KR20070018101A - Method for protecting against attacks in a high-speed network - Google Patents

Abstract

Methods, modules and computer programs are provided for protecting targets against intrusion in high speed networks. The method according to the invention comprises the steps of: generating a query after receiving a request from an initiator identified by a source ID associated with a particular node in a network, sending the query to the node identified by the source ID; Evaluating the response if a response is received, and enabling the communication between the initiator and the target by sending an additional message from the target to the initiator, if an appropriate response is received.

Description

METHOD FOR PROTECTING AGAINST ATTACKS IN A HIGH-SPEED NETWORK}

The present invention relates to the field of protecting a target against intrusion in a high speed network, and more particularly, to a method and a module for protecting a target against intrusion in a high speed network. The invention also relates to a computer program product having said computer program and said computer readable medium stored on a computer readable medium having program coding means suitable for carrying out such a method when the computer program is executed on a computer. The present invention also relates to a method for handling a request in a high speed network.

Data exchange in high speed networks is performed based on standardized protocols such as TCP / IP or InfiniBand. Communication between nodes in such a network is initiated by a so-called handshake protocol that seeks for the correct data transfer between the involved network nodes. In this way, certain nodes in the network, the so-called initiators, are enabled to use the services provided by other nodes, hereinafter referred to as targets. Thus, the initiator sends a request to a target that provides a service requested by the initiator.

Intrusions in a network, such as service tampering, are characterized by the intentional attempt by an intruder to prevent the legitimate user of a service from using that service. This is accomplished by using the wrong address or source ID and sending multiple requests that require resources to flood the target within the network (flooding), thereby preventing the server from performing meaningful work.

Denial of service attacks result in significant time and money loss for many of the structures using the network.

Known methods use a four-way handshake protocol that includes an initiator message that includes a specific parameter, a first query message, a response to the query that includes the parameter, and a final message. However, this solution does not effectively prevent floating intrusion for protocols that rely on a predefined sequence of handshake messages.

Summary of the Invention

It is an object of the present invention to provide a method of protecting a target against intrusion in a high speed network which overcomes the disadvantages known in the prior art. More specifically, it is an object of the present invention to provide a method for pursuing the availability of all unrestricted services in a network as it handles the needs of a high-speed network that protects the target against intrusion in the network.

These objects are a method for protecting against intrusion in a high speed network having the features of claim 1, a module for protecting against intrusion in a high speed network having the features of claim 9, and a method for handling a request in a high speed network according to claim 16. Is achieved by proposing.

According to the present invention, there is provided a method for protecting a target against intrusion in a high speed network, the method comprising: generating a query after receiving a request from an initiator identified by a source ID associated with a particular node in the network; Transmitting to the node identified by the message, and thereafter, if a response to the query is received, evaluating the response, and if an appropriate response is received, from the target to the initiator with an additional message, for example a reception ready message. A method is proposed that includes enabling communication between an initiator and a target by sending.

With the present invention, it is possible to prevent fraudulent service intrusion in the network caused by multiple requests sent from the initiator to the target using an invalid source ID.

According to a preferred embodiment, the method according to the invention is built in a three way handshake protocol.

Advantageously, generating the query and evaluating the response are performed in separate modules. These individual modules can be embedded into hardware modules such as logic chips, PLDs or FPGAs, resulting in high throughput.

Preferably, the query sent to the initiator includes a parameter associated with the source ID and the target. Such a query can be encrypted to further increase the reliability of the method according to the invention.

According to a preferred embodiment, the method further comprises the step of inputting initiator related information into a table. Thus, it is possible to observe the number of connections between a particular initiator and a target, or alternatively the number of claimants. Each time the number of observed connections and the number of requesters exceeds a predetermined value, no more connections are established to prevent the target from floating by the particular initiator.

Advantageously, the network is an InfiniBand network that provides high speed and good performance.

The invention also covers a module that protects the target against intrusion in a high speed network comprising means for generating a query triggered by a request and means for evaluating a response to such a query.

Preferably, such modules are embedded into hardware modules such as logic chips, PLDs or FPGAs. Such hardware modules are embedded in a network adapter housing, or alternatively in a separate housing.

