WO2016055668A1 - Device and method for protection in communication networks - Google Patents

Abstract

The invention relates to a device (1) for protection against denial-of-service attacks, which can encrypt and decrypt the data packets flowing therethrough, said device being connected to any point in a telecommunications network, in a service provider system. An algorithm programmed in the protection device (1) analyses the Ethernet packets of the traffic circulating in the network, on the physical layer level. The protection device can encrypt and decrypt the network traffic and can detect, within said network traffic, the packets intended to cause a DoS attack, said packets being rejected and not retransmitted to the network downstream.

Description

 "DEVICE AND METHOD OF PROTECTION IN NETWORKS OF

 COMMUNICATIONS '

 DESCRIPTION

 Object of the invention

 The present invention relates to a device and a method of protection in communications networks, in particular a hardware device and a method specifically designed to provide protection against DoS denial of service attacks by flooding a computer system, capable of encrypting and decipher the information that flows through it, connected to a telecommunications network, thus acting as a method of protection against attacks of information theft, by illicit access to the telecommunications network used.

State of the art

 The use of security devices that protect computers, computer systems or network nodes critical against attacks that attempt to saturate them by sending them disproportionate amounts of data packets that the attacked system cannot process due to overflow of resources, is a known practice Faced with the use of protection means via software installed on the same computer to be protected, the use of protection devices via hardware has advantages of rapid evaluation and response, reduction of system latency and reduction of the consumption of necessary resources of the computer itself to protect to stop the attack.

European Patent EP-2 256 298 and publication of US Patent Application US-2003/0065943 Al they refer to a protection system based on a personal computer that rejects received data packets that violate a specific package rejection policy. The device verifies that the length and sum of each packet of received IP data matches the information declared in the header of the IP packet itself. The weakness of this type of system is that it requires oversized hardware to operate, not embedded and of considerable dimensions. The algorithms introduced may not be easily expandable or modifiable.

 There are also other patent documents and patent applications, such as the publication of US patent application US-2005/0144467 Al, in which it is intended to solve the problem posed from the perspective of the implementation of a firewall that performs the packet filtering through software, which is beyond the scope and content of this patent for having the aforementioned weaknesses as for the protection based on algorithms implemented by software.

 Defining in detail the problem to be solved, it is established that a plurality of computers are connected to transmit data through a telecommunications network of the Internet network type, transporting data packets on these communication channels between the computers connected to the ends of these communication channels. The computers are associated to an IP address respectively, so that each IP packet transported by the transport network includes an origin and destination address in order to allow the correct addressing of them.

Although the nodes of the communications network do not properly have an assigned IP address, attacking them is fairly simple knowing its geographical location, based on attacking the IP addresses dependent on the node itself.

 For example, for the "SYN flood" type attack, who wants to perform this type of attack against a particular computer with a specific IP, sends a large number of connection establishment request packets, in case of using protocol TCP, in order to saturate the computer's ports with information flow, causing the computer to overload and, therefore, cannot continue to provide services; This is why it is called a "denial attack", because it makes the computer unable to manage user request packages, causing a service or resource to be inaccessible to legitimate users. Therefore, the attacked computer denies the service to legal users, this technique being known as denial of service attack by service saturation, that is Denial Of Service Attack (DoS) or Distributed Denial Of Service Attack (DDoS) when the origin It is from multiple attacking computers.

 The high traffic generated by the attacking computers seems to be legal traffic in the transport layer, being difficult to filter it effectively with a firewall without consuming 100% of the resources of the firewall itself, thus leaving the attacked computer without resources available to serve legitimate users.

Consequently, there is a need in the current state of the art to reduce the denial of service of a computer to legitimate users, without the need for the use of a downstream firewall, whose effectiveness lies in rules defined by software and in the resources of available hardware, forcing these techniques to increase their own firewall resources if you want to achieve greater system effectiveness.

 The characteristic of the protective device to encrypt and decrypt the information that flows through it, responds to the problem of the existence of intruders or attackers who wish to carry out a Man in the Middle (MIM) attack. These attacks are based on the fact of being able to read the unencrypted communications, obtain sensitive security data, such as passwords, credentials or electronic certificates, etc., of the victim of the attack that transmits this information over the existing telecommunications network . The ability to create virtual private networks, VPNs, between computers separated by the public telecommunications network allows partially solving this problem of Man in The Middle attacks.

 A VPN network is simply a network in which an encryption algorithm is used between point to point so that no one accessing the same network can decrypt the content of a communication.

 The fact of using a computer program, software, to encrypt and decrypt communications between two computers is well known, being the encryption method and the way to execute the encryption, the options that a user has and that distinguish a other system.

