FR2907998A1 - Data packet control device for e.g. asymmetric digital subscriber line network, has processing module associating replacement address with extracted packet, where address is allocated to packet equipment so that router routes to address - Google Patents

Abstract

The device (D) has a control module (MC) for extracting a data packet containing a header with a non-allocated or inaccessible destination address in case of determination of the address by an analysis module (MA). A processing module (MT) associates a chosen replacement destination address with the packet extracted by the control module, where the replacement address is allocated to a packet analysis equipment e.g. honeypot equipment, such that a router (R1) routes to the associated replacement destination address.

Description

2907998 PACKET CONTROL DEVICE FOR A ROUTER OF A NETWORK OF

  The invention relates to communication networks capable of transmitting data packets, and more specifically the routing of packets within such networks. Many communication devices, attached to lo communication networks, are the object, usually via the Internet, of computer attacks by means of attack traffic (consisting of data packets defining, for example, a virus, a worm or Trojan horse) generated by malicious people. It is recalled that there are address scanning devices ls for automatically generating any destination address (for example IP) and therefore transmit traffic (packets) attack to all addresses of destination (IP), or at least to a large subgroup of the set of destination (IP) addresses.

As known to those skilled in the art, it has been proposed to equip communication networks with analysis equipment (called honeypots) dedicated to the detection and analysis of attack traffic. the understanding of the attacks defined by these attack traffic and if possible the generation of signatures characteristic of these attacks and useful intrusion detection systems (or IDS (Intrusion Detection System)). These honeypot devices are typically connected to the Internet and each have an Internet Protocol (IP) address that is not usually made public. Therefore, any attempt to connect to such equipment is considered suspicious and as a potential attack. It is therefore important that the greatest possible number of attack traffic reaches the level of honeypot-type equipment in order to be able to counter their attacks as quickly as possible. Several solutions have been proposed for this purpose. A first solution is to multiply the number of honeypot devices in the largest possible number of networks, so that each of them automatically receives attack traffic targeting its own IP address. But, such a solution is expensive and difficult to manage. A second solution consists in making each honeypot type of equipment accessible by several IP addresses. This allows to receive numerous attacks, then to analyze them in the same equipment and to correlate the attacks. However, by the design of an IP network a honeypot type of equipment can receive and analyze only attack traffic targeting an IP address of the network or networks for which it works. In order to be able to receive and analyze a large number of attack traffic, it must therefore be attached to several networks (multi-homed), which requires that it can be reached by means of several different network addresses. This constraint strongly limits the ability of a honeypot-type device to scale up, since it is difficult to obtain for the same equipment multiple network accesses (this requires several links, possibly virtual). In addition, since the number of IP addresses of a honeypot device depends on the number of networks to which it is attached, its detection is facilitated. However, as soon as a honeypot-type device is detected, it becomes useless and it compromises the confidence that one can have in its analyzes since it can be the object of misleading attacks intended to overload it at the same time. time as the IDSs that it feeds into signatures. A third solution is to implement in various places of the Internet equipment called funnel. These devices are responsible for receiving the attack traffic on their own address or address ranges which are respectively allocated to them, and to transfer these received attack traffic to a honeypot type of equipment (generally via a transmission channel tunnel type). This solution is advantageous because when a funnel-type device is detected, it does not compromise the entire attack detection system. In addition, it requires only a limited number of honeypot-type equipment. However, it requires the installation of at least one funnel-type equipment in each network where honeypot-type equipment is installed, which is expensive because of the number of equipment to be deployed and because of the costs of deployment and deployment. management of all said equipment. Since no known solution is entirely satisfactory, the purpose of the invention is therefore to improve the situation. It proposes for this purpose a control device intended to be coupled to, or to be part of (at least partially) a communication network router comprising analysis means responsible for determining in the header of a packet of data, which it has just received, the destination address it contains, for the purpose of routing this packet to this destination address. The invention therefore applies to any packet network routed to the destination address, and therefore applies particularly well to networks of the IP type. This control device is characterized in that it comprises: loaded control means, when the router analysis means have determined in a header an unassigned or inaccessible destination address, to extract the packet containing this header , and processing means for associating with a packet extracted by the control means a selected alternate destination address, which has been assigned to packet analysis equipment, for example of the honeypot type, so that the router the route to that associated alternate destination address.

