FR2887384A1 - Information system protecting method for DHCP server, involves supplying static routing to workstations such that any station-to-station communication is partially locked, and identifying information flow based on predetermined criterion - Google Patents

Abstract

The method involves supplying a static routing to workstations in such a way that any station-to-station communication is partially locked. A critical information flow between the workstations and servers is identified based on a predetermined criterion, where the critical information flow is transmitted without processing. The other information flows are controlled through firewalls. An independent claim is also included for a system for protecting an information system.

Description

Method and system for protecting an information system constituted

  The present invention relates to a method for protecting an information system constituted around a local network. logged. It also relates to a protection system implementing this method.

  The field of the invention is that of the protection of information systems and local computer networks particularly exposed to various threats such as the spread of worms and viruses.

  When a worm-infected workstation is connected to a company's local network, almost all other workstations become contaminated within seconds, and the costs associated with their resettlement and Downtime is very high.

  Firewall solutions for workstations intended to protect against this scourge exist, but are very poorly adapted to corporate networks because of the diversity of flows to be taken into account, and the diversity of user needs that makes the task of the administrator very complicated especially when it comes to move on the workstations to adapt the configurations to the daily needs.

  Centralized firewalls that implement the VLAN method and isolate each user station in a dedicated network to contain the risks, but all of the company's local network flows pass through the network. through this firewall which becomes a real bottleneck even on small networks of a few dozen posts and some servers.

  New firewalls with multiple ports are emerging to compromise the quality of filtering and performance, and allow the partitioning of user groups with low performance degradation. by declining sacrificable areas on the network. As a result, the access to the servers remain efficient, but that the appearance of a worm in a zone can still make all the stations connected in the latter out of use.

  There are thus internal security needs of companies, especially for the following reasons: - the worms circulate directly from station to station on the local network whereas these workstations never need to be able to communicate directly except in very rare exceptions (ex: file sharing, printer sharing, ...); - the user base is very difficult to maintain in a known and homogeneous state of software configuration, especially because of the high volume of weekly updates to be made, the increasing mobility of users, and the rapid obsolescence of the versions of software, the durability of which is far below the depreciation time of the equipment; - Access to file servers and internal services, such as e-mail, must be as fast and reliable as possible, especially when the mass arrival of users in the morning.

  The object of the present invention is to achieve simultaneously these three objectives by proposing a method for protecting an information system comprising a plurality of workstations and server equipment communicating via a local area network (LAN).

  According to the invention, this method comprises: - a provision of a static routing for each station, so as to effect a partial or total blocking of any station-to-station communication, - an identification, according to predetermined criteria, of flows from said workstations, including flows between workstations and server equipment, said streams thus identified being transmitted without processing, and - a control of other flows through filtering means.

  Static routing can be advantageously achieved by providing each workstation with a subnet mask and a routing table specifying for said workstation the equipment that is accessible to it.

  The protection method according to the invention is preferably implemented within a DHCP server connected to the local network.

  When the method according to the invention is implemented in a local network based on the Internet Protocol (IP), the subnet mask supplied to each workstation is for example a subnet mask. 32 bits (255.255.255.255).

  An implementation of this protection method can also advantageously comprise, following an analysis of the information flows, a triggering of LAN protection actions and alerts, which can be initiated, for example, in response to detection of an exceeding of an anomaly threshold.

  According to another aspect of the invention, there is provided a system for protecting an information system comprising a plurality of workstations and server equipment communicating via a local area network (LAN), implementing the method according to the invention , characterized in that it comprises: means for at least partially blocking any peer-to-peer communication; means for analyzing information flows within said local network, arranged to identify critical flows, in particular flows; between workstations and server equipment, said critical streams can then be transmitted without processing, and - means for controlling all other flows through filtering means.

  This system according to the invention includes for example, as locking means, analysis means and control means, a DHCP server connected to the local network and arranged to provide each workstation a configuration based on a mask subnet and static routes by IP address.

  It may further comprise, as filtering means, a firewall type equipment, preferably disengageable, arranged to perform at least a partial filtering workstations between them.

  The method according to the invention thus implements the following concepts aimed at: 2887384 -4- Exploiting the network configuration distribution capabilities of workstations to force them to cross a centralized firewall for any communication requiring analysis, and this without modification of the network architecture; E exploit these configuration distribution capabilities to enable them to reach high-traffic services directly, without impacting performance; É Filter only the residual traffic through the firewall equipment (very low or zero), so as not to impact the performance of the flows submitted to analysis, and providing a very fast detection of anomalies with very low risk of false positives. The method according to the invention thus meets the following need: To confine any potentially dangerous IP traffic by segmenting the network to its lowest granularity, namely, the workstation, in the event of anomalies detected, blocking partially or totally the Suspicious traffic source post and alert the administrator.

  The protection method according to the invention thus rests on the configuration of a more restrictive subnet IP mask than that applied to the local network on the network interfaces of the equipment attached to it, the optimum case being the subnet mask to 32 bits (255.255.255.255) which limits the possibilities of connection of these to themselves. Then, using the routing table, it is possible to specify with the precision of the IP address, the different machines that will be accessible to it on the network, the default gateway thus representing the first control point for all the routed flows .

  This type of network configuration is never used because it goes against the principle of letting the workstations communicate as they wish on the network. To configure this level of granularity of the routing on a station using the MS Windows operating system, it is necessary either to impose the configuration by a DHCP server, or to directly modify the registry which remains a delicate operation to carry out manually.

  A DHCP server can provide workstations with a 32-bit subnet mask (255.255.255.255) so that the machine can not communicate without control over the network and then distribute each of the desired routes with DHCP options adequate.