 One of the problems that a user faces is to think that he or she is in a secure communication network without being one, either through a spoofing of the SSL certificates or because their computer is infected by a computer virus. Such computer viruses can alter SSL certificates and give the impression of being encrypting outgoing information without actually being.

The International Patent Publication Document WO-2013/098424 Al describes a device and a method of protection against denial of service Two due to flooding of a computer system connected to a telecommunications network whose content underlies the basis of the present specification. The present invention constitutes a clear improvement of the device and method described in the aforementioned document.

Summary

 The present invention seeks to solve one or more of the problems set forth above by means of a method and a protective device protecting against denial of service by saturation that is also capable of encrypting and decrypting the communications of a computer system connected to a telecommunications network. , avoiding MIM attacks.

 An aspect of the invention is to provide an integrated protective device that identifies or recognizes malicious data packets, associated with attacks of the flood attack type, such that the protective device recognizes and protects computers or computer networks from attacks by denial of service, rejecting or retransmitting Ethernet packets of incoming traffic to the internal network, according to certain standards, all with a hardware configuration specifically designed for it.

 The fact of recognizing a denial of service attack is something well known but not very efficient to carry out through software, due to the amount of CPU resources consumed in it.

A decision tree is provided herein in which the manner of recognizing malicious data packets and their rejection is defined, whose flow diagram will be explained later in relation to Figure 3C. The number of analysis rules implemented in this device it can vary and consequently it can be increased by modifying the rejection policy in charge of making the decisions to transmit (or not) an Ethernet packet. This policy is recorded on the protective device itself, by its introduction using, for example, the USB connection of that device.

 The flow chart of the way to decrypt the data packets will be explained later in relation to Figure 3B. This figure illustrates the incoming data traffic in the protective device from upstream. The number of decryption methods on this device can be increased by modifying the firmware, using the USB connection of that device.

 As for the data packets that circulate in the opposite direction, that is, those that come from the computer, computer network or node to be protected and are directed towards the users connected to them, these can be encrypted following the same technique and diagram of flow of figure 3B; Depending on the port, application or IP address, the information will be encrypted with a specific method and password.

 Still another aspect of the present invention is to provide a protective device that prevents saturation of the bandwidth at the entrance of the attacked system and, in addition, prevents all computer resources of said system from being consumed.

Still another aspect of the invention is to provide a flood protection device for DoS attacks from an external network. The protective device may be connected, on the one hand, to the communications network, such as that of the Internet, and on the other hand, to the internal network to be protected, consisting of one or more computers providing the attack object or a node network, and can even be connected in series more than one protective device in order to increase The protection capabilities.

 The protective devices can be connected in series, being able to implement rules against different denial of service attacks according to the different connected devices, in order to improve security if a device by itself becomes overloaded.

 In the same way, two or more devices can be connected in series in order to improve security, if the bandwidth were such that it would be more convenient to separate the encryption and decryption stages into two different devices.

 A further aspect of the invention is to provide a protective device comprising a programmable general purpose logic type device, composed of logic blocks communicated by FPGA (Field Programmable Gate Array) programmable connections, governed for example by a microprocessor.

 Another possible aspect of the invention is to be able to provide a protective device comprising at least one FPGA or two connected in series, which may be negatively fed back. The negative feedback is that the first FPGA, to which the data packets arrive, is responsible for filtering the data packets that the second FPGA estimates as part of an attack.

 Another additional aspect of the present invention is to be able to supply a device with more than two FPGAs, with different functionalities (encryption, decryption, filtering and detection of DoS attacks) governed by the same microprocessor. Said microprocessor is electronically connected in parallel with the FPGAs that comprise the system.

Still another additional aspect of the invention is to provide a protective device comprising at least one FPGA directly connected by its control. of media access, MAC, to a microprocessor that in turn is connected to a high speed access memory unit. These connections between the FPGA MAC and the microprocessor are of the serial-parallel type.

 A further aspect of the invention is to provide a protective device comprising at least one FPGA directly connected by its MAC to two microprocessors, each of which is in turn connected to a high speed access memory unit. These connections between the microprocessors and the memories are in parallel.

 Still another aspect of the invention is to provide a protective device without an assigned or determined IP address, not at least for the external network, and which, therefore, cannot be attacked by not having visibility on the network itself. not be an addressable device from upstream.

