EP1774751A1

EP1774751A1 - Method, device and system for protecting a server against dns denial-of-service attacks

Info

Publication number: EP1774751A1
Application number: EP05788637A
Authority: EP
Inventors: Patrick Trabe; Yvon Gourhant; Yannick Carlinet
Original assignee: France Telecom SA
Current assignee: Orange SA
Priority date: 2004-07-09
Filing date: 2005-07-08
Publication date: 2007-04-18
Also published as: US20080028073A1; WO2006013292A1

Abstract

The invention concerns in particular a method for protecting a server (10, 18) against DNS denial-of-service attacks, which consists in: detecting (100, 102, 104) DNS denial-of-service attacks aimed at the server; intercepting (110) the data packets addressed to the server. If an intercepted packet has a transaction number which is not in the list of transaction numbers of requests emitted by the server, the transmission of said data packet to the server is interrupted (116).

Description

Method, device and system for protecting a server against DNS denial of service attacks

The present invention relates to a method, a device and a system for protecting a server against DNS denial of service attacks.

More specifically, the invention relates to such a method in which: DNS denial of service attacks targeting the server are detected; - intermediate equipment intercepts data to the server;

A DNS (Domain Name Service) service makes it possible to provide an IP (Internet Protocol) address corresponding to a symbolic name such as a URL address or a domain name. It is a service that is provided by a DNS system adapted to respond to specific requests for DNS service delivery issued from client terminals.

A DNS service provisioning request is therefore a request whose function is to obtain from a DNS system the IP address of a server whose known symbolic name is known. It comprises, among other things, a first information field called "source address" or "identification field" in which the IP address of the sender of this request is recorded and which is used by the DNS system to send a response to the request. client terminal sending the request. It also includes a second information field called "requested address" in which is inscribed the symbolic name of the server whose issuer of the request wishes to have the IP address. It is understood that a DNS service is essential for the establishment of communications between different terminals connected to each other via an IP type network such as the Internet, since it allows the terminals to be located between them without having to remember their respective IP addresses, but simply by knowing their symbolic names. Web site visits or email transmission are examples of actions that require the solicitation of a DNS service.

A DNS system generally consists of a hierarchical set of DNS servers, each DNS server being associated with a specific part of the symbolic names managed by the system. Specifically, a DNS server has correspondence tables between the symbolic names that it manages and corresponding IP addresses.

When a client terminal transmits a DNS service provision request to a DNS system, to obtain an IP address from a symbolic name, two Different processes can be implemented by the DNS system because of its hierarchical structure.

According to a first method, which will be called "non-recursive mode" thereafter, a first DNS server receives the request. If it is not competent to answer, it sends back to the client terminal a response in which it provides the IP address of a second server DNS system likely to respond to this request. The client terminal therefore sends its request to the second DNS server which can also, if it is not competent to answer, provide the IP address of a third DNS server. The client terminal renews its request as many times as necessary to reach the competent DNS server to respond.

According to a second method, which will be called "recursive mode" thereafter, a first DNS server receives the request. If he is not competent to answer, he himself transmits the request to a second DNS server. If the second DNS server is not competent to respond either, it itself transmits the request to a third DNS server. Recursively, the DNS servers transfer the request issued by the client terminal as many times as necessary so that it can reach the appropriate DNS server to respond. The response provided by the competent server is then transmitted in the opposite direction until it reaches the first requested DNS server, which in turn transmits it to the client terminal.

Note that according to the recursive mode of processing the DNS request, a single request issued from the client terminal causes the generation of a plurality of requests transmitted from one server to another DNS system.

A DNS denial of service attack consists in generating a fraudulent DNS service provisioning request, that is to say a request whose form reproduces the form of the DNS service provisioning requests, but which is not motivated by obtaining a DNS service. There are two known methods for generating such a fraudulent request.

A first method, called "simple attack", consists in sending, from a client terminal, a fraudulent request in which the source address is not that of the client terminal but that of a server that the user of the client terminal wishes to attack. .