The device according to the invention can comprise other characteristics that can be taken separately or in combination, and in particular: its processing means can be responsible for associating with a received packet transmitted by packet analysis equipment, for example of the honeypot type, in response to a previous packet retrieved by the control means, the (original) source address of said preceding packet retrieved by the control means, so that the router routes said received packet to this source (original) address that has been associated with it by the processing means; Its processing means may be responsible for placing a packet extracted by its control means in a new packet provided with a header containing the chosen alternative destination address, and then providing the router with the new packet containing the packet. extract; Alternatively, its processing means may be responsible for replacing with a chosen alternate destination address the destination address that is contained in a packet that has been retrieved by the control means, and then for providing the router with the extracted packet. with his new alternate destination address; lo its control means may for example be located in a so-called data plane (or data plane) of the router; its processing means may for example be located in a control plane (or control plane) of the router; its processing means can be loaded, when the means of analyzing the router have determined in a header an unassigned or inaccessible destination address, to prevent the router from sending an error message to the equipment (source ) who issued the packet containing that heading and which is designated in the latter; it may comprise management means responsible for configuring the control means to extract a packet containing an unassigned or inaccessible destination address only if it satisfies at least one selected criterion and / or configuring the processing means so that they can proceed to the alternative destination address associations according to at least one selected criterion; 25> each criterion is for example chosen from at least one criterion of belonging of the destination address to a set of chosen addresses, a criterion of belonging of the source address to a set of chosen addresses, a criterion the membership of the content type of the packet to a set of selected content types, a criterion relating to the local time of the router, a criterion of the occupancy rate of at least one selected buffer of the router, and a criterion relating to the value of a counter chosen its management means may be responsible for configuring the control means and / or the processing means by transmitting them rules defining at least some criteria to be applied and / or tables correspondence between criteria to be applied and alternative destination addresses; Its management means may be responsible for configuring the address or addresses of the packet analysis equipment to which the suspect packets will be sent; its management means may be responsible for configuring control means and / or localized processing means in at least two routers of its network; its management means can for example be implemented in the control plane of the router. The invention also proposes a router (communication network) comprising analysis means of the aforementioned type and a control device of the type of that presented above and coupled to said analysis means. The invention is particularly well suited, although not exclusively, to Internet Protocol (IP) communication networks. Other characteristics and advantages of the invention will become apparent upon examination of the following detailed description and the accompanying drawings, in which: FIG. 1 very schematically illustrates two communication networks connected to the Internet and comprising analysis equipment as well as routers each equipped with a control device 25 according to the invention, and - Figure 2 schematically and functionally illustrates a router equipped with an embodiment of a control device. according to the invention. The attached drawings may not only serve to complete the invention, but also contribute to its definition, if any.

The object of the invention is to enable a large number of suspect traffics (transmitted as packets via one or more packetized communication networks routed to the destination address, as well as possibly via the Internet). to reach equipment for analyzing suspicious traffic, for example of the honeypot type. In what follows, it is considered as a non-limiting example that the communication networks are wired IP networks of xDSL type (for example ADSL), connected to the Internet. However, the invention is not limited to this type of communication network. It concerns indeed any type of packet communication network routed on the destination address, whether wired or radio (or wireless, and more generally by wave) and terrestrial and / or satellite type .