Brief Description of the Figures

 A more detailed explanation of the device according to embodiments of the invention is given in the following description based on the attached figures in which:

 Figure 1A shows a simplified block diagram of a telecommunications network such as the Internet, connected to a protection device (1) according to the invention and to a computer network;

 Figure IB shows a simplified block diagram of a telecommunications network such as the Internet, connected to the protection device (1) according to the invention and to the computer network through a firewall (2), illustrating that the protection device is compatible with this configuration;

Figure 1C shows a simplified block diagram of a telecommunications network such as the Internet, with the protective device (1) of the invention connected within the network to a node on which the connection of critical points of the telecommunications network depends;

 Figure 2A shows a simplified block diagram of the protection device (1) according to the invention, comprising physical layer connectors of Ethernet interfaces, PHY, (50) and (56), an FPGA (52) with its access control of media, MAC, (51) connected to a microprocessor (53) in turn connected to two solid fast access memories (54) and (55);

 Figure 2B shows a simplified block diagram of the protection device (1) according to the invention comprising physical layer connectors of Ethernet interfaces, PHY, (50) and (56), an FPGA (52) connected to two microprocessors (53) and (62) in turn each connected to two solid quick access memories, (54), (55) (63) and (64);

 Figure 2C shows a simplified block diagram of the protection device (1) according to the invention comprising physical layer connectors of Ethernet interfaces, PHY, (50) and (56), two FPGAs (52) and (57) in turn connected to two microprocessors (53) and (62) respectively by each MAC media access control of each FPGA (51) and (58) respectively, and where each microprocessor is in turn connected to two solid fast access memories (54 ), (55) (63) and (64);

 Figure 2D shows a simplified block diagram of the protection device (1) according to the invention, comprising physical layer connectors of Ethernet interfaces, PHY, (50) and (56), two FPGAs (52) and (57) with their respective MAC media access controls (51) and (58) connected to a microprocessor (53) which in turn is connected to two solid fast access memories (54) and (55);

Figure 3A shows a flow chart simplified in which the decision tree that applies the protection device (1) according to the invention is represented, by reading the information packets that arrive through the telecommunications network, upstream, to perform its filtering and / or decryption of incoming data packets, before transmitting them downstream;

 Figure 3B shows a flowchart depicting the decision tree that applies the protection device (1) of the present invention in the decryption or decryption stage mentioned in Figure 3A, and

 Figure 3C shows a flow chart depicting the decision tree that applies the protection device (1) according to the invention, in the filtering stage, against denial of service attacks, mentioned in Figure 3A.

Description of an embodiment

 According to a preferred embodiment, the protection device (1) proposed by the present invention has been designed so that it is connectable, on the network side, through an Ethernet network line, to a telecommunications network for the transport of data packets of the IP datagram type and, on the client side, it is configured so that it is connectable through an Ethernet network line, also to a computer or to a computer system or network to recognize or identify packets received from an attacking sender user and encrypt and decrypt data packets whose destination is a computer connected downstream of the protection device (1).

Therefore, the protection device (1) is capable of receiving all the network packets whose recipient is located downstream of the device protection (1), and consequently, the protection device (1) is adapted to analyze the Ethernet packets that come from the transmitter, upstream, destined for the system that is downstream or behind the protection device (1).

 In a scenario where a flood attack develops, a recipient computer receives a plurality of "malicious" packets, generated from at least the same source computer, connectable to the destination computer via the network connection. The protection device (1) is programmed to receive all network packets through an input / output interface (3), process them and analyze them at a low level through a custom programmable hardware system, being able to identify and block those considered attackers, and retransmit those that are not considered as such.

 The traffic of data packets coming from the upstream network passes through the physical layer connectors of Ethernet interfaces (PHY) (50) connected to the data packet input interface to later pass through the access control input of media (media access control, MAC) (51) implemented in the FPGA, which allows the microprocessor to access the information in the data packets in order to perform filtering at the link layer level, avoiding having to pass to upper layers, thus being able to perform these operations in a smaller number of clock cycles.

To perform the filtering, the Ethernet Type (indicator of the frame encapsulation protocol) is extracted from the Ethernet frame in addition to the IP and TCP headers, corresponding to the network and transport layers, at the physical layer level. This information passes from the FPGA input (52) to the microprocessor (53) responsible for governing the same FPGA through a memory access Direct (Direct Memory Access, DMA) (54), (55). In this way, the data packets that enter the device sequentially, can be read in parallel from a memory (DMA) to facilitate its processing, and thus be able to perform these operations in a very small number of clock cycles. It is the MAC (51) of the FPGA (52) that manages the DMA (54) and (55) so that it saves the packets that arrive in a serial way and that it is the microprocessor (53) that accesses that memory in parallel

 To determine whether a frame fits the scheme used in DoS attacks, the device must perform a set of ordered mathematical operations, an algorithm, in which the characteristics of each different denial of service attack are checked (see flowcharts of Figures 3A to 3C).