So, everything happens as if the sender of the request was actually the attacked server. The DNS system will therefore return its response to the attacked server, regardless of its operating mode (recursive or non-recursive) since it is the IP address of the server that is registered in the source address of the request. Note that it is irrelevant whether the address requested in the request exists or not. This one can be totally crazy. A second method, called a "recursive attack", consists of transmitting from a client terminal a fraudulent request in which the requested address is a symbolic name managed by a DNS server that the user of the client terminal wishes to attack. This type of attack exploits the recursive mode of the DNS system. Indeed, the client terminal transmits this request to any of the servers of the DNS system, but it will reach the attacked DNS server without further intervention of the client terminal. Note that it is irrelevant whether the source address in the request is that of the issuer or not. It can be totally wacky, but it can also match that of the transmitter, it does not stop to harm. In practice, a malicious user sends from his client terminal a large number of fraudulent DNS service provisioning requests, so that the attacked server receives a very large number of messages (requests in the case of recursive attacks, responses in the case of simple attacks). This has the effect of making the attacked server unable to provide the service for which it is programmed. Note that simple attacks target all types of servers while recursive attacks exclusively target DNS servers.

A first solution for protecting a server against such DNS denial of service attacks is to create access control lists, these access control lists comprehensively defining client terminals authorized to transmit requests for provision of services. DNS service to specific DNS servers. Thus, if a request to a DNS server is issued from a client terminal that does not belong to the access control list of this DNS server, it is not processed.

In the case of recursive attacks, the queries can have all the appearance of normal queries, since the source address of the request can actually be the address of the sender and the requested address is not a wacky address. . In this case, this solution may have some efficiency. But it is very easy to circumvent if we know at least one IP address of a client terminal authorized to query the DNS server that we want to attack. In this case, simply enter this IP address in the source address of fraudulent requests.

Similarly, in the case of simple attacks, it is sufficient that we know a DNS server that has in its access control list the IP address of the server that you want to attack. A symbolic name managed by this DNS server is then entered in the requested address of the fraudulent requests. A second solution, only to counter recursive attacks, is to remove this mode of operation of a DNS system. Obviously, this solution -AT-

has no impact on simple attacks. Moreover, it penalizes all the users of the DNS system for which this mode of operation is suppressed, preventing it from functioning in the recursive mode.

Finally, another solution to protect a server against DNS denial of service attacks, reactive type, is to divert all requests to an attacked server, as soon as it was detected that this server was attacked, to another server usually called "black hole", so that it is the black hole that receives all the attacks rather than the server itself. The function of the black hole is to receive the data and destroy it without processing it. However, this solution does not distinguish between the different data transmitted to the attacked server. Moreover, in this case, it can be considered that the attack actually worked because the server is no longer able to provide the service for which it is programmed.

The aim of the invention is to improve the existing methods of protecting a server against DNS denial of service attacks by providing a method capable of protecting a server against such attacks and which makes it possible to sort the data transmitted to an attacked server so that those who are not involved in these attacks can be treated so that the operation of the attacked server is as undisturbed as possible. The invention therefore relates to a method for protecting a server against DNS denial of service attacks, in which:

- DNS denial of service attacks on the server are detected;

- intermediate equipment intercepts data packets to the server; characterized in that: the intermediate equipment analyzes the intercepted data packets;

for each intercepted data packet, if a criterion predetermined by the intermediate equipment is verified following the analysis of this data packet, the intermediate equipment interrupts the transmission of this data packet to the server.

Thus, requests and / or responses to requests of the DNS type, relating to a server that is attacked, are diverted to an intermediate device that has its own criteria for sorting the data packets intended for the attacked server. This filter system, implemented in an intermediate device different from the attacked server allows the latter to continue to provide the service for which it is programmed without feeling the harmful effects of the attacks. A method of protecting a server according to the invention may further include one or more of the following features:

the predetermined criterion is linked to the emitter of the intercepted packet;

the predetermined criterion is linked to a requested address in the intercepted packet, if it concerns a request for DNS service provisioning;

the predetermined criterion is linked to the absence of a transaction number of the intercepted packet in a list of request transaction numbers issued by the server, this list being maintained by the intermediate equipment; - during the detection step of DNS denial of service attacks:

• abnormal traffic is detected to the server, including abnormal traffic using the UDP (User Datagram Protocol);

• extracting a source port number contained in intercepted data packets;

• the nature of the protocol used at the application layer in the intercepted data packets is determined;

in the step of detecting DNS denial of service attacks, a destination port number contained in the intercepted data packets is extracted;

The subject of the invention is also a device for protecting a server against DNS denial of service attacks, comprising means for intercepting data packets destined for the server, characterized in that it furthermore comprises:

means for analyzing the intercepted data packets; means for interrupting the transmission to the server of a data packet among the intercepted data packets, if a criterion predetermined by the protection device is verified following the analysis of this data packet.

