Patent Application
20110066851
1. Field of the Invention
The present invention relates generally to a computer implemented method and computer program product for network security. More specifically, the present invention relates to segregating network traffic to traverse only secure routers that have clearance levels at least has high as the classification of the network traffic itself.
2. Description of the Related Art
Government data processing systems are routinely used to process information under a security scheme that governs the circulation of information within and among people, secure areas or places, and machines. A typical security scheme stratifies security levels as being, for example, unclassified, classified, secret, and top secret. A security level is a generic term for either a clearance level or a classification level.
A clearance level indicates the level of trust given to a person, computer node, or place. The clearance level indicates the highest level of classified information to be stored or handled by the person device or location. A classification level indicates the level of sensitivity associated with some information, such as in a document or a computer file. The level is supposed to indicate the degree of damage the country could suffer if the information is disclosed to an enemy. A high level, such as “top secret” is information that potentially could seriously damage a country. Though this label is somewhat subjective, information labeled “top secret” has a higher security level than “secret”. Similarly, “secret” has a higher security level than “classified”. In addition, “classified” has a higher security level than “unclassified”. Similar security levels may exist in countries other than the United States of America, and may have more or less labels. However, the security scheme is organized, the people, places, and equipment with higher clearance levels are permitted to access information classified at the corresponding classification level or lower. Thus, a “top secret” person may access information in the levels below that label, for example “classified”.
Access by machines or people of information classified above the clearance level of the machine or person is placing such information at risk in entities that are not trained, equipped, or trusted sufficiently to assure continued security of such information. Accordingly, governments seek ways to detect when such occurrences happen to data owned and controlled by the government. In essence, part of the job of a government is to locate leaks or potential leaks and issue warnings, legal action, training, etc., to abate further dissemination of information in improper ways.
Word processor process 331 is cleared to a “secret” security level. A label “secret” 335 is set to correspond with the process in the node. Accordingly, word processor process 331 can read from the unclassified “bird” document 325. In addition, word processor process 331 can both read 353 and write 355 to secret “dog” document 311. Importantly, it is undesirable, to the government who protects information, that word processor process 331 reads documents such as top secret labeled “cat” document 301. In other words, the process is forbidden from “reading up” a classification level from the clearance level associated with the process. Reading up means that a process, person, or device has obtained or read data that is above the clearance level of the process, person, or device. A government can take steps to stop reading up, though it may have to contend with reading up occurring, despite the government's efforts.
The above conditions are addressed in the following detailed description.
The present invention provides a computer implemented method and computer program product for obtaining a secure route. A trusted host sets a node security association for a trusted host. The trusted host receives, at the trusted host, a client communication request directed to a destination host. The trusted host builds a secure route query comprising a trusted host address, a destination host address, and at least one security level, to form at least one secure route. The trusted host sends packets from the trusted host to the destination host based on the at least one secure route. The packets are responsive to the client communication request, and the packets each have a security label that matches the security level.
The novel features believed characteristic of the invention are set forth in the appended claims. The invention itself, however, as well as a preferred mode of use, further objectives and advantages thereof, will best be understood by reference to the following detailed description of an illustrative embodiment when read in conjunction with the accompanying drawings, wherein:
With reference now to the figures and in particular with reference to
In the depicted example, local area network (LAN) adapter 112 connects to south bridge and I/O controller hub 104 and audio adapter 116, keyboard and mouse adapter 120, modem 122, read only memory (ROM) 124, hard disk drive (HDD) 126, CD-ROM drive 130, universal serial bus (USB) ports and other communications ports 132, and PCI/PCIe devices 134 connect to south bridge and I/O controller hub 104 through bus 138 and bus 140. PCI/PCIe devices may include, for example, Ethernet adapters, add-in cards, and PC cards for notebook computers. PCI uses a card bus controller, while PCIe does not. ROM 124 may be, for example, a flash binary input/output system (BIOS). Hard disk drive 126 and CD-ROM drive 130 may use, for example, an integrated drive electronics (IDE) or serial advanced technology attachment (SATA) interface. A super I/O (SIO) device 136 may be connected to south bridge and I/O controller hub 104.