 There is a pre-established check order in the firmware, which can be altered by an electronic notification coming from downstream through the USB port, if the server, computers or nodes to be protected by the protective device (1) consider that the defense against a type Specific attack is a priority. This information entry with extra filtering requirement is clearly shown in Figure 3C

 The protective device has an SRAM memory directly connected to the microprocessor (53) responsible for governing one or more FPGAS, which serves to save the already filtered IP addresses and another SRAM memory that fulfills a temporary memory function to perform the encryption calculations and decryption of information. These two memories can be merged into a single memory as long as the internal memory of the FPGA has sufficient capacity to store the information necessary to encrypt and decrypt the information.

When a data package meets the requirements and is has exceeded the number of packets from which an IP address is blocked (filtered), the device stores that IP together with a time stamp in the SRAM memory. In this way, each time a frame that matches the scheme is reviewed by the software, it will first review the SRAM memory to check if said IP is blocked or not and act accordingly. In this way a higher processing speed is achieved.

 The IP address of each data packet is compared with those previously stored in SRAM memory in very few clock cycles. That is, said information arrives through the Ethernet connection (50) or (56), it is extracted at the link layer level by the microprocessor, which is responsible for checking the various fields that indicate if a packet complies with the scheme required for Be identified as a possible attack. If the package is identified as a possible attack, the microprocessor checks if the address is stored in the SRAM memory responsible for storing IP addresses. If said address is in memory, and the blocking of said IP is still active (within the time range described by a time stamp in a memory cell adjacent to the memory cell itself responsible for storing the corresponding IP address) proceed to discard the package. If the IP address stored in the SRAM memory is not found, and in case the criterion for a data packet is estimated as part of a denial of service attack, from which an IP is blocked, the The microprocessor will add that address to the SRAM memory along with the time stamp.

When a data packet is detected to be part of a denial of service attack, this packet is instantly discarded in the FPGA upon receipt of the instructions from the microprocessor, except for its address IP, TCP and Ethernet type that are stored in SRAM memory to compare with subsequent packets.

Each time the system receives a new IP, the software must scan the memory to check if that IP has already been previously blocked. In situations where the number of IPs stored in the SRAM is small, this is not a problem. In the case where the number of stored IPs is high, it may be the case that the system has to go through the entire memory to find (or not) a specific IP address. To avoid this, since it would penalize the performance of the system, the software divides the memory into blocks of identical size. The software uses the last component of the IP addresses as a method of selecting the memory block to which it should go, or in which it must search for that IP. For this reason, the IP address memory is specially integrated in the system so that the microprocessor can use the IP address itself as part of the information to be sent via the address bus to the memory unit. To perform this operation, the microprocessor applies an offset to the base IP address of the memory based on the IP block in which the IP address must be searched / saved. Once the base address is obtained, the microprocessor will increase the offset, at the physical layer level by the address bus; until the end of the memory is reached, the first empty position is reached or a positive search result is obtained. In the event that greater optimization is required, the task of increasing the offset to traverse the different memory positions can be carried out by a separate element independent of the microprocessor and directly connected between the microprocessor and the SRAM memory comprising a memory buffer and an electronic counter capable of operating at the layer level physics, thus freeing the microprocessor from this task to be able to focus on another series of operations.

If a data packet is not estimated as part of a denial of service attack, it is retransmitted in the shortest possible time. That is, once the necessary operations have been carried out on a package in the microprocessor, the microprocessor, this will indicate the Scatter-Gather Direct Memory Access (SGDMA) _. The base address from which the packet to be transmitted downstream is located. Once the SGDMA receives this address, the SGDMA will transform this information (which is already in parallel in this point) into a serial data stream that can be received by the system's transmission MAC for downstream retransmission.

 The traffic coming from the protected system downstream, and that circulates to the network does not require filtering, the data packets coming from the PHY (50) of the data entry interface from downstream are connected to the FPGA module that in turn, it will send the data to the microprocessor (53) for later encryption if the ports or application require it, before retransmitting the data packet to the PHY interface of upstream data output, in this way the traffic does not pass through the microprocessor avoiding unwanted delays if you do not want to encrypt the information.

 In case of reaching the transmission limit that this basic architecture can offer, two independent microprocessors (53) and (62) will be implemented instead of just one, each governing an FPGA (52) and (67) and each one in charge of an address of the flow of data packets for encryption and decryption thereof.