Finally, the invention also relates to a system for protecting a server against DNS denial of service attacks, comprising a server that may be attacked by a client, characterized in that it comprises an intermediate device formed by a protection device as described above.

A protection system of a server according to the invention may further include the feature that the intermediate equipment is a firewall disposed between the server and a client access network to the server. The invention will be better understood on reading the description which follows, given solely by way of example and with reference to the appended drawings in which:

- Figure 1 shows schematically the general structure of an installation comprising a system according to a possible embodiment of the invention; and

FIG. 2 illustrates the successive steps of a method for protecting a server according to a possible embodiment of the invention.

The installation represented in FIG. 1 comprises a first server 10 adapted for the provision of a predetermined service to different clients.

For example, this server 10 is a DNS server belonging to a set of servers of a DNS system. Alternatively, the server 10 may be any server suitable for providing any service.

The server 10 is connected to a high-speed network 12, for example an ADSL link, itself connected to an operator network 14. Intermediate equipment 16 may be disposed at the interface of the operator network 14 and the ADSL broadband network. This intermediate equipment 16 is for example a firewall.

The installation includes a second server 18 also adapted to provide a predetermined service to different customers. This server 18, as well as the server 10, can be a DNS server or any other type of server. It is connected to a private local area network 20, itself connected to the operator network 14. Intermediate equipment 22, as well as a router 24, can be arranged at the interface of the operator network 14 and the high-speed network 12. The intermediate equipment 22 is for example a firewall, such as the equipment intermediate 16.

The installation represented in FIG. 1 further comprises a first client terminal 26 capable of requiring the provision of a service on the part of the server 10 or the server 18. This client terminal 26 is connected to a high-speed network 28, for example identical to the high-speed network 12, that is to say an ADSL link. This high-speed network 28 is itself connected to the operator network 14 via intermediate equipment 30, such as a firewall.

Finally, the installation comprises a second client terminal 32, also likely to require the provision of a service from the server 10 or the server 18. It is connected to a packet data transmission network 34, such as than the Internet. The Internet network 34 is itself connected to the operator network 14 via a router 36 directly connected to a control platform 38 and to intermediate equipment 40. Intermediate equipment 40 is for example a firewall, such as intermediate equipment 16, 22 and 30.

The set of intermediate equipment 16, 22, 30 and 40 is managed by a conventional system 42 under the control of the operator of the operator network 14. The method of protecting a server against denial of service attacks

DNS shown in Figure 2 comprises a first step 100 of detecting an anomaly.

During this step 100 of detection of an anomaly, one of the elements of the installation of FIG. 1 detects an abnormal traffic towards the server 10 or 18. This detection is for example carried out by the intermediate equipment 16 ( for the server 10) or the intermediate equipment 22 (for the server 18).

The traffic related to the DNS service provisioning requests and the corresponding responses is UDP-transmitted traffic which normally represents less than 10% of the overall traffic of a packet data network. The detection of an abnormal traffic may therefore consist in the detection of an abnormal quantity of UDP packets going to the server 10 or 18, that is to say greater than a predetermined threshold.

During the next alert step 102, the management system 42 is informed of this anomaly by the intermediate equipment 16 or 22. Then, during a verification step 104, the intermediate equipment 16 or 22 having detected the anomaly, or the possibly attacked server 10 or 18 analyzes the nature of the packets likely to participate in DNS denial of service attacks. The purpose of this verification step is to determine whether the packets actually relate to the provision of a DNS service. Then, during a test step 106, it is decided, in light of the results of steps 100 and 104 if the server concerned is indeed a victim of DNS denial of service attacks. This is for example the case if the number of UDP packets is greater than the predetermined threshold and if these packets actually concern a DNS service.

If this is not the case, we go to a step 108 end of the process. Otherwise, we go to a step 110 of protection of the attacked server. During this step, the management system deviates all the traffic destined for the server considered as being attacked to an intermediate device of the installation. This intermediate equipment may be, depending on the case, the intermediate equipment 16, 22, 30 or 40.

Then, as soon as the intermediate equipment to which the data destined for the attacked server is diverted receives a data packet destined for the attacked server, a step 112 of analysis of the content of this packet is carried out. According to case, this analysis can lead to determine a specific transaction number which is associated with this packet, the source address and / or the actual transmitter of this packet, and possibly, if this packet concerns a DNS request, the address requested in this request. We then go to a test step 114. In this step, the intermediate equipment checks whether a criterion it has predetermined is filled, based on the information from the analysis of step 112. This criterion will be detailed later, according to different possible configurations of attacks.

