WO2007088120A2 - Évaluation automatisée de la protection d'un réseau - Google Patents

Évaluation automatisée de la protection d'un réseau Download PDF

Info

Publication number
WO2007088120A2
WO2007088120A2 PCT/EP2007/050604 EP2007050604W WO2007088120A2 WO 2007088120 A2 WO2007088120 A2 WO 2007088120A2 EP 2007050604 W EP2007050604 W EP 2007050604W WO 2007088120 A2 WO2007088120 A2 WO 2007088120A2
Authority
WO
WIPO (PCT)
Prior art keywords
network
sensitive data
case
data
tool
Prior art date
Application number
PCT/EP2007/050604
Other languages
German (de)
English (en)
Other versions
WO2007088120A3 (fr
Inventor
Joachim Charzinski
Bernhard Petri
Djordje Stamenkovic
Wilhelm Wimmreuter
Original Assignee
Nokia Siemens Networks Gmbh & Co. Kg
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Nokia Siemens Networks Gmbh & Co. Kg filed Critical Nokia Siemens Networks Gmbh & Co. Kg
Publication of WO2007088120A2 publication Critical patent/WO2007088120A2/fr
Publication of WO2007088120A3 publication Critical patent/WO2007088120A3/fr

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1433—Vulnerability analysis

Definitions

  • the subject of the application relates to a method for automated evaluation of the security of a network, in particular ⁇ special data network, against spying sensitive data.
  • IPSs Intrusion detection systems
  • IPSs intrusion prevention systems
  • host IDs can be detected directly on the target computer to detect any attacks.
  • Firewalls are used to restrict access to systems with certain rules. In many cases, firewalls can not detect attacks based on the exploitation of known attacks (eg with the help of worms or taking control of computers). Also, the protective function of a system of firewalls is in Often complex network configurations are not verifiable, so in practice penetration tests (penetration tests) are used, but these endanger the function of the systems. Simple networks have network or security planning tools, but they can not address system vulnerabilities.
  • the application object is an object, a Ver ⁇ go for automated assessment of the security of a network, in particular data network to provide against spying sensitive data that allows the network operator to influence newly identified vulnerabilities in the security sensi ⁇ tive data quickly to verify.
  • a system which, based on a network description and a description of the weak points in network elements and the sensitive data in the network, analyzes the network together with the weak points and checks whether an attacker has the opportunity to obtain sensitive data.
  • the problem is solved by transforming the inherently spatial problem (which service on which node is reachable from a starting point) into an equivalent temporal problem (which state of a system can be reached at some point from a given initial state). Then the accessibility of the sensitive data from outside is checked with already available tools for formal verification.
  • the formal fication to be verified Systemspe ⁇ is formulated to prevent sensitive data may be accessible from the outside. If the specification is met, the system is safe. If it is not met, the verification tool provides the same mög ⁇ union attack vectors that indicate how and through which systems can get an attacker to read sensitive data.
  • the inventive method supports power-on security of a network by the non-reachable ⁇ ness of sensitive data or systems checked it by attackers with line with formal methods.
  • the method according to the invention helps to quickly check the influence of newly recognized weak points on the security of sensitive data or systems in the network.
  • the inventive method helps network operators in the decision between fast (risky) fixing of
  • FIG. 1 shows the sequence of the safety analysis with data (1), (2), (3), (8), (9), (5), (6), (7), processing units (10) according to the invention, ( 4) and standard verification tool (11),
  • FIG. 2 shows equivalent circuit diagrams for servers with multiple services.
  • a network administrator e.g., a corporate network or an IP-based public voice network
  • a network administrator describes its network with its services, network elements, and sensitive data to be formally verified.
  • the network administrator uses the above-described
  • the vulnerability must be remedied quickly (e.g., by patch, if available, or by stopping the appropriate service, if possible), or the attack vector must be disrupted, e.g. by modifying ACLs on routers or firewalls. If access is not possible, the administrator can spend more time resolving the vulnerabilities, e.g. wait until a patch is available and tested.
  • the described method has the advantage of assisting a network administrator in balancing between resolving a vulnerability with a possibly untested patch, disabling services, and deferring a response to newly identified vulnerabilities in elements of his network. This makes his risk calculable.
  • FIG. 1 shows the sequence and the data involved in the security analysis.
  • the connections and services in this network (1), a description of the vulnerabilities in the network elements (network nodes, servers) (2), a network model (3) is generated. This can be done by hand or with the support of one
  • the network model (3) is under zuzz ⁇ acquisition systematic modeling concepts (8) converted by a tool (10) in an extended network description (9) puts. Another tool (4) then translates this description in the time required for the verification Computing Computing Kaysspra ⁇ surface (5).
  • a verification tool (11) determines the set of possible attack vectors on the basis of the network description (5) and a formulation of the protection goals and the possible attack methods (6) and outputs them as a file (7).
  • the second conversion step (4) in Figure 1 can be omitted if the functions of the tools (10) and (4) are combined.
  • Vulnerability descriptions (2) can be automatically added to the network description (3) by another tool if they conform to a standard format.
  • files (1), (2), (9) are XML files
  • (5) is a file in the PROMELA language
  • (6) is LTL
  • (11) is the verification tool SPIN.
  • attack vectors (7) can optionally be implemented by another tool in an easily readable or a graphical format.
  • CERT reports a vulnerability reporting system that automatically evaluates these reports, - tool as part of a network management system
  • the prototype implementation uses the following AttributeDescriptor ⁇ bute (8) for marking the nodes and the following security formulas (6) to confirm the safety objectives:
  • Servers with multiple services, routers and proxies are represented by the equivalent circuits (8) shown in FIG. 2 in the preprocessed network model (9).

