System and method for receiving and processing a signal within a TCP/IP protocol stack

Abstract

A method for receiving and processing a covert transmission within a TCP/IP protocol stack is described. An IP protocol layer receives a datagram comprising covert data. The datagram is adapted to appear as an error at a TCP layer. The datagram is intercepted at an IP layer routine below the TCP layer. The intercepted datagram is processed by an extension of an IP layer routine.

Description

TECHNICAL FIELD

Exemplary embodiments relate generally to a system and method for receiving and processing packets of data over a TCP/IP network.

BACKGROUND AND BRIEF SUMMARY OF THE INVENTION

Two of the most important communication protocols used on the Internet and other similar networks are the Transmission Control Protocol (TCP) and the Internet Protocol (IP). Together, the TCP and IP protocols form core protocols of the larger Internet protocol suite used on packet-switched networks. That protocol suite is commonly referred to as the TCP/IP protocol because of the widespread adoption and implementation of the TCP and IP protocols.

The TCP/IP protocol was developed for the United States Advanced Research Projects Agency (ARPA). The TCP/IP protocol is a set of rules that enable different types of network-enabled or networked devices to communicate with each other. Those network devices communicate by using the TCP/IP standard, or format, to transfer or share data. TCP/IP rules are established and maintained by the Internet Engineering Task Force (IETF). The IETF is an international community of network designers, operators, vendors, and researchers concerned with the Internet's architecture and operation. The IETF's mission is to produce technical and engineering documents that influence the way people design, use and manage the Internet with the goal of improving its operations and efficiencies. These documents include protocol standards, best current practices and information updates of various kinds, and are commonly referred to as Request for Comments (RFC).

TCP can be used to establish a bi-directional connection between two clients wherein activity begins with a request for information made by one client to another client. A “client” is any program or application that initiates requests for, or sends information from, one remote location to another. As used herein, the term “client” may refer to such applications including, but not limited to, web browsers, web servers, file transfer protocol (FTP) programs, electronic mail programs, line printer (LPR) programs also known as print emulators, mobile phone apps, telnet programs also known as terminal emulators, and the like, all of which may operate conceptually in an application layer.

TCP software accepts requests and data streams directly from clients and other daemons, sequentially numbering the bytes, or octets, in the stream during the time the connection is active. When required, the TCP software breaks the data stream into smaller pieces called segments (sometimes referred to as datagrams or packets generally) for transmission to a requesting client. The protocol calls for the use of checksums, sequence numbers, timestamps, time-out counters and retransmission algorithms to ensure reliable data transmission. [RFC 793, 1981]

The IP layer actually performs the communication function between two networked hosts. The IP software receives data segments from the TCP layer, ensures that the segment is sized properly to meet the requirements of the transmission path and physical adapters (such as Ethernets and CTCs). IP changes the segment size if necessary by breaking it down into smaller IP datagrams, and transmits the data to the physical network interface or layer of the host. [RFC 791, 1981]

The software that manages handling the TCP/IP RFCs may be referred to as a TCP/IP protocol stack. It may be referred to as a stack because the different protocols are often layered into this type of organization. A TCP/IP stack may have the following layers: 1) Link drivers, 2) ARP, 3) IP, 4) TCP, 5) SSL/TLS, and 6) Applications. Inbound data may transfer from layer 1 to layer 6 in turn and outbound data may take the reverse direction going from layer 6 to 1.

Depending on the implementation, these different layers can operate under the same process, or can function independently. Within the IP layer, there are several separate operational functions: 1) address resolution, 2) routing, 3) fragmentation, and 4) protocol isolation. Again, inbound data may use these functions from 1 to 4 in secession and outbound data may go in reverse order from 4 to 1.

A frame of inbound data may work its way through the stack. The inbound data may be broken down until the final payload that is destined for an application is exposed. Once the application completes operating upon the information, the response may once again be passed to the stack. On the outbound operation, additional tags and headers may be constructed that will be required to deliver the information back to its origin.

The highly defined, structured, and open nature of TCP/IP protocol stacks does not lend itself to preventing actions intended to be performed covertly (hereinafter also “covert actions”) from being readily observed. Once it has been established that a payload of data which the user desire to remain covert (hereinafter also a “covert payload”) can arrive at a host destination, it would be advantageous to establish how such a covert payload may be processed without being readily observed.

The present invention is directed to a system and method for accepting and processing a covert payload that avoids ready detection and observation by the receiving host. The information containing the covert payload may be intercepted within a lower level of the processing stack. A process of execution may be performed which bypasses the section of stack processing that normally opens the communication to ready observation. In this way, a covert action may be inserted into the host system without ready detection.