According to another embodiment, the module is preferably embedded in a software module running on a separate processor.

The invention also covers a computer program product having said computer program and said computer readable medium stored on a computer readable medium having program coding means suitable for carrying out the method according to the invention when the computer program is executed on a computer. .

The present invention also provides a method of handling a request in a high speed network at a target using a common handshake protocol, wherein as soon as the load of the target exceeds a predetermined threshold, claims 1 to 8 A method according to any one of the above covers how the common handshake protocol is corrected.

Since protection against demand floating is only needed at high points of use, a common handshake protocol, typically a three-way handshake protocol, can be used at low points of use. The handshake protocol according to the present invention introduces two additional steps and is used at high points of use.

Further features and embodiments of the present invention will become apparent from the detailed description and the accompanying drawings.

It is to be understood that the foregoing and subsequent features may be used in other combinations as well as in the specified combinations without departing from the scope of the invention.

The invention is schematically illustrated in the drawings by way of example and will now be described in detail with reference to the drawings. The following description is not intended to limit the scope of the present invention but merely illustrates a preferred embodiment of the present invention.

Other aspects and advantages of the present invention will become apparent upon review of the detailed description and with reference to the accompanying drawings.

1 illustrates a possible scenario for a service breach.

2 is a diagram illustrating a three-way handshake protocol.

3 is a diagram illustrating a four-way handshake protocol in a TCP network.

4 is a diagram illustrating a four-way handshake protocol in an Infiniband network.

5 is a diagram illustrating a five-way handshake protocol in an Infiniband network according to the present invention.

6 is a block diagram schematically showing a module in a network environment according to the present invention.

FIG. 7 includes the name for FIG. 8 and illustrates the handling of requests in the network according to the present invention.

8 is a flowchart illustrating a method according to the present invention.

A possible scenario for a breach of service is shown in FIG. 1. The intruder 10 using the source ID of the authorized initiator 12 sends a request to the target 14 via the fabric 16. In accordance with the present invention, this requirement is evaluated within the hardware networking module 18 to ensure that resources of the main CPU 20 in the target are not consumed and that the target's floating is prevented.

Referring to Fig. 2, a three way handshake protocol is shown. The initiator specified by the source ID sends a request message to the target identified in the destination ID. The target returns a ready to receive message containing the target parameters. In order to establish a connection, the initiator sends a ready to receive message including initiator parameters.

Using a three-way handshake protocol, an attacker using a fake address cannot float the target into a connection request because the target allocates resources before the initiator's identification is performed.

Referring to Figure 3, a four-way handshake protocol in a TCP network is shown. After receiving the request from the initiator, the target sends a query to the initiator that allocates the resource. The initiator sends a response to the query with a ready to receive message including initiator parameters. The target evaluates the response and, if it is a valid response, returns a ready to receive message to establish a connection. Thus, resource allocation is performed after identification of the initiator.

However, as shown in Fig. 4, the four-way handshake protocol causes a non-transparent sequence change of I → T and T → I that is not transparent to the higher layer protocol, thus requiring a required floating intrusion problem in the Infiniband network. Does not solve. Since the I → T and T → I messages contain higher layer connection establishment parameters and QPNs, this approach is not operable for Infiniband networks. The problem is that the target does not know when the transmission is allowed. In addition, this approach does not solve the problem with a limited number of possible queue pairs.

5, the 5-way handshake protocol according to the present invention is embedded in the 3-way handshake protocol. After receiving a request from the initiator identified by the source ID, the target is preferably a query derived from a source ID for which the hardware module associated with the target does not contain consistent data for the node identified by the source ID. Create Thus, an attacker using a fake address does not receive this query and therefore cannot respond to the query. If a valid source ID is used, the target responds to the query. This response is evaluated by the target. If the response matches, the connection is established.

Query generation and response checking are performed without involving the target's software. Consistent data between queries and responses should not be stored within the target. In addition, this approach is transparent for compatible backward and higher level protocols in typical situations.

