WO2013001241A1

WO2013001241A1 - Method for detecting and preventing intrusions in a computer network, and corresponding system

Info

Publication number: WO2013001241A1
Application number: PCT/FR2012/051493
Authority: WO
Inventors: Fabien Thomas; Damien Deville
Original assignee: Netasq
Priority date: 2011-06-29
Filing date: 2012-06-28
Publication date: 2013-01-03
Also published as: FR2977432B1; FR2977432A1

Abstract

The invention relates to a system and a method for detecting and preventing intrusions in a computer network (1), suitable for preventing intrusions by detecting and blocking the latter before the same penetrate the network. The system comprises a firewall (2) capable of analysing data packets (D) streaming over a connection via an analysis engine (3) capable of detecting the presence of malicious data. The firewall is capable of correcting and/or deleting the detected malicious data before transmitting the data packets (D) over the network (1). The firewall (2) is capable of operating in a first mode, in which the data packets (D) are allowed to stream over the connection to the network (1), and in a second mode, in which the connection is temporarily blocked. As long as the analysis engine (3) does not detect any malicious data in a data packet (D), the firewall (2) operates in the first mode. When the analysis engine (3) detects the presence of one or more pieces of malicious data in a data packet (D), the firewall (2) switches to the second mode, corrects and/or deletes the malicious data from the data packet D, resynchronises the connection, and then unblocks the connection in order to return to the first operating mode.

Description

METHOD FOR DETECTING AND PREVENTING INTRUSIONS IN A COMPUTER NETWORK, AND CORRESPONDING SYSTEM.

The present invention relates to a system and method for detecting and preventing intrusions in a computer network, for preventing intrusions by detecting and blocking them before penetration of the network.

In a computer network, the availability of data and its transmission in a context of maximum security is a constant problem. The growing complexity of attacks requires increasingly sophisticated and intelligent network protection. It must indeed be possible in particular to check the contents of data packets that transit, and react to an attack before it has penetrated the network that we seek to protect.

Protection solutions are known, such as the solution shown diagrammatically in FIG. 1, which consist in the use of a relay device 2, for example a proxy or proxy comprising a firewall 2 which analyzes the data packets D traveling on a connection 4 to detect the presence of malicious data and correct or delete this data before the transmission of data packets D on the network 1.

To do this, the proxy captures the connection 4, for example by means of an address translation performed by the firewall 2. This address translation is intended to replace the destination address of the data packets D that of the firewall 2, so that the data packets D are all intercepted and redirected to the firewall 2.

The firewall 2 can then read the content of the data D, for example by means of a "socket" type mechanism, and respond as a conventional server.

Once the firewall 2 has analyzed and possibly cleaned the data D, it must create a new connection 5 to the original recipient of the data. For the traffic to be carried out end-to-end, the new connection 5 must be created at the time of the capture of the original connection 4, and the firewall 2 must pass the data D 'therein in both directions. transparent way.

In this solution, it is therefore a question of a relay device which, for delete the attacks, modifies the original connection 4 by intercepting it, as represented by the dashed cross in FIG. 1. This relay device creates a new connection 5 for regenerating the data packets D 'to be transmitted to the destination .

Such a regeneration is very expensive in terms of performance and resources, because all the data of the connection must be modified, which implies many read / write of data on the original connection and on the new connection created.

Solutions are also known in which the relay device is content to analyze the data packets, and, when malicious data is detected, either to send an alert or to block the data packet until intervention is made. an administrator.

In both cases there is the problem of cleaning the data, the data being either transmitted uncleaned or blocked before manual cleaning.

In the first case, performance is improved because there is no connection capture or temporary blocking of traffic. But the data is not cleaned and the mere sending of an alert is insufficient to foil an attack, once the malicious data is transmitted over the network.

In the second case, data blocking significantly disrupts performance, and data cleansing remains arbitrary.

It is therefore the object of the invention to provide a reliable solution that makes it possible to solve the aforementioned problems among other problems, in particular concerning the effective protection of a network without loss of performance.

To this end, the invention relates, in a first aspect, to a method for detecting and preventing intrusions in a computer network comprising a firewall.

The method includes analyzing data packets circulating on a connection, via a firewall analysis engine capable of detecting the presence of malicious data, the firewall being able to correct and / or delete malicious data previously detected before to transmit data packets over the network.