FIG. 1 schematically illustrates an example of a communication installation embodying the invention. This installation comprises here, by way of purely illustrative and nonlimiting example, two communication networks NI and N2 capable of transmitting data packets, for example of the IP (Internet protocol) type, and both connected to the Internet. In order to simplify the description, hereinafter called network communication networks NI and N2, and IP packet a data packet transmitted by an NI or N2 network. In the illustrated example, the first network N1 comprises, in particular, a set of routers Ri (R1 to R4, i = 1 to 4), each equipped with a control device D according to the invention. The number of routers represented here is equal to four, but it can take any value greater than or equal to one. Note that it is preferable, for reasons of efficiency, that each router of the first network NI is equipped with one, or coupled to a control device D. It can indeed be envisaged that only one, or some 25 routers of the first network N1 are equipped with, or coupled to, a control device D. As illustrated, communication equipment (EA1, EA2, ES1) , each having a communication address (such as an IP address), are connected to the first network N1. More precisely, in the nonlimiting example illustrated, a first device for analyzing suspicious traffic (packets) EA1, a second equipment for analyzing suspicious traffic (packets) EA2 and a communication terminal ES1 are connected to the first network. NI.

Furthermore, in the example illustrated, the second network N2 comprises, in particular, a set of routers R'j (R'1 to R'3, j = 1 to 3), each equipped with a control device. D according to the invention. The number of routers represented here is equal to three, but it can take any value greater than or equal to one. As illustrated, communication equipment (EA3, EA4, ES2), each having a communication address (such as an IP address), are connected to the second network N2. More precisely, in the nonlimiting example illustrated, a third equipment EA for analyzing suspicious traffics (packets) EA3, a fourth equipment for analyzing suspicious traffics (packets) EA4 and an communication terminal ES2 are connected to the second network. N2. It is considered hereinafter that the first EA1, second EA2, third EA3 and fourth EA4 suspected traffic analysis equipment (packages) are honeypot type equipment. Furthermore, it is considered below that the communication terminals ES1 and ES2 are equipment belonging to malicious people wishing to attack, by means of attack traffic (consisting of packets defining, for example, a worm, a virus or a Trojan), other communication equipment (of any type) connected to the first N1 or second N2 network or to any other network accessible via the first N1 or second network N2. Such an (communication) terminal ES1 or ES2 is provided with an address scanning system enabling it to generate automatically any IP address and thus transmit traffic (packets) of attack to all 25 possible IP addresses, or at least to an important subgroup of all IP addresses. As schematically and functionally illustrated in FIG. 2, each router Ri or R'j is responsible for routing each packet (here of the IP type) that it receives to the destination address (IP) that is contained in 30 l. header (IP) of this packet (IP). It is recalled that the IP header of an IP packet includes, among other things, the source address of the source equipment that sent the IP packet and the destination address of the equipment that is the recipient of the IP packet.

In order to ensure this routing, each router Ri or R'j comprises, in particular, an analysis module MA and an routing module (or matrix) MR. The analysis module MA is responsible for analyzing the contents of each IP header in order to determine the destination address it contains, and then determining how to route the packet containing this IP header according to routing information ( usually stored in a routing table). The routing module MR is responsible for routing (routing) a received packet to the communication equipment which is designated by the IP address of the destination determined by the analysis module MA in its IP header, according to the instructions. routing provided by the MA analysis module. The analysis module MA is generally part of what the person skilled in the art calls the data plane (or data plane) PD of the router Ri or R'j. But, it could be otherwise.

The routing module MR is generally distributed between the PD data plane and what the person skilled in the art calls the control plane (or control plane) PC of the router Ri or R'j. But, it could be otherwise. As schematically and functionally illustrated in FIG. 2, each control device D according to the invention comprises at least one control module MC and a processing module MT coupled to each other. The control module MC is coupled to the analysis module MA. When it is located in a router Ri or R'j, it is preferably part of its PD data plane. This control module MC is responsible for observing the result of the analysis performed by the analysis module MA on each IP header of a received IP packet. When the analysis module MA has determined in the header of an IP packet to route an unassigned or inaccessible destination address, the control module MC extracts the corresponding packet and transmits it to the processing module MT.