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Storage Device Security (AREA)
  • Telephone Function (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

L'invention concerne un procédé d'évaluation automatisée de la protection d'un réseau, en particulier d'un réseau de données, contre le piratage de données sensibles. Ce procédé consiste à décrire le réseau avec ses connexions et services, ses éléments de réseau avec ses points faibles et ses données sensibles en tant que modèle de réseau, à vérifier si les données sensibles sont accessibles de l'extérieur et, si ces données sensibles sont accessibles, à fournir les vecteurs d'intrusion par lesquels un accès aux données sensibles est donné. Ledit procédé permet de vérifier de façon rapide et automatique l'influence de points faibles nouvellement identifiés sur la protection de données sensibles ou de systèmes dans le réseau.
PCT/EP2007/050604 2006-01-31 2007-01-22 Évaluation automatisée de la protection d'un réseau WO2007088120A2 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
DE102006004445.2 2006-01-31
DE102006004445 2006-01-31

Publications (2)

Publication Number Publication Date
WO2007088120A2 true WO2007088120A2 (fr) 2007-08-09
WO2007088120A3 WO2007088120A3 (fr) 2007-11-15

Family

ID=38327070

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/EP2007/050604 WO2007088120A2 (fr) 2006-01-31 2007-01-22 Évaluation automatisée de la protection d'un réseau

Country Status (1)

Country Link
WO (1) WO2007088120A2 (fr)

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030182582A1 (en) * 2002-03-19 2003-09-25 Park Jong Sou Network security simulation system
WO2004031953A1 (fr) * 2002-10-01 2004-04-15 Skybox Security, Ltd. Systeme et procede de detection et d'analyse des risques dans un reseau informatique

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030182582A1 (en) * 2002-03-19 2003-09-25 Park Jong Sou Network security simulation system
WO2004031953A1 (fr) * 2002-10-01 2004-04-15 Skybox Security, Ltd. Systeme et procede de detection et d'analyse des risques dans un reseau informatique