In addition, the firewall 1e firewall is adapted to operate in a first mode in which it allows the flow of data packets on the connection to the network, and in a second mode in which the connection is temporarily blocked.

As long as the scan engine does not detect any malicious data in a data packet, the firewall works in the first mode.

When the scanning engine detects the presence of one or more malicious data in a data packet, the firewall goes into the second mode, corrects and / or removes the malicious data from the data packet, resynchronizes the connection and then unblocks the connection for a return to the first mode of operation.

In an implementation variant, it is the analysis engine which, in the second mode of operation, performs the correction and / or deletion of the malicious data of the data packet, the resynchronization of the connection and the unblocking of the data. connection for a firewall return in the first mode of operation.

In another implementation variant, possibly in combination with the previous one, in the second mode of operation, the new data packets flowing on the connection are put on hold until the connection is unblocked.

In yet another implementation variant, possibly in combination with one or more of the previous ones, the method according to the invention comprises a step of applying a correction factor to an acknowledgment value and to sending back to the sender of the packet. the corrected acknowledgment value.

This correction factor is a function of the difference between the size of the malicious data before and after the modification and / or deletion of this malicious data.

According to a second aspect, the invention relates to a system for detecting and preventing intrusions in a computer network comprising a firewall. The firewall includes an analysis engine capable of analyzing data packets flowing over a connection and detecting the presence of malicious data.

This firewall is able to correct and / or delete previously detected malicious data before transmitting the data packets on the network.

In addition, the firewall is capable of operating in a first mode in which it allows the data packets to flow over the connection to the network, and in a second mode, triggered by the detection of malicious data by the analysis engine. , the second mode in which the connection is temporarily blocked.

Moreover, in the second mode, the firewall is able to correct and / or delete the malicious data of the data packet, to resynchronize the connection and then to unblock the connection so as to return to the first operating mode.

In a first variant embodiment, the analysis engine is able, in the second mode of operation, to implement the correction and / or deletion of the malicious data of the data packet, the resynchronization of the connection and the unblocking of the data. connection for a firewall return in the first mode of operation.

In another variant embodiment, possibly in combination with the previous one, the firewall is able, in the second mode of operation, to put on hold the new data packets circulating on the connection.

In yet another variant embodiment, possibly in combination with one or more of the preceding embodiments, the firewall, possibly via the analysis engine, is able to apply a correction factor to an acknowledgment value and to return the corrected acknowledgment value to the sender of the data packet.

This correction factor is a function of the difference between the size of the malicious data before and after the modification and / or deletion of this malicious data. Other characteristics and advantages of the invention will appear more clearly and completely on reading the following description of the preferred variants of implementation of the method and system realization, which are given as non-exemplary examples. and with reference to the following appended drawings:

FIG. 1 schematically represents a protection system and its operation in the state of the art, FIG. 2 schematically represents an example of a protection system and its operation according to the invention, FIG. 3 schematically represents an example of implementation. of the process according to the invention.

Regarding Figure 1, it actually corresponds to the state of the art and has been described above.

FIG. 2 diagrammatically shows the protection system according to the invention, which notably comprises a firewall 2. It can of course also include other computing devices, such as storage devices, calculation devices, memory devices input-output, not shown in Figure 2.

The firewall 2 is placed at an entry point of the computer network 1 to be protected, and comprises an analysis engine 3 which makes it possible in particular to analyze the data packets D flowing over an input connection of the network 1.

Each data packet D is received and analyzed by the analysis engine 3 on the original connection, to detect the presence of any malicious data that will be appropriately processed by the firewall 2.

Preferably, the processing of data packets D in case of detection of malicious data is performed by the analysis engine 3 itself. But it can also be achieved by a processing module separate from the analysis engine 3.

As is shown in more detail in FIG. 3, on an exemplary implementation of the method of the invention, the firewall 2 is able to operate in two operating modes respectively A and B.

In the first mode of operation A, the firewall 2 circulates the data packets D on the connection to the network 1, from their sender EXP out of the network 1 to their destination DEST on the network 1.

The firewall 2 operates in this first mode A, as long as the analysis engine 3 does not detect any malicious data in the data packets D,

In the example shown in FIG. 3, the data packet D contains the data DATA, sent by EXP to the destination DEST.