It is important to note that the extraction can possibly be done according to at least one selected criterion. The application of some of these criteria may possibly require the analysis of the IP header and / or the content (payload) of the packet. Many criteria 2907998 9 can be used, and in particular: - a criterion of membership of the destination address (contained in the header of the packet received) to a set of chosen addresses. Indeed, the control module MC may be configured to transmit an IP packet to the processing module MT provided that its IP header includes a destination address belonging to a set of chosen addresses, a criterion of membership of the source address (contained in the header of the received packet) to a set of chosen addresses. Indeed, the control module MC may be configured to transmit an IP packet to the processing module MT provided that its IP header includes a source address belonging to a set of chosen addresses, a membership criterion from the content type of the packet to a set of selected content types. Indeed, the control module MC may be configured to transmit an IP packet to the processing module MT provided that its content corresponds to a type belonging to a set of selected types. Several of these criteria may possibly be applied to the same extracted IP packet.

It should be noted that when several honeypot devices are connected to a network, the control module MC may possibly be configured to select the honeypot-type equipment to which an extracted packet is to be routed. To do this, it can optionally apply at least one selected criterion). Numerous criteria can be used for this purpose, and in particular: a criterion relating to the local time of the router Ri or R'j. Indeed, the control module MC can be configured to choose the honeypot type equipment to which an extracted packet must be routed according to the local time. This can in particular allow the distribution of traffic 30 (or load balancing). For example, it can order the transmission of an extracted packet to the first EA1 honeypot equipment during the even seconds (or minutes), and to the second EA2 honeypot equipment during the odd seconds (or minutes); 2907998 lo a criterion of occupancy rate of at least one selected buffer of the router Ri or R'j. Indeed, it is possible to provide buffers (for example of the FIFO type) associated with each of the honeypot type equipment, in order to place the extracted packets awaiting routing according to the equipment of the honeypot type addressed. In this case, it can be envisaged that an initially extracted packet intended for a first honeypot EA1 type equipment item is placed in the buffer memory associated with the second honeypot equipment item EA2 when the occupancy rate of the buffer memory associated with the first equipment item the honeypot EA1 type exceeds a chosen threshold. It can also be used to make the distribution of traffic; a criterion relating to the value of a chosen counter. Indeed, counters associated with each of the honeypot type equipment may be provided. In this case, each time the control module MC orders the routing of an extracted IP packet to a honeypot-type device, it increments by one the value of the counter which is associated with the latter. Thus, when the value of a counter associated with a first honeypot device EA1 exceeds a threshold, the control module MC orders the routing to the second honeypot equipment EA2 of the following extracted IP packet which should normally be routed to the first honeypot equipment EA1. This can also be used to make the distribution of traffic. Several of these criteria may possibly be applied to the same packet I P extracted.

The control module MC therefore transmits to the processing module MT each IP packet that it has extracted and optionally selected according to at least one criterion, accompanied by a possible instruction designating the honeypot-type equipment to which this packet IP must be routed. Whenever the processing module MT receives a packet extracted by the control module MC, it associates it with a chosen alternative destination address (assigned to a honeypot-type device), so that the router Ri or R'j the route to this associated alternate destination address.

This alternative address association can be done in at least two different ways. One way is to replace with a replacement destination address the destination address that is contained in the extracted IP packet. In this case, the processing module MT then supplies to the router Ri or R'j, and more specifically to its data plane PD, the extracted IP packet which now comprises a new replacement destination address. A second, currently preferred, way is to place the extracted IP packet into a new packet with a header that contains the chosen alternate destination address. In this case, the processing module MT then supplies the router Ri or R'j, and more precisely to its data plane PD, the new IP packet that contains the packet 1P extracted. As previously indicated, the replacement destination address, which is associated with an extracted IP packet, may be designated (selected) by the control module MC subsequent to the application of one or more selected criteria. In this case, this address (or its designation) is for example communicated to the processing module MT at the same time as the extracted IP packet concerned.