Further features and advantages of the systems and methods disclosed herein, as well as the structure and operation of various aspects of the present disclosure, are described in detail below with reference to the accompanying figures.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS

Novel features and advantages of the present invention, in addition to those mentioned above, will become apparent to those skilled in the art from a reading of the following detailed description in conjunction with the accompanying drawings wherein identical reference characters refer to identical parts and in which:

FIG. 1 is a visual representation of an exemplary TCP/IP stack;

FIG. 2 is a visual representation of exemplary processes that occur at the IP layer of the TCP/IP stack of FIG. 1; and

FIG. 3 is a visual representation of an exemplary data flow through the IP stack of FIG. 2.

DETAILED DESCRIPTION OF EXEMPLARY EMBODIMENT(S)

Various embodiments of the present invention will now be described in detail with reference to the accompanying drawings. In the following description, specific details such as detailed configuration and components are merely provided to assist the overall understanding of these embodiments of the present invention. Therefore, it should be apparent to those skilled in the art that various changes and modifications of the embodiments described herein can be made without departing from the scope and spirit of the present invention. In addition, descriptions of well-known functions and constructions are omitted for clarity and conciseness.

Embodiments of the invention are described herein with reference to illustrations of idealized embodiments (and intermediate structures) of the invention. As such, variations from the shapes of the illustrations as a result, for example, of manufacturing techniques and/or tolerances, are to be expected. Thus, embodiments of the invention should not be construed as limited to the particular shapes of regions illustrated herein but are to include deviations in shapes that result, for example, from manufacturing.

FIG. 1 and FIG. 2 are visual representations of what a typical TCP/IP stack and IP layer functions may entail.

Data Flow

An incoming payload or portion of an IP datagram that contains covert data 310 may arrive through an electrical interface and pass to the IP layer 210 for processing. This covert data 310 may enter the IP layer 210 and appear the same as other network traffic 312.

Covert insertion of information into a remote system may require the active operation of a robust implementation of a TCP/IP protocol stack 110. This implementation may be one where the source is tightly controlled, either through proprietary means, or by careful and undisclosed modifications to open source availability.

All data flow in and out of the TCP/IP stack 110 must conform correctly to all known standards of operation in order to allow such data flow to pass therethrough successfully. By providing consistent operation, the containment of covert data 310 may be masked by normal operations. Inbound and outbound data is first and foremost properly structured IP datagrams, or low-level address resolution in nature. These datagrams may contain higher level requirements and may match and conform to layers such as TCP or UPD, for example without limitation.

Any arriving covert payload 310 must be contained within the normal dataflow 312 of the TCP/IP stack 110. Covert data 310 that does not conform to recognized protocols will normally be isolated and exposed. While there are numerous methods that may be used for transmission, the covert payload 310 that appears part of normal data flow 312 will be unnoticed and unobtrusive. It is possible to contain covert information 310 directly within a standard transmission 312 destined for an application, however that application and data transmission will be recorded and observable to monitoring systems and facilities. Therefore, the transmissions of covert data 310 must be contained within standard data traffic 312, and yet be extracted and processed via unexpected portions of the IP layer 210 protocols that exist below the TCP layers protocols.

Covert Interception

As illustrated in FIG. 3, a packet of covert data 310 may be intercepted by a covert extraction 314 routine inserted within one of the normal IP layer 210 routines of the TCP/IP protocol stack 110. In other exemplary embodiments, the covert extraction 314 may be a routine inserted above, below, or between normal IP layer 210 routines. In still other embodiments, the covert extraction 314 routine may be an extension of one or more layers of the normal IP layer 210 routines.

Regardless, by intercepting the covert data 310 at this level of processing, the covert interception 314 mechanism can isolate, extract, and perform a covert processing 316 routine on the extracted covert data 310. The cover data 310 may be further treated as nonsense for the rest of normal operation and processing through the TCP/IP protocol stack 110. TCP/IP protocol stacks 110 are typically designed to deal with the potential of erroneous data produced by normal IP network traffic 312, and these failed pieces of information are normally be discarded without further notation or observation. Therefore, the covert interception process 314, which may be inserted between normal operations and the discard mechanism, may be used to read what otherwise appears to be nonsense, but which actually contains the covert payload 310.

Covert Processing

Once a covert payload 310 has been intercepted 314 within the IP layer 210 of a TCP/IP protocol stack 110, the covert payload 310 may be passed to a covert processing routine 316 for processing. Such covert processing 316 may comprise, for example without limitation, decoding of the covert data 310, which may be encrypted. While it is possible to spawn a process to handle this operation, the existence of an observable process may expose the existence of the covert interception 314 routine. Therefore, any processing 316 of covert data 310 may occur as an extension of the interception 314 routine, which may be an extension of, or inserted between, normal routines in the IP layer 210. In this way, existence of the covert processing 316 routine is further obfuscated. As this process may extend the IP layer 210, it is possible that a wide range of operations within the operating system may occur.