An operating system runs on processor 106, and coordinates and provides control of various components within data processing system 100 in
Instructions for the operating system, the object-oriented programming system, and applications or programs are located on storage devices, such as hard disk drive 126, and may be loaded into main memory 108 for execution by processor 106. The processes of the present invention can be performed by processor 106 using computer implemented instructions, which may be located in a memory such as, for example, main memory 108, read only memory 124, or in one or more peripheral devices.
Those of ordinary skill in the art will appreciate that the hardware in
In some illustrative examples, data processing system 100 may be a personal digital assistant (PDA), which is configured with flash memory to provide non-volatile memory for storing operating system files and/or user-generated data. A bus system may be comprised of one or more buses, such as a system bus, an I/O bus and a PCI bus. Of course, the bus system may be implemented using any type of communications fabric or architecture that provides for a transfer of data between different components or devices attached to the fabric or architecture. A communication unit may include one or more devices used to transmit and receive data, such as a modem or a network adapter. A memory may be, for example, main memory 108 or a cache such as found in north bridge and memory controller hub 102. A processing unit may include one or more processors or CPUs. The depicted example in
The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used herein, the singular forms “a”, “an”, and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms “comprises” and/or “comprising,” when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof.
The corresponding structures, materials, acts, and equivalents of all means or step plus function elements in the claims below are intended to include any structure, material, or act for performing the function in combination with other claimed elements as specifically claimed. The description of the present invention has been presented for purposes of illustration and description, but is not intended to be exhaustive or limited to the invention in the form disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the invention. The embodiment was chosen and described in order to best explain the principles of the invention and the practical application, and to enable others of ordinary skill in the art to understand the invention for various embodiments with various modifications as are suited to the particular use contemplated.
As will be appreciated by one skilled in the art, the present invention may be embodied as a system, method, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, micro-code, etc.) or an embodiment combining software and hardware aspects that may all generally be referred to herein as a “circuit,” “module”, or “system.” Furthermore, the present invention may take the form of a computer program product embodied in any tangible medium of expression having computer usable program code embodied in the medium.
Any combination of one or more computer usable or computer readable medium(s) may be utilized. The computer-usable or computer-readable medium may be, for example but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, device, or propagation medium. More specific examples (a non-exhaustive list) of the computer-readable medium would include the following: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CDROM), an optical storage device, a transmission media such as those supporting the Internet or an intranet, or a magnetic storage device. Note that the computer-usable or computer-readable medium could even be paper or another suitable medium upon which the program is printed, as the program can be electronically captured, via, for instance, optical scanning of the paper or other medium, then compiled, interpreted, or otherwise processed in a suitable manner, if necessary, and then stored in a computer memory. In the context of this document, a computer-usable or computer-readable medium may be any medium that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. The computer-usable medium may include a propagated data signal with the computer-usable program code embodied therewith, either in baseband or as part of a carrier wave. The computer usable program code may be transmitted using any appropriate medium, including, but not limited to wireless, wireline, optical fiber cable, RF, etc.
Computer program code for carrying out operations of the present invention may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the “C” programming language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider).
The present invention is described below with reference to flowchart illustrations and/or block diagrams of methods, apparatus and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable medium that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable medium produce an article of manufacture including instruction means which implement the function/act specified in the flowchart and/or block diagram block or blocks.
The computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks.
The aspects of the illustrative embodiments provide a computer implemented method, data processing system, and computer program product for establishing a secure path between a trusted host and a destination host, or at least indicating to a destination host that a secure route is unknown to a secure route discovery node. In other words, in the second situation, there is no secure route available to the secure discovery node that will satisfy a classification level of data targeting the destination host.
Network 200 is monitored and served by secure route discovery node 221. A secure route discovery node is a node that collects the network topology information of a network. Accordingly, a secure route discovery node may record to a database each router in the network topology and a clearance level. The database that stores each paring of a router and clearance level is a secure routes database controlled by the secure route discovery node. Secure route discovery node 221 updates and queries secure routes database 223 in response to activity on network 200.
Activity on the network may appear in at least three different forms. First, the network may query the secure route discovery node by transmitting to the secure route discovery node secure route query 251. Second, the network's routers may each transmit a multicast packet or packets (not shown) in order to announce the connectivity or clearance level status of the sending router. Third, a secure router may collect and report anomalous packet sources. In other words, the secure router may identify routers that send packets that reach a secure router having a clearance level below the security label of such packets. A security label is an indication of the classification level of information transmitted over a network. In addition, and in response to node secure route queries, the secure route discovery node may respond with a secure route discovery node response 253. Each of these communications or activities are described further below.