The number of packets from which an IP address is filtered, as well as the time that said IP remains blocked, can be modified at the owner's will of the device by means of a computer program or through two rotary switches present on the PCB.

 An effect of the mode of action of the protection device (1) is to reduce the number of packets that the recipient computer will receive, preventing the computer or the computer system itself from being saturated by having to attend to an abnormally large number of packages in a reduced time period

 In summary, the service provider or set of service providers are protected against an attack by denial of service due to flooding by the protection device (1), which helps prevent loss of connectivity of the computer network victim of the attack by the bandwidth consumption available in the protected network itself. Likewise, the protection device (1) collaborates in reducing the load of the computer resources of the system victim of an attack. In other scenarios, the flood attack can cause the attacked computer to malfunction, but not its disconnection from the transport network.

 Consequently, the protection device (1) performs a filtering step where a number of IP data packets can be rejected based on a rejection policy executed by the protection device itself (1).

 The rejection policy applied by the protection device (1) is a function of the bandwidth occupied at each moment, the number of packets received per unit of time and the type of firewall (2) connected between the protection device (1) and the computer network.

The rejection policy applied is variable depending on the above parameters, that is, if the occupancy of the bandwidth is high, the rejection policy determines that the protective device raises the number of similar Ethernet packets rejected.

 An administrator of the protection device (1) can modify the threshold values of occupied bandwidth and the number of packets received by the protection device (1) from which malicious request packets could be rejected for the purpose of provide a correct and sized network traffic to its infrastructure. For example, you could keep the computer network connected to the external network, even if the operation of the same network is not optimal because you are receiving a number of malicious packets below the defined threshold.

 The flood attack protection procedure described above can also be applied to protect a computer network against distributed attacks of denial of service by DDoS saturation in which the source IP addresses of the malicious packets are not repetitive.

 The input / output network interface (3) comprises at least one Ethernet connector for the unprotected external network and another for the internal network to be protected. The protection device (1) is powered by a power supply, battery type, rechargeable battery, power source or similar, both through a standard USB connector and through its expansion slot.

 Using one of the USB connections of the protection device (1) you can modify and debug the algorithm programmed to make the decisions to reject (or not) a data packet, as well as reprogram the H synthesized for the FPGA, recorded on the device protection (1)

In addition, firmware and general software updates are allowed via the USB connection. protection device (1).

 An advantage of this is that the administrator of the protection device (1) can update the rules governing rejection decisions (or not) of a data packet from a communication network, such as the Internet, in the if new forms of denial of service attacks appear.

 The algorithm comprises, for this purpose, programmed instructions for executing the steps of the aforementioned process when, in addition, the programmed instructions can be recorded on a readable carrier medium within the device.

Claims

1. - A protective device against DoS and DDoS flood denial of service attacks, characterized in that it consists of a programmable general purpose logic device (1), composed of logic blocks communicated by FPGA programmable connections (52) and (57) ( 52; 57) with network data packets such as system data input and output, in addition to a USB data input and output connection, where network data packets enter serial mode via physical layer connectors Ethernet interfaces, PHY, (50, 56) and pass directly to the media control implemented in an FPGA, capable of transferring them in parallel by a data bus to a microprocessor implemented in the FPGA (53; 62) or connected to an FPGA by a direct connection between both elements, at the physical layer level, capable of forwarding, followed by a data and address bus, to a solid fast access memory (SRAM) (54, 55; 63, 64). In addition, the protective device comprises an Ethernet PHY physical layer interface (50) managed by a physical layer controller, in turn managed by a media access controller, MAC, implemented in an FPGA, which sends the data to a microprocessor implemented in an FPGA for processing and, if appropriate, its downstream retransmission finally through a PHY physical layer interface (56). 2. - A device according to claim 1, wherein between the memory units (54, 55; 63, 64) and the microprocessor there is a programmable electronic element capable of receiving in part or parallel format part of an IP address to physical layer level, modify it using an algorithm implemented in the own electronic element, to subsequently increase said modified signal with a bit-level counter, and use the resulting signals as input of the address bus of the memory units.  3. - A device according to claim 2, wherein the memory units are directly connected in parallel to the microprocessor implemented in an FPGA, this microprocessor being responsible for governing one or more FPGAs.  4. - A device according to claim 1, wherein in the media control, MAC (51), of the FPGA (52) includes means for copying in parallel format exclusively the data header of the incoming Ethernet packet and media for sending in parallel format of said data header to a microprocessor implemented within an FPGA (53; 62), without altering the content of the original data packet that will remain temporarily stored in the FPGA from where they are transmitted sequentially.