According to the communication protocol between EXP and DEST, data DATA is associated with a sequence number Seq, an acknowledgment value Acq and a value Sz representing the size of the data DATA, ie 4 in this example.

The analysis engine 3 detects no malicious data in the data DATA, so that the data packet D is transmitted to EXP on the original connection.

According to the communication protocol, the destination DEST of the data packet D then sends back to the sender EXP an acknowledgment, indicating, via the acknowledgment value Acq equal to 4, that it has received a data of size 4.

Since this is an acknowledgment step, without data transmission, the size value Sz is 0.

The next transmission sequence of a new data packet D carries a sequence number Seq equal to 4, corresponding to the previous Seq sequence number incremented by the size Sz of the data transmitted to the previous sequence and which has been correctly acknowledged.

The acknowledgment value Acq is 0 because no data has yet passed from DEST to EXP in this new sequence.

The value of size Sz is this time equal to 10 since the data D transmitted is equal to ATTACKDATA (10 characters corresponding to 10 bytes of data).

This new data packet D is analyzed by the analysis engine 3 which detects in this packet the presence of the malicious data dm equal to ATTACK.

The firewall then immediately goes into the second operating mode B, in which the connection is temporarily blocked. In this second operating mode B, the new data packets arriving on the connection can simply be ignored. However, it is preferable not to lose data, so that it is preferable to put the new data packets on hold in a buffer provided for this purpose.

During this time of temporarily blocking the connection, the firewall 2 will correct and / or delete the malicious data or dm detected by the analysis engine 3, and resynchronize the connection to ensure that the corrected data are actually received and paid by the EXP / DEST equipment.

When the connection is resynchronized, the connection can effectively be unblocked by the firewall 2, which corresponds to a return of the firewall 2 in the first mode of operation A.

All or part of these blocking processing of the connection, correction and / or deletion of the malicious data dm, resynchronization of the connection and release of the connection, may possibly be carried out directly by the analysis engine 3, as represented in FIG. figure 3.

In this example shown in FIG. 3, the analysis engine 3 having received from EXP the data packet D corresponding to ATTACKDATA and having detected the presence of the malicious datum dm in this data packet D, performs the deletion of dm, so that it transmits to DEST only the data D equal to DATA, that is to say a data D cleaned.

To this data D equal to DATA, transmitted to DEST, are associated the sequence number Seq equal to 4, the acknowledgment value Acq equal to 0, and the size value Sz which is equal to 4.

It can thus be seen that the correction of the data packet D would induce an offset in the sequences, so that if no processing is performed, the recipient B can not acknowledge receipt in the manner expected by EXP, and the acknowledgment mechanism according to the communication protocol is disturbed.

That is why the DEST recipient of the data packet D will send back to the sender EXP an acknowledgment, indicating via the value acknowledgment Acq equal to 8 that he received a data of size 8

(corresponding to the cumulative size of the previous data and the size of the new data).

As for the previous sequence, since this is an acknowledgment step, without data transmission, the size value Sz is 0.

However, the sender EXP expects an acknowledgment on the basis of an Acq value equal to 14 corresponding to the accumulation of the size of the previous data packet already acknowledged (DATA) and the size of the data packet being processed (ATTACKDATA ).

Also, the analysis engine 3 applies a correction factor fc equal to 6, the cumulative increase from 8 to 14, to avoid the phenomenon of aforementioned shift.

This correction factor fc effectively corresponds to the difference between the size of the data D before correction and the size of this data D after correction, ie 6 (for 10 minus 4) in the example represented in FIG.

Equivalently, it can be said that this correction factor fc effectively corresponds to the difference between the size of the malicious data dm before correction and the size of this malicious datum dm after correction, ie 6 (for 6 minus 0) in the example shown in Figure 3 in which the correction is a deletion.

In this example, it has been schematically considered that the data packet D corresponding to ATTACKDATA contained a malicious portion dm equal to ATTACK and a healthy portion DATA, and therefore this malicious data dm was deleted.

The reasoning is equivalent if one considers that the packet of data D corresponding to ATTACKDATA constitutes itself the malicious data, in which case one modifies this malicious data to make it healthy.

In both cases, the correction factor fc mentioned above is equal to 6.