A secure route discovery node may respond to a security route query with a secure route. If the secure route is found and sent to the trusted host, the trusted host may cache the route (along with other routes) in a manner to track the security level associated with the route. The security level associated with the route may be the lowest security level of any security router along the route. The trusted host may store the secure route to a secure route cache. A secure route cache is a low-latency recording device local to a trusted host. By ‘local to’ it is meant that the recording device is housed within a data processing system that is the trusted host, or is within a common structure having security features consistent with the clearance level of the trusted host. The recording device can be, for example, main memory 108, hard disk drive 126, cache within processor 106, or any other device capable of storing data.
Step 601 may be performed, for example, by an administrator entering a path describing each host, secure router or destination host by a unique descriptor into a secure routes database, together with a security level that the path, as a whole is able to support. By being able to support, it is meant that the security level of packets may traverse nodes in the path without the security level of the packets being above the clearance level of each node in the path. By being “above” it is meant that the first security level is one corresponding to more rigid and exclusive security precautions and/or value than a second security level corresponding to a lighter and/or more relaxed security precaution and/or value.
It is appreciated, that other ways of building a path may be performed at step 601. For example, a secure route discovery node may receive multicast packets originating from a secure router that describe the security level and the next hop routers to which it may communicate. The secure route discovery node may then use the information from such multicast packets and build a topology image that it can use to determine the secure routes between two given hosts and also the security levels on these routes. This topology image allows the secure route discovery node to learn about the available routers without significant direct involvement of an administrator.
Next, the secure route discovery node may receive a secure route query (step 603). The secure route query may be in the form, for example, of secure route query 400 of
The secure route query may further include a security level, for example, “secret”. In the example of
Next, the secure route discovery node may determine whether criteria are met. The criteria determination may influence which information the secure route discovery node transmits to a source trusted host. In other words, the secure route discovery node determines if a path is found (step 607). This determination is affirmative when at least one path is found. In which case, the secure route discovery node may transmit the path or paths to the trusted host (step 611). Again, in the context of this example, trusted host 611 plays the role of source trusted host. The secure route discovery node can transmit the paths as a secure route discovery node response. The secure route discovery node response can include each node along the path as well as the security level corresponding to the path, as looked up from the secure routes database. On the other hand, a negative determination may cause the secure route discovery node to transmit an empty string to the trusted host (step 609). In the case that the secure route discovery node performs step 609, the secure route discovery node transmits the empty string as at least a part of a secure route discovery node response. Processing may terminate after steps 609 or 611. An empty string may be null data stored in a payload of a packet sent from the secure route discovery node to the trusted host. As may be appreciated, the null data may be any suitable form of placeholder, for example, if a convention is to send paths to the trusted host as data that specifies a number of hops along a path as an initial value to the path (with respect to step 611), then a number of hops equal to zero may indicate an empty string.
A simplified case of looking up the path can be finding a network segment having one endpoint selected from a group consisting of trusted host and destination host. Such a network segment, to meet the criteria, can have a clearance level at least as high as the classification level of the secure route query such that the network segment and at least one additional network segments interconnect trusted host and destination host. Each additional network segment has endpoints each having a clearance level at least as high as the classification level of the secure route query.
One way to fail to look up a secure path is to locate only inadequate paths. An inadequate path is a path that corresponds to a clearance level below the security level of the secure route query. Such a path or paths may be found by step 605 when only one or more inadequate paths are found in response to receiving a secure route query.
Periodically, the secure route discovery node may receive multicast packets from a secure routers, as described further below with respect to
Next, the secure router may set a routing table (step 703). Next, the secure router may transmit a multicast packet having the security level and the neighbor routers (step 705). The neighbor routers can include one or more neighbor secure routers. The neighbor secure router is a router reached by a single hop by the secure router. It is appreciated that the payload of security level and neighbor routers may be divided among several packets, as an alternative to step 705. Next, the secure router may receive a packet from a source address (step 707). The packet may have a label for a classification level. As such, the secure router may compare the packet to the security level of the secure router set at step 701. Thus, the secure router determines whether the packet classification level is above the secure router security level (step 709).