When the data plane PD receives from the processing module MT the IP packet which has been associated with a replacement destination address, it processes it as if it were an IP packet. newly arrived. Therefore, it is again analyzed by the analysis module MA, and then routed to the replacement destination address it contains, since this is now known and accessible. When the control device D is implanted in a router Ri or R'j, its processing module MT is preferably part of what the person skilled in the art calls the control plane (or control plane) PC of the router. It should be noted that in a variant of operation, it can be envisaged that the criteria relating to the IP header or the content type of an IP packet are applied by the control module MC, while the other criteria relating to the selection honeypot type equipment is applied by the processing module MT. In this case, when the processing module MT receives an extracted IP packet, to be the subject of a replacement destination address association, it applies one or more criteria to it to determine the type of equipment. honeypot to which it should be directed, then it associates with it the address of destination of this last s. In another variant of operation, it can be envisaged that the criteria concerning the header (IP) and / or the content type of a packet (IP) are applied by the processing module MT. In general, the criteria relating to the header (IP) and / or the content type of a packet (IP) may be applied by the control module MC and / or the processing module MT. As known to those skilled in the art, in an IP network, when a router Ri or R'j detects an unassigned or inaccessible destination address, it automatically addresses the source equipment ES1 (or ES2), which has issued the corresponding IP packet and which is designated in the IP header, an error message (usually ICMP type) specifying the reason why it was unable to route this IP packet (equipment unreachable because the address destination does not exist (host unreachable - especially if there is no ARP Address Resolution Protocol entry (RFC 20 826)), or network unreachable because you can not find a route to access the address destination (network unreachable)). In order to prevent the router Ri or R'j from transmitting such an error message to an ES1 or ES2 source equipment, which could attract its attention, the processing module MT may, for example, be loaded with power. prohibit its analysis module MA from generating this type of error message when it detects an unassigned or inaccessible destination address. On the other hand, some suspect packet analysis equipment EA1-EA4 may be arranged to respond to the attack messages they receive. Since they now receive a message of attack from a router which is equipped with a control device D according to the invention, they transmit to the same router the response to said attack message, while that This is for ES1 source equipment or 2907998 ES2. In order for a response to arrive at an ES1 or ES2 source equipment without its noticing it, the processing module MT of a control device D may be responsible for associating with a received packet transmitted by a user. EA1 packet analysis equipment in response to a previous suspect packet extracted by its MC control module, the source address (original) of this previous packet. For this purpose, each time a control module MC extracts a suspicious packet, it stores its source address in a memory of its device D or its router Ri or R'j. And, when a control module lo MC finds that the analysis module MA of its router Ri or R'j has detected a packet transmitted by a packet analysis equipment EA1 in response to a packet it had previously extracted, it determines in the memory the source address that corresponds to this received packet and transmits it to its processing means MT so that it associates it with the received packet. The routing module 15 MR of the router Ri or R'j can then route the received packet to the source address that has been associated with it by the processing module MT. As a variant, it is the processing module MT that can determine in the memory the source address that it must associate with a received packet to be routed to a source equipment ES1 or ES2.

As illustrated in FIG. 2, the control device D can also and possibly also include a management module MG responsible for configuring the control module MC and / or the processing module MT, in particular so that it (s) applies (nt) IP packets extracted one or more selected criteria.

For example, the MG may be used to define rules that define at least some of the criteria to be applied and / or correspondence tables between criteria to be applied and alternate destination addresses, and then (or only ) to transmit some of these rules and / or some of these correspondence tables to the control module MC and / or the processing module MT, according to instructions received from the network manager to which the router Ri or R'j belongs. which it is part of (or to which it is coupled). The management module MG may also be responsible for activating or deactivating the control device D at times chosen according to received instructions or any programming. The management module MG may also be responsible for configuring the address or addresses of the EA1 and EA2 packet analysis equipment to which the suspect packets will be sent. The management module MG may also be responsible for configuring control modules MC and / or processing modules MT which are located in (or coupled to) several (at least two) routers. In other words, a management module MG can be used to configure the lo control modules MC and / or the processing modules MT of all the routers of its network or only a part of them. In this case, it can be either implanted in one of the control devices D or in a network equipment of another type. When the control device D is implanted in a router Ri or R'j, its management module MG is preferably part of the control plane PC of this router. The control device D according to the invention, and in particular its control module MC and processing module MT, as well as its possible management module MG, can be implemented in the form of electronic circuits, software modules (or computer modules) , or a combination of circuitry and software. The invention is not limited to the control device and router embodiments described above, by way of example only, but encompasses all the variants that the person skilled in the art can envisage in the context of the invention. of the claims below.