Referring to Fig. 6, before the output message is transmitted, the connection HW assist module 30 is connected to the transmission buffer 32 containing the output message. The sender 34 reads all incoming messages stored in the receive buffer 36. The module 30 is connected to the control logic 38 to trigger "message transfer" and "message drop" operations and connect request with "additional high load information", eg source address or arrival rate. Signals the arrival of. Load detection module 40 comprising a table with initiator related data signals "normal operation", "high load", "drop of all connection requests from verified initiator" to connection HW assist module. .

The proposed five-way handshake protocol is an effective solution to prevent the floating of the target. Since protection against demand floating is only needed at high points of use, the three-way handshake protocol can be used at low points of use. The five-way handshake protocol introduces two additional messages, one for each query or challenge, and one for challenge response.

Referring to Fig. 7, the initiator using the source ID sends a request R to a target establishing a connection. The target generates a query Q = f (...) that is sent over the switch network to the entity identified by the source ID included in R. Only the entity that receives Q can generate a response A that is returned to the target. The switch network carries A to the target based on the destination ID included in Q. If the constructor of A can know Q by q (A, ...) then the target is valid. In the preferred embodiment Q = f (source ID, key, ...) and valid = q (A, source ID, key, ...).

The result of f should be difficult to predict by any initiator without knowing the "key" (plaintext encryption intrusion, freely selectable plaintext), e.g. the use of regularly changed keys. Key generation should not be predictable by any initiator, for example by the use of physical noise to generate a key. In addition, different initiators must result in different keys as input parameters, for example by the use of Infiniband LID, GID, GUID. The target determines, based on A and the "key", whether the response A has sent an address corresponding to Q by the initiator.

As another implementation example, the query message may be an Infiniband redirection message (GetResp (ClassPortInfo)) that includes an Infiniband parameter to be used for the response. The response is a repeated connection establishment message (Infiniband REQ) with the original parameter set except for the parameters specified in the query message GetResp (ClassPortInfo). All possible parameters for redirection can be used to form a query message.

Referring to FIG. 8, the module associated with the target to be protected waits for an incoming message (step 50). Upon receipt of the message, the header of the message is analyzed in step 52. If the received message is a request for a connection (step 54), a query is generated in step 56 and sent to the node identified by the received source ID (step 58).

If the received message is a response (step 60), this response is evaluated in step 62. If the response is valid, the message is sent to the target (step 64). Otherwise, the message is dropped (step 66).

If the received message is neither a request nor a response (step 68), the message is sent to the target (step 70).

Claims (16)

As a method of protecting a target against intrusion in a high speed network, After receiving a request from an initiator identified by a source ID associated with a particular node in the network, generating a query; Sending the query to the node identified by the source ID; When a response to the query is received, evaluating the response; Enabling communication between the initiator and the target by sending an additional message from the target to the initiator when an appropriate response is received. How to protect the target comprising a. The method of claim 1, The method is a method for protecting a target embedded in a three-way handshake protocol. The method of claim 2, Generating the query and evaluating the response is performed in a separate module. The method of claim 3, wherein Said individual module protecting a target embedded as a hardware module. The method of claim 1, The query includes a parameter associated with the source ID and the target. The method of claim 1, Encrypting the query further comprising: encrypting the query. The method of claim 1, And entering the initiator related information into the table. The method of claim 1, And wherein said network is an InfiniBand network. A module that protects a target against intrusion in a high speed network. Means for generating a query triggered by the request, Means for evaluating responses to these queries Module to protect the target comprising a. The method of claim 9, The module protects a target embedded in a hardware module. The method of claim 10, The module protecting a target integrated into a network adapter housing. The method of claim 10, The module protects the target integrated in a separate housing. The method of claim 10, Said module protecting a target embedded in a software module. The computer program and the computer readable medium stored on a computer readable medium having program coding means suitable for carrying out the method according to any one of claims 1 to 8 when the computer program is executed on a computer. Having a computer program product. A computer program having program coding means suitable for carrying out the method according to any one of claims 1 to 8 when the computer program is executed on a computer. As a method of handling a request in a high speed network at a target by using a common handshake protocol, As soon as the load of the target exceeds a predetermined threshold, the target in which the common handshake protocol is to be corrected by the method according to any one of claims 1 to 8 is handled. Way.

Images