A positive determination at step 709 can cause the security router to transmit the source address to the secure route discovery node (step 721). A reason to report the source address in this manner is that it may be helpful to identify the node corresponding to the source address as a node that is ineffective at assuring packets dispatched from the node traverse only secure routers having clearance levels at or above the classification level of the packets so dispatched. Accordingly, the secure router may next drop the packet (step 723).
If, instead, the secure router makes a negative determination at step 709, the secure router may transmit the packet according to a strict source route internet protocol (step 711). Such a strict source route internet protocol can be established on the basis of a secure route determined by a trusted host in cooperation with a secure route discovery node, explained further below. Next, after either step 711 or step 723, the secure router may determine if the packet received at step 707 is the last packet (step 713). A positive determination causes the secure router to repeat step 707, and accordingly receive an additional packet. A negative determination at step 713 may cause termination.
Next, the trusted host may determine if a secure route cache describes the destination host (step 805). The step 805 may include matching a route to the security level, where the route includes the destination host. If the security level associated with the route is not at or above the security level determined at step 803, a negative determination may occur at step 805.
Accordingly, steps 811 through 819 may permit the trusted host to acquire a secure route when no secure route is discoverable within the secure route cache. The trusted host may transmit a secure route query (step 811). The step may be performed using the security level determined at step 803. Next, the trusted host may receive a secure route discovery node response (step 813). Next, the trusted host may determine if the secure route discovery node response is non-empty (step 815). The secure route discovery node response may be formed as described in relation to
After setting a cache time at step 819, the trusted host may send a packet based on the secure route (step 821). The secure route may be as determined from the secure route cache, or as determined by other means, described below. In addition, for each packet sent, the trusted host may set a strict source route option. Next, the trusted host may determine whether more packets are available to send from the client to the destination host (step 823). If not, processing may terminate. However, if so, the trusted host may resume at step 805. Step 805 determines if the secure route cache has a suitable route.
An alternate result to step 805 is to determine that the secure route cache describes a destination host. Accordingly, having made an affirmative determination, the trusted host may form a secure route based on the secure route cache (step 831). Processing continues at step 821 described above.
The illustrative embodiments permit a government to establish a secure path between a trusted host and a destination host, or at least indicating to a destination host that a secure route is unknown to a secure route discovery node. In addition, any secure paths so provided, may expire in a timescale that can make the trusted host responsive to ad hoc revisions of the secure routes database, as might occur if a secure router becomes compromised and stripped of its associated clearance level. One or more illustrative embodiments may detect improperly routed packets, and respond accordingly.
The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems that perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.
The invention can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment containing both hardware and software elements. In a preferred embodiment, the invention is implemented in software, which includes but is not limited to firmware, resident software, microcode, etc.
Furthermore, the invention can take the form of a computer program product accessible from a computer-usable or computer-readable medium providing program code for use by or in connection with a computer or any instruction execution system. For the purposes of this description, a computer-usable or computer readable medium can be any tangible apparatus that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device.
The medium can be an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system (or apparatus or device) or a propagation medium. Examples of a computer-readable medium include a semiconductor or solid state memory, magnetic tape, a removable computer diskette, a random access memory (RAM), a read-only memory (ROM), a rigid magnetic disk and an optical disk. Current examples of optical disks include compact disk—read only memory (CD-ROM), compact disk—read/write (CD-R/W) and DVD.
A data processing system suitable for storing and/or executing program code will include at least one processor coupled directly or indirectly to memory elements through a system bus. The memory elements can include local memory employed during actual execution of the program code, bulk storage, and cache memories, which provide temporary storage of at least some program code in order to reduce the number of times code must be retrieved from bulk storage during execution.
Input/output or I/O devices (including but not limited to keyboards, displays, pointing devices, etc.) can be coupled to the system either directly or through intervening I/O controllers.
Network adapters may also be coupled to the system to enable the data processing system to become coupled to other data processing systems or remote printers or storage devices through intervening private or public networks. Modems, cable modem and Ethernet cards are just a few of the currently available types of network adapters.
The description of the present invention has been presented for purposes of illustration and description, and is not intended to be exhaustive or limited to the invention in the form disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art. The embodiment was chosen and described in order to best explain the principles of the invention, the practical application, and to enable others of ordinary skill in the art to understand the invention for various embodiments with various modifications as are suited to the particular use contemplated.
