions for receiving a message sent over the network, and instructions for determining whether the received message comprises a forgery declaration declaring that a forged message has been detected on the network.
These and other features and advantages of the invention will become apparent from the following description, drawings and claims.
The present invention provides a method and an apparatus for protecting against forged messages, or impersonation attacks. The invention does not require the use cryptography. In accordance with the invention, one or more nodes on the network are configured to detect a forged message and to output an indication that a forged message has been detected. Nodes that receive an indication that a forged message has been detected may then take certain actions, such as, for example, discontinuing use of the protocol associated with the forged message for a period of time.
One or more non-detector nodes 20 on the network 10 do not directly detect forged packets. It is not necessary that the network 10 include non-detector nodes 20. The purpose for including non-detector nodes 20 in the network 10 is to demonstrate that it is not necessary for every node to have the ability to detect forged packets. Also, while the network 10 is being described as a packet-based network, the network 10 may be any type of network (e.g., circuit-switched) in which it is possible to have forged-message attacks. The network 10 may be a wired network or a wireless network, or a combined wireless and wired network.
It should be noted that the status of a node (e.g., detector, non-detector, forwarder, etc.) is not fixed. For example, some nodes can detect forgeries of one protocol (e.g., protocol P), but cannot detect forgeries of another protocol (e.g., P′ forgeries). Similarly, even if a node can detect some P forgeries, this does not mean it can detect all P forgeries. For example, if an attacker is pretending to be a specific node, node N, often only node N can detect the forgery. Therefore, a node's status as detector and non-detector can change on a per-packet basis. Also, a node can assume multiple identities. For example, a non-detector node of P forgeries can forward a P forgery declaration.
While an authentic forgery declaration offers explicit evidence that at least one detector node thinks an attacker is present, forgery declarations themselves may be forged. The extent to which a forgery declaration should be authenticatable hinges in part on the strength of the security scheme protecting the protocol, P, against which attacks can be mounted. If the attackable protocol P is not strongly protected (e.g., does not use cryptologic security mechanisms), then forgery declarations about P do not necessarily need to be strongly protected because if an entity has successfully forged a forgery declaration about P that is not strongly protected, then it is not unreasonable to conclude that the same entity can or already has successfully attacked the not-strongly protected protocol P. The same logic holds if both protocol P and forgery declarations about protocol P are strongly protected (e.g., cryptologically). However, if the attackable protocol P is strongly protected (e.g., cryptologically), but forgery declarations about protocol P are not strongly protected, then it may be unreasonable to assume that the entity that can forge forgery declarations about protocol P can also forge protocol P, since the latter is much more difficult than the former.
With reference again to
As shown in
Although the example depicted in
It should be noted that the inventions is not limited to the algorithms represented by the flowcharts shown in
The algorithms described above with reference to
The algorithms described above with reference to
Although the invention may use encryption, the invention does not require the use of encryption. In accordance with one exemplary embodiment, the invention is implemented as a “Non-authenticated Forgery Declaration Protocol” (NAFDP), which is used to protect other protocols against impersonation attacks. The NAFDP formally defines the functionality of detector nodes, non-detector nodes, forwarder nodes, and the format of forgery declaration messages. An NAFDP forgery declaration message provides at least information indicating that a forgery has been detected. The message typically also includes information as to what protocol has been attacked, and may include information as to which specific message(s) have been forged, the address of the node that issued the forged message, and hints as to how non-detector nodes might react upon receipt of the declaration.
In accordance with a second exemplary embodiment, the present invention is incorporated directly into a vulnerable protocol regardless of whether that protocol uses cryptographic techniques for security. For instance, a vulnerable protocol may be supplemented with a purpose-defined “forger declaration” message or supplemented with a “forger detected” field inside of messages that have previously been defined. Alternatively, a vulnerable protocol may be supplemented in a manner that allows detector nodes to declare implicitly that they have directly detected a forgery without using a new message or new field. The latter technique may be useful, for example, in cases in which non-detector nodes treat duplicated messages as an implicit forgery declaration and detector nodes replay forged packets, thereby causing non-detector nodes to receive one or more duplicates.
In accordance with a third exemplary embodiment, the present invention is used in an “Authenticated Forgery Declaration Protocol” (AFDP), which is used to protect other protocols against impersonation attacks. The AFDP is similar to the NAFDP except that AFDP messages are authenticated, i.e., encryption is used. Thus, the invention may be used along with encryption techniques, but it is not necessary for the invention to be used with encryption techniques.
The invention is not limited to being implemented at any particular location of the network or in any particular device or component of the network. The detector node is typically a firewall device, but may be other devices as well.
The invention has been described with reference to exemplary embodiments. The invention, however, is not limited to the embodiments described herein. It will be understood by those skilled in the art in view of the description provided above that modifications may be made to the embodiments described above and that all such modifications are within the scope of the invention.
This application claims priority to a provisional patent application having Ser. No. 60/738,149, entitled “Simple Algorithm To Protect A Network Against Forged Messages”, which was filed on Nov. 18, 2005, and which is hereby incorporated herein by reference in its entirety.
Number | Date | Country | |
---|---|---|---|
60738149 | Nov 2005 | US |