If the predetermined criterion is checked for this packet, we go to a step 116 of interruption of the transmission of this packet to the attacked server. In practice, this package can be deleted by the intermediate equipment. Otherwise, we go to a step 118 of transmission of this packet to the attacked server.

Following steps 116 and 118, a test step 120 is made in which the intermediate equipment checks whether it has received a new data packet for the attacked server. In this case, we return to step 112. Otherwise, we go to a step 122 end of the process.

This method of reaction to DNS denial of service attacks, described previously in a rather general way, does not necessarily apply in all attack configurations that may be faced by the installation, and may include certain variations depending on the configurations.

In particular, it is important to distinguish between simple attack configurations and recursive attack configurations.

In addition, it is necessary to distinguish the attack configurations emitted from a client terminal connected to the server that it wishes to attack via a data transmission network on which the management system 42 of the network of data. operator 14 has full visibility, attack configurations issued from a client terminal connected to the server that it wishes to attack via a data transmission network on which the network management system 42 Operator 14 does not have full visibility. For example in the case of Figure 1, the client terminal 26 is connected:

the server 10 via the high-speed network 28, the operator network 14 and the high-speed network 12, and

the server 18 via the high-speed network 28, the operator network 14 and the private local network 20. It is therefore connected to the servers 10 and 18 via a data transmission network on which the management system 42 has full visibility. On the other hand, the client terminal 32 is connected:

the server 10 via the Internet network 34, the operator network 14 and the high-speed network 12, and

to the server 18 via the Internet network 34, the operator network 14 and the private local network 20.

It is therefore connected to the servers 10 and 18 via a data transmission network on which the management system 42 does not have full visibility, because of the Internet 34.

It is therefore possible to distinguish four configurations of DNS denial of service attacks:

- First configuration: the client terminal is connected to the server via a network on which the management system 42 has full visibility, and DNS denial of service attacks are simple;

- Second configuration: the client terminal is connected to the server via a network on which the management system 42 has full visibility, and DNS denial of service attacks are recursive;

third configuration: the client terminal is connected to the server via a network on which the management system 42 does not have full visibility, and DNS denial of service attacks are simple; and

fourth configuration: the client terminal is connected to the server via a network on which the management system 42 does not have full visibility, and DNS denial of service attacks are recursive. In the first configuration of attacks, the method according to the invention does not apply, since at each transmission of a request for DNS service provision the installation is able to check itself that the address source indicated in this request corresponds to the IP address of its issuer. This verification is carried out by a server, known as the BRAS ("BRoadband Access Server") server, located in particular in the high-speed network 28 and the data of which the operator's management system 42 has access.

In the second attack configuration, the previously described method is applied with reference to FIG.

More precisely, during step 104, for each data packet destined for the server possibly attacked and intercepted by the intermediate equipment, it is checked: - the source port number;

- the destination port number;

- the nature of the protocol used at the application layer.

In the next test step 106, if both the source port number and the destination port number are 53, which is the port value used for forwarding packets for DNS services, and if the protocol used at the application layer level is identified as the DNS protocol, so it is decided that the target server is the victim of DNS denial of service attacks. Since we are in a configuration of recursive attacks, the packets participating in these attacks involve fraudulent requests for DNS service provisioning.

Steps 104 and 106 are executed by the intermediate equipment 16 if the attacked server is the server 10 and by the intermediate equipment 22 if the attacked server and the server 18.

In this second configuration of attacks also, the intermediate equipment having carried out the verification step 104 and the test step 106 identifies the issuer of the fraudulent DNS queries and possibly the requested address in these requests, and then transmits these data to the management system 42. This issuer and this requested address are therefore filed by the management system 42

In this case, the predetermined criterion used by the intermediate equipment during the test step 114 to interrupt the transmission of a data packet for the attacked server is linked to the identity of the sender of the intercepted packet and possibly to the requested address which is the subject of the request. If the intercepted packet is sent by the transmitter stored by the management system 42 and possibly if it concerns the requested address stored by the management system 42, the transmission of this packet of data is interrupted. Otherwise, it reaches the recipient.

In the third configuration of attacks, the method described above is applied with reference to FIG.