Thus, the analysis engine 3 can return to the sender EXP the acknowledgment value 14 that it expects.

The connection is then resynchronized, and the firewall can unblock this connection for a return to the first operating mode A in which the next data packet will be analyzed.

If the data packets have been put on hold during the temporary blocking of the connection, as explained above, the first data packet arrived during the blocking is transmitted and analyzed by the analysis engine 3,

If, on the other hand, no mechanism for stopping the data packets is provided, it is the first data packet arriving after the unblocking of the connection that is transmitted and analyzed by the analysis engine 3, the previous ones packets being lost.

The whole of the description above is given by way of example and is not therefore limiting of the invention.

In particular, the invention is not limited to resynchronizing the temporarily blocked connection by applying a correction factor in the acknowledgment mechanism. More generally, this resynchronization is a function of the communication protocol and consists in making the correction of the malicious data transparent to the sender by making him believe that the data packet concerned has been fully transmitted to the recipient.

Claims

A method for detecting and preventing intrusions into a computer network (1) having a firewall (2), including analyzing data packets (D) traveling on a connection, via a an analysis engine (3) of the firewall (2), said analysis engine (3) being able to detect the presence of malicious data (dm), and said firewall (2) being adapted to correct and / or delete the malicious data (dm) previously detected before transmitting the data packets (D) on said network (1),

characterized in that said firewall (2) being operable in a first mode (A) in which it allows said data packets (D) to flow on said connection to the network (1), and in a second mode (B) wherein said connection is temporarily blocked,

as long as the analysis engine (3) does not detect any malicious data (dm) in a data packet (D), the firewall (2) operates in the first mode (A),

and when said analysis engine (2) detects the presence of one or more malicious data (dm) in a data packet (D), the firewall (2) goes into the second mode (B), corrects and / or deletes the malicious data (dm) from the data packet (D), resynchronizes the connection and then unblocks the connection for a return to the first operating mode (A).

2. Method according to claim 1, characterized in that, in the second operating mode (B), the correction and / or deletion of the malicious data (dm) of the data packet (D), the resynchronization of the connection and the unblocking the connection for a return of the firewall (2) in the first operating mode (A), are performed by the analysis engine (3).

3. Method according to any one of claims 1 and 2, characterized in that in the second operating mode (B), the new data packets circulating on the connection are put on hold, until unblocking said connection,

4. Method according to any one of claims 1 to 3, characterized in that it comprises a step of applying a correction factor (fc) to an acknowledgment value (Acq) and to send back to the sender of the data packet (D) said corrected acknowledgment value (Acq), said correction factor (fc) being a function of the difference between the size of the malicious datum (dm) before and after the modification and / or deletion of this datum malicious (dm).

5. System for detecting and preventing intrusions in a computer network (1) comprising a firewall (2) comprising an analysis engine (3) capable of analyzing data packets (D) circulating over a connection and detecting the presence of malicious data (dm), said firewall (2) being able to correct and / or delete the malicious data (dm) previously detected before transmitting the data packets (D) on said network (1) ,

characterized in that said firewall (2) is operable in a first mode (A) in which it allows said data packets (D) to flow on said connection to the network (1), and in a second mode ( B), triggered by the detection of malicious data (dm) by said analysis engine (3), wherein said second mode (B) said connection is temporarily blocked, and in that second mode (B) said said -feu (2) is able to correct and / or delete the malicious data (dm) of the data packet, to resynchronize the connection and then to unblock the connection so as to return to the first operating mode (A).

6. System according to claim 5, characterized in that, in the second operating mode (B), the analysis engine (3) is able to implement the correction and / or deletion of the malicious data (dm) of the data packet (D), the resynchronization of the connection and the unblocking of the connection for a return of the firewall (2) in the first operating mode (A).

7. System according to any one of claims 5 and 6, characterized in that in the second operating mode (B), the firewall (2) is able to put on hold the new data packets flowing on the connection.

8. System according to any one of claims 5 to 7, characterized in that the firewall (2), possibly via the analysis engine

(3), is adapted to apply a correction factor (fc) to an acknowledgment value (Acq) and to return to the sender of the data packet (D) said corrected acknowledgment value (Acq), said factor correction (fc) depending on the difference between the size of the malicious data (dm) before and after the modification and / or deletion of this malicious data (dm).