  For configurations with a static IP address, the possibilities will be the same but the configuration methods will be specific to each system (ex: MS Windows registry, Unix configuration files).

  The protection method according to the invention can be implemented without any change of architecture.

  The physical architecture of the network is not modified by the implementation of the protection method according to the invention, all critical flows can be identified and can be transmitted without processing (and without protocol control), the other flows are controlled and potentially stopped by the firewall equipment.

  Other advantages and characteristics of the invention will emerge on examining the detailed description of an embodiment which is in no way limitative, and the appended drawings in which: FIG. 1 illustrates a first example of implementation of FIG. protection method according to the invention; FIG. 2 illustrates a second example of implementation of the protection method according to the invention; FIG. 3 illustrates a comparison of the possible communications as a function of the configured subnet mask; and FIG. 4 illustrates various protection configurations provided by the method according to the invention.

  We will now describe, with reference to the above figures, the operating principle of the protection method according to the invention, as well as an example of implementation of a protection system according to the invention, in an information system. installed on two separate sites.

  A protection system S according to the invention comprises a DHCP server 1 and a firewall type equipment 2 both connected to a local area network LAN of an information system SI comprising for example a plurality of workstations P1, ... PN and a file server 3.

  Direct communication between two workstations is inhibited and the corresponding F1 flows are controlled and filtered by the firewall 2.

  On the other hand, the streams F of the stations P1,..., PN towards the file server 3 are not filtered, as schematically illustrates FIG. 2.

  The use of the 255.255.255.255 subnet mask allows full control of all the information system workstations, giving them a reduced network view, while the 255 255.255.0 mask. On the contrary, it provides a complete view of the network, as illustrated schematically in Figure 3.

  The protection method according to the invention allows different configurations of protection of an information system, as illustrated in FIG. 4. For example, an information system SI comprising a first LAN LAN connected to the Internet via a firewall 21 and comprising several local subnets connected via a switch 4, and a second local area network LAN '.

  In a first subnet, a first protection server 11 has quarantined a workstation P1 that has been detected as infected and filters a second workstation P2 that communicates with servers S1, S2 via switch 4.

  In a second subnet, a second protection server 12 blocks any direct communication between two workstations P3, P4.

  In the second local area network LAN 'of the information system SI connected to the Internet via a second firewall 22, a third protection server 13 blocks the flows between two workstations P5, P6 but allows to communicate the workstation P6 with an S3 file server.

  The protection servers 11, 12, 13 are DHCP servers capable of providing a client configuration based on a 32-bit subnet mask (255.255.255.255) and local static routes by IP address.

  The firewalls 21, 22 are firewall type (disengageable).

  The protection servers 11, 12, 13 implement an analysis engine whose role is to trigger protection actions (against 2887384 7-measures) and alerting when exceeding anomalous thresholds: MAC filtering, IP filtering, service filtering, notification and host identification.

  The boxes of the protection servers 11, 12, 13 are simply connected to the network with a static IP address. Then simply adapt the static routing configuration as needed: if a DHCP server was already present: disabling the old server, enabling the integrated DHCP server with the same settings as the old one, identifying the main servers accessible directly, enable the DHCP configuration accordingly; the DHCP machines will then be controlled by the integrated firewall for access to unidentified internal services, identification of indirect services and creation of filters accordingly on the integrated firewall, implementation place of the notification system, - establishment of the protection system.

  Of course, the invention is not limited to the examples that have just been described and many adjustments can be made to these examples without departing from the scope of the invention. In particular, the protection system according to the invention can be deployed without difficulty in complex architecture information systems since it is sufficient to install as many protection servers as local subnets.

Claims (11)

-8- CLAIMS   A method for protecting an information system comprising a plurality of workstations and server equipment communicating via a local area network (LAN), characterized in that it comprises: a provision of a static routing for each station, so as to block at least part of any peer-to-peer communication, an identification, according to predetermined criteria, of flows from said workstations, in particular flows between workstations and server equipment, said flows being able to be transmitted without treatments, and control of other flows through filtering means.   2. Method according to claim 1, characterized in that the static routing is achieved by providing each workstation with a subnet mask and a routing table specifying for said workstation the equipment that it are accessible.   3. Method according to claim 2, characterized in that it is implemented within a DHCP server connected to the local network.   4. Method according to claim 3, implemented in a local area network whose workstations communicate using the IP protocol, characterized in that the subnet mask provided to each workstation is a subnet mask 32. bits (255.255.255.255).   5. Method according to one of the preceding claims, characterized in that it further comprises, following an analysis of information flows, a trigger actions of protection of the local network and alert.   6. Method according to claim 5, characterized in that the protection and alert actions are initiated in response to a detection of an exceeding of at least one anomaly threshold.   2887384 -9- 7. Method according to one of claims 5 or 6, characterized in that it further comprises, as protection actions, a quarantine of a workstation by sending a blocking configuration via the subnet mask.   8. System for protecting an information system comprising a plurality of workstations and server equipment communicating via a local area network (LAN), implementing the method according to any one of the preceding claims, characterized in that comprises: means for blocking all or part of the peer-to-peer communications, means for analyzing information flows within said local network, arranged to identify critical flows, in particular flows between workstations and equipment; servers, said critical streams can then be transmitted without processing, and - means for controlling all other flows through filtering means.   9. Protection system according to claim 8, characterized in that it includes, as locking means, analysis means and control means, a DHCP server connected to the local network and arranged to provide each station a configuration based on a subnet mask and static routes by IP address.   10. Protection system according to one of claims 5 or 6, characterized in that it further comprises, under the filtering means, a firewall type of equipment, arranged to perform a filtering at least partial work stations between them.   11. Protection system according to claim 10, characterized in that the fireproof equipment is of the type disengageable.