More precisely, during step 104, for each data packet destined for the server possibly attacked and intercepted by the intermediate equipment, it is checked:

- the source port number;

- The nature of the protocol used at the application layer.

In the next test step 106, if the source port number is set to 53 and if the protocol used at the application layer is identified as the DNS protocol, then it is decided that the target server is the victim of the problem. DNS denial of service attacks. Since we are in a configuration of simple attacks, the packets participating in these attacks involve responses to fraudulent requests for DNS service provision.

In this third configuration of attacks also, the intermediate equipment having carried out the verification step 104 and the test step 106 identifies the transaction numbers of each DNS request sent by the attacked server and transmits these transaction numbers. the management system 42 which manages a list of transaction numbers of requests issued by the attacked server.

The transaction numbers in this list correspond to legitimate request numbers issued by the attacked server.

The list is stored and maintained by the management system or the intermediate equipment. Thus, this list evolves according to the legitimate requests emitted by the server.

In this case, the predetermined criterion used by the intermediate equipment during the test step 114 to interrupt the transmission of a data packet for the attacked server is related to the transaction number of the intercepted packet. If the intercepted packet has a transaction number that is in the list of transaction numbers managed by the management system 42, it is transmitted to the attacked server, since it is then a legitimate response to a request issued by this last. Otherwise the transmission of this data packet is interrupted.

In the fourth configuration of attacks, the method described above is applied with reference to FIG.

- the source port number; - the nature of the protocol used at the application layer.

In the next test step 106, if the source port number is set to 53 and if the protocol used at the application layer is identified as the DNS protocol, then it is decided that the target server is the victim. DNS denial of service attacks. Since we are in a configuration of recursive attacks, the packets participating in these attacks involve fraudulent requests for DNS service provisioning. Steps 104 and 106 are executed by the intermediate equipment 16 if the attacked server is the server 10 and by the intermediate equipment 22 if the attacked server and the server 18.

In this fourth configuration of attacks also, the intermediate equipment having carried out the verification step 104 and the test step 106 identifies the requested address in the fraudulent requests, then transmits these data to the management system 42. This requested address, which is an address managed by the attacked server, is therefore stored by the management system 42.

In this case, the predetermined criterion used by the intermediate equipment during the test step 114 to interrupt the transmission of a data packet intended for the attacked server is linked to the requested address which is the subject of the request of the intercepted packet. If the intercepted packet concerns the requested address stuck by the management system 42, the transmission of this data packet is interrupted. Otherwise, it reaches the recipient. It is clear that a protection method as described above effectively protects an attacked server against DNS denial of service attacks, without neutralizing it.

Claims

A method of protecting a server (10, 18) against DNS denial of service attacks, wherein: - DNS denial of service attacks against the server are detected (100, 102, 104),

intercepting (110) the data packets destined for the server, characterized in that if an intercepted packet has a transaction number that is not in a list of request transaction numbers issued by the server, then one interrupts (116) transmitting this data packet to the server.

The method of protecting a server (10, 18) according to claim 1, wherein in the step (100, 102, 104) of detecting DNS denial of service attacks:

- it detects (100) abnormal traffic to the server;

extracting (104) a source port number contained in intercepted data packets;

the nature of the protocol used at the application layer level in the intercepted data packets is determined (104).

The method of protecting a server (10, 18) according to claim 2, wherein, in the step (100, 102, 104) of detecting DNS denial of service attacks, extracting (104) a destination port number contained in the intercepted data packets.

4. Device (16, 22, 30, 40) for protecting a server (10, 18) against DNS denial of service attacks, comprising means for intercepting data packets to the server, characterized in that it further comprises means for interrupting transmission of an intercepted data packet to the server if the intercepted packet has a transaction number which is not in a list of request transaction numbers issued by the server .

A system for protecting a server (10, 18) against DNS denial of service attacks, comprising a server that may be attacked by a client (26, 32) and at least one intermediate device (16, 22, 30, 40), characterized in that the intermediate equipment (16, 22, 30, 40) is formed by a protective device according to claim 4.

6. Protection system of a server according to claim 5, comprising means (42) for managing the list of transaction numbers, the transaction numbers being transmitted by each protection device according to claim 4.

A system for protecting a server according to claim 5 or 6, wherein the intermediate equipment (16, 22, 30, 40) is a firewall arranged between the server (10, 18) and a network of client access to the server.