Claims (15)

  1. Control device (D) for a router (R1) of a communication network, said router (R1) comprising analysis means (AM) arranged to determine in the header of a data packet, received and to route, the destination address it contains, for routing said received packet to this destination address, characterized in that it comprises i) control means (MC) arranged, in case of determination by said means for analyzing (MA) a header comprising an unassigned or inaccessible destination address lo, for extracting the packet containing this header, and ii) processing means (MT) arranged to associate with a packet extracted by said control means (MC) a chosen alternative destination address, assigned to a packet analysis equipment (EA1), so that said router (RI) routes it to said associated alternate destination address.   2. Device according to claim 1, characterized in that said processing means (MT) are arranged to associate with a received packet, sent by a packet analysis equipment (EAI) in response to a previous packet containing a source address and retrieved by said control means (MC), said source address of said previous packet, so that said router (RI) routes said received packet to that source address associated with said processing means (MT).   3. Device according to one of claims 1 and 2, characterized in that said processing means (MT) are arranged to place a packet extracted by said control means (MC) in a new packet provided with a header containing said replacement destination address chosen, then to provide said router (RI) said new packet containing the extracted packet.   4. Device according to one of claims 1 and 2, characterized in that said processing means (MT) are arranged to replace by a chosen alternative destination address the destination address which is contained in a packet extracted by said control means (MC), then to provide said router (R1) with the extracted packet with its new replacement destination address (2907998).   5. Device according to one of claims 1 to 4, characterized in that said control means (MC) are located in a so-called data plane of said router (R1). 5   6. Device according to one of claims 1 to 5, characterized in that said processing means (MT) are located in a so-called control plane of said router (R1).   7. Device according to one of claims 1 to 6, characterized in that said processing means (MT) are arranged, in case of determination by said analysis means (MA) of an unassigned destination address or inaccessible , to prevent said router (R1) from sending an error message to the equipment that sent the corresponding packet and which is designated in its header.   8. Device according to one of claims 1 to 7, characterized in that it comprises management means (MG) arranged to configure said control means (MC) so that they do not extract a packet containing an address unassigned or inaccessible destination only if it satisfies at least one selected criterion and / or for configuring said processing means (MT) so that they can proceed to alternative destination address associations based on of at least one selected criterion.   9. Device according to claim 8, characterized in that each criterion is chosen from a group comprising at least one criterion of membership of a destination address to a set of selected addresses, a criterion of membership of a source address to a set of chosen addresses, a criterion of membership of a packet content type to a set of selected content types, a criterion relating to the local time of the router (R1), a rate criterion occupying at least one selected buffer of the router (R1), and a criterion relating to the value of a selected counter.   10. Device according to one of claims 8 and 9, characterized in that said management means (MG) are arranged to configure said control means (MC) and / or said processing means (MT) in their transmitters 287998 rules defining at least some of the criteria to be applied and / or correspondence tables between criteria to be applied and alternative destination addresses.   11. Device according to one of claims 8 to 10, characterized in that said management means (MG) are arranged to configure each address of a packet analysis equipment to which suspect packets will be sent.   12. Device according to one of claims 8 to 11, characterized in that said management means (MG) are arranged to configure control means (MC) and / or treatment means (MT) located in at least two routers of said network.   13. Device according to one of claims 8 to 12, characterized in that said management means (MG) are located in a so-called control plane of said router (R1). 15   14. Router (R1) for a communication network, said router (R1) comprising analysis means (AM) arranged to determine in the header of a data packet, received and to be routed, the destination address it contains, for routing said received packet to this destination address, characterized in that it comprises a control device (D) 20 according to one of the preceding claims and coupled to said analysis means (MA) .   15. Use of the control device (D) and the router (RI) according to one of the preceding claims in an Internet Protocol (IP) communication network.