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
GERRIT ROTHMAIER ET AL: "A Framework Based Approach for Formal Modeling and Analysis of Multi-level Attacks in Computer Networks" FORMAL TECHNIQUES FOR NETWORKED AND DISTRIBUTED SYSTEMS - FORTE 2005 LECTURE NOTES IN COMPUTER SCIENCE;;LNCS, SPRINGER-VERLAG, BE, Bd. 3731, 2005, Seiten 247-260, XP019020857 ISBN: 3-540-29189-X *
LI YONGJIAN ET AL: "Using SPIN to model cryptographic protocols" INFORMATION TECHNOLOGY: CODING AND COMPUTING, 2004. PROCEEDINGS. ITCC 2004. INTERNATIONAL CONFERENCE ON LAS VEGAS, NV, USA APRIL 5-7, 2004, PISCATAWAY, NJ, USA,IEEE, Bd. 2, 5. April 2004 (2004-04-05), Seiten 741-745, XP010697313 ISBN: 0-7695-2108-8 *

Also Published As

Publication number Publication date
WO2007088120A3 (fr) 2007-11-15

Similar Documents

Publication Publication Date Title
DE60102555T2 (de) Verhinderung der map-aktivierten modulmaskeradeangriffe
DE60017457T2 (de) Verfahren zur isolierung eines fehlers in fehlernachrichten
US20090177929A1 (en) Method and apparatus for adaptive declarative monitoring
DE102010037740A1 (de) Integriertes Unified-Threat-Management für ein Prozesssteuersystem
DE102014113582B4 (de) Vorrichtung, Verfahren und System für die kontextbewusste Sicherheitssteuerung in einer Cloud-Umgebung
DE102012218704A1 (de) Erkennung von schwachstellen für dom-basiertes cross-site-scripting
DE202011111121U1 (de) System zum Erfassen komplexer Schadsoftware
DE102012109212B4 (de) Methoden, Vorrichtung und Herstellungsprodukte zur Bereitstellung von Firewalls für Prozesssteuerungssysteme
DE102012109829A1 (de) Verfahren und Vorrichtung zum Steuern von Straßenlampen
DE112010004605T5 (de) Verfahren und Vorrichtung zur Sicherheitsprüfung
DE10249427A1 (de) System und Verfahren zum Definieren des Sicherheitszustands eines Computersystems
EP3430558B1 (fr) Détection d'un écart entre un état de sécurité d'un dispositif de calcul et un état de sécurité théorique
DE112018004408B4 (de) Identifikation von angriffsströmen in einer mehrschichtigen netzwerktopologie
DE102015102434A1 (de) Verfahren und System zum Bereitstellen eines robusten und effizienten Verwaltungs- und Verifikationsdienstes für Verwundbarkeiten von virtuellen Betriebsmitteln
EP3695337B1 (fr) Procédé et dispositif de confirmation permettant de confirmer l'intégrité d'un système
DE102019209349A1 (de) Untersuchung von Web-Bedrohungen mithilfe von fortschrittlichem Web-Crawling
DE102006036111B3 (de) Verfahren und Prüfsystem zum sicheren Übertragen einer Nachricht von einer ersten Zone in eine zweite Zone
EP3655876B1 (fr) Système sur puce, procédé pour faire fonctionner un système sur puce et véhicule à moteur
WO2007088120A2 (fr) Évaluation automatisée de la protection d'un réseau
EP3339994A1 (fr) Procédé de vérification d'une attribution de mandat, produit-programme informatique et dispositif
DE102012223123B4 (de) Verhindern einer Fehlerausbreitung
JP6441742B2 (ja) セキュリティレベル管理システム、セキュリティレベル管理装置、セキュリティレベル管理方法およびプログラム
EP3627788A1 (fr) Procédé et dispositif de configuration d'un système de protection d'accès
WO2007088121A1 (fr) Système d'identification automatique de mesures de prévention nécessaires contre des points faibles dans une protection
DE102022122124A1 (de) Verfahren und Prozessorschaltung zum Schützen eines Computernetzwerks bei Erkennen von angreifbaren Schwachstellen sowie computerlesbares Speichermedium, Computernetzwerk und Kraftfahrzeug

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 07726214

Country of ref document: EP

Kind code of ref document: A2

122 Ep: pct application non-entry in european phase

Ref document number: 07726214

Country of ref document: EP

Kind code of ref document: A2