Any embodiment of the present invention may include any of the optional or preferred features of the other embodiments of the present invention. The exemplary embodiments herein disclosed are not intended to be exhaustive or to unnecessarily limit the scope of the invention. The exemplary embodiments were chosen and described in order to explain some of the principles of the present invention so that others skilled in the art may practice the invention. Having shown and described exemplary embodiments of the present invention, those skilled in the art will realize that many variations and modifications may be made to the described invention. Many of those variations and modifications will provide the same result and fall within the spirit of the claimed invention. It is the intention, therefore, to limit the invention only as indicated by the scope of the claims.

Claims

1. A method of receiving and processing a covert transmission within a TCP/IP protocol stack, said method comprising: receiving network traffic at an electrical interface, wherein the network traffic comprises normal network traffic and a datagram, intermingled with the normal network traffic and comprising data for covert delivery at an IP protocol layer, wherein said datagram is artificially manipulated to appear as a non-conforming data transmission at the IP layer by inaccurate description of one or more features of the datagram in a fashion which prevents normal processing through the TCP/IP protocol stack;intercepting said datagram at a covert interception routine inserted as an extension of at least one of the IP protocol layers;processing said datagram at a covert processing routine to extract said data for covert delivery; andsubsequently discarding the datagram as a non-conforming data transmission at the IP layer.

2. The method of claim 1 wherein: the covert processing routine is an extension of the covert interception routine.

3. The method of claim 1 wherein: the IP protocol layer comprises: a link level routine,an address resolution routine,a routing routine,a fragmentation routine, ora protocol isolation routine.

4. The method of claim 3 wherein: the covert interception routine is an extension of the link level routine.

5. The method of claim 3 wherein: the covert interception routine is an extension of the address resolution routine.

6. The method of claim 3 wherein: the covert interception routine is an extension of the routing routine.

7. The method of claim 3 wherein: the covert interception routine is an extension of the fragmentation routine.

8. The method of claim 3 wherein: the data for covert delivery is encrypted; andthe covert processing routine is configured to decrypt the data for covert delivery.

9. The method of claim 1 wherein: the datagram is inaccurately described as a non-initial fragment of a larger transmission.

10. The method of claim 1 wherein: the datagram is an ICMP error message.

11. A method of receiving and processing a covert transmission within a TCP/IP protocol stack, said method comprising: receiving, at an electrical interface, normal network traffic;passing the normal network traffic to an IP protocol layer;receiving, at the IP protocol layer, a datagram, intermingled with the normal network traffic and comprising data for covert delivery, wherein said datagram is artificially manipulated to appear as an error when processed at a IP layer by indicating the datagram to be a non-primary fragment of a larger transmission, where said larger transmission is not included within a remainder of the normal network traffic;prior to a timeout period, intercepting said datagram, while permitting normal processing of the remainder of said normal network traffic, at a covert interception routine extending from a routine located with the IP protocol layer and below the IP layer;processing said datagram, while permitting normal processing of the remainder of said normal network traffic, at a covert processing routine to extract said data for covert delivery, wherein said covert processing routine is an extension of the covert interception routine; andsubsequently continuing normal processing of said datagram such that said datagram is discarded as appearing as an error at the IP layer at or following expiration of the timeout period.

12. A system for receiving and processing a covert transmission within a TCP/IP protocol stack, said system comprising: a transmitting computerized system operating the TCP/IP protocol stack and a covert data transmission routine; anda receiving computerized system operating the TCP/IP protocol stack, a covert interception routine inserted as an extension of at least one of the IP protocol layers of the TCP/IP protocol stack, and a covert processing routine, wherein said receiving computerized system is connected to the transmitting computerized system by way of one or more TCP/IP networks;wherein said transmitting computerized system is configured to generate a datagram using the covert data transmission routine by including covert data within the datagram with at least one or more inaccurately described features which prevent normal processing through the TCP/IP protocol stack at the receiving computerized system;wherein said receiving computerized system is configured to: receive network traffic by way of the one or one or more TCP/IP networks, said network traffic including said datagram;process said network traffic, including processing the network traffic through the TCP/IP protocol stack, intercepting said datagram at the covert interception routine and processing said datagram through the covert processing routine to extract said covert data, and subsequently resume processing of the datagram through the TCP/IP protocol stack, including discarding the datagram as a non-conforming data transmission at the IP layer due to the one or more inaccurately described features.

13. The system of claim 12 wherein: the one or more inaccurately described features comprise indicating the datagram to be a non-initial fragment of a larger transmission.

14. The system of claim 12 wherein: the network traffic comprises ICMP error messages; andsaid datagram comprises one of the ICMP error messages.