Device and method for detecting and preventing intrusion into a computer network

0001The present invention relates to a device and a method for detecting and preventing intrusion into a computer network for preventing intrusions by detecting and blocking them before penetration of the network.

0002In a computer network, the availability of data and its transmission in a context of maximum security is a constant problem. The growing complexity of attacks requires increasingly sophisticated and intelligent network protection. It is indeed necessary to be able to check the format and the destination of the packets which transit, to check their contents, to memorize the history of the sessions to do the analysis over a certain duration, to distinguish between the real and the false alarms reassembled, and especially to react to attack before it has penetrated too deeply into the network.

0003Among the solutions found in the state of the art, we know those that are based on packet filtering but provide a low level of security because only the packet headers are verified. Proxy filtering is another solution in which content filters are used, for example, to block access to websites and filter email messages and attachments. These solutions are not designed to block attacks and cause very large performance losses. In addition, they do not respect the architecture of the server client model and require a proxy per communication port. There is also known a method of inspecting the state of the connections in order to allow or to refuse the traffic and to obtain higher performances, based on a state table, but which again ignores attacks. This is the principle of the network firewall, with a variant corresponding to the application firewall in which we do not just check the status of connections but also the content.

0004Other complex systems exist such as Intrusion Detection Systems (IDS), which rely on a database of known attack signatures. This database must be updated regularly. These systems have a major disadvantage that they do not block the attack but detect it once it has passed. It is therefore often too late to react for vulnerable networks that can be compromised in a few seconds.

0005Also known intrusion prevention systems or IPS (Intrusion Prevention System), which are sort of IDS placed in a network cut and to detect and block attacks. These systems use more sophisticated detection methods, which usually combine a scenario approach and a behavioral approach to limit false alarms (generated in abundance by IDS) and to detect and block even new attacks. In response to such an attack, these systems reconfigure the network firewall accordingly. However, one of the drawbacks of these systems is that they can not detect attacks spread over several segments of the network since they operate on a single branch. To be able to protect several branches, you need several of these systems, which considerably complicates their management. This complexity is a source of additional security flaw, besides the high cost (purchase, installation and maintenance).

0006Moreover, whatever the state-of-the-art systems commonly used, the filtering policies essentially consist in the blocking or authorization of certain port numbers. However, more and more applications are communicating on dynamic or variable ports, and some applications are even coming onto the market with the aim of bypassing the firewall. The consequence is that if we can not guarantee that a given application uses a given port, we can not apply a fixed filtering based on a fixed association application-communication port. In addition, the fact that applications typically use the previously open channel to communicate with other protocols, and that it is necessary to know precisely the operation of

0007We also know the Applicant's document: <nplcit id="ncit0001" npl-type="s"><text>"Netasq IPS-Firewalls, ASQ Real Time Intrusion Profession" published in 2003</text></nplcit>. This document discloses a firewall including an intrusion detection and prevention system. The firewall includes stand-alone modules for analyzing a given protocol and a generic module that attaches to connections for which the protocol has not been recognized. These modules are able to recognize a protocol regardless of the communication port used. The demand<patcit id="pcit0001" dnum="WO0078004A1"><text>WO 00/78004 A1</text></patcit> discloses a firewall capable of recognizing a protocol used in a communication and applying filtering policies defined for the protocol.

0008There is therefore a need for a reliable solution that overcomes the aforementioned drawbacks, particularly concerning the protection of a network comprising many segments, and in a context where the attacks use variable communication ports.

0009It is therefore the object of the invention to overcome these disadvantages. To this end, the invention relates in a first aspect to a method for detecting and preventing intrusion into a computer network, as defined by claim 1.

0010According to a second aspect, the invention relates to a device for detecting and preventing intrusion into a computer network, as defined by claim 4, integrated in a firewall located on the network, thus making it possible to block the attacks before penetration on said network with an instantaneous reaction (no delay between issuing an alert and putting into practice the reset commands). Such a device integrated in the firewall protects all segments of the network, without the need to install specific devices on each segment.

0011According to the invention, the selective filtering of the connections, after said accessing protocol has been automatically recognized, consists in constantly checking the conformity of the communications circulating on a given connection to said protocol, in order to deliver a dynamic authorization for the communications resulting from the operation. normal protocol and issue a dynamic rejection for communications resulting from abnormal operation of the protocol. Specifically, as long as the protocol accessing a connection is not recognized, the data is accepted but not transmitted. If the number of data packets accepted but not transmitted exceeds a certain threshold, or if the data is accepted but not transmitted for a certain time beyond a certain threshold, then the connection is unauthorized.

0012The device includes a communications analysis intrusion prevention means, integrated in the network firewall, at the central point and before each branch of said network, said intrusion prevention means including a means for selective filtering of the recognition communications automatic protocol access, regardless of the communication port used by the protocol. The selective filtering means comprises at least one autonomous module for analyzing at least one given communication protocol. At least one of the autonomous modules more specifically comprises a unit for automatic recognition of a given communication protocol, and a unit for verifying compliance of the communications circulating on a given connection to said protocol,

0013Such a device and such a method advantageously make it possible to block known attacks such as unknown attacks. An interface allows the user to fill in the criteria defining the filtering policy, specifying them in natural language. In addition, the device comprises means for statistical processing of the connection information, and means for storing this information and processed information (audit logs), with the aim of simplifying the subsequent management of this information.

0014Other characteristics and advantages of the invention will appear more clearly and in a complete manner on reading the following description of the preferred variants of implementation of the method and of the embodiment of the device, which are given as non-exemplary examples. and with reference to the following appended drawings:<ul><li><figref idref="f0001">figure 1</figref> : schematically represents a network of classic type interconnected to the Internet,</li><li><figref idref="f0002">figure 2</figref> represents the functional details of a firewall integrating the device according to the invention,</li><li><figref idref="f0001">figure 3</figref> : schematically represents the functional details of a protocol analyzer of the device according to the invention,</li><li><figref idref="f0003">figure 4</figref> : schematically represents an autonomous communication protocol analysis module of the device according to the invention,</li><li><figref idref="f0004">figure 5</figref> : schematically represents the method of detection and prevention of intrusions according to the invention</li></ul>

0015The <figref idref="f0001">figure 1</figref> schematically represents a network of conventional type interconnected to the Internet, as known in the state of the art. In this configuration, we find schematically three areas in the center of which is the firewall 1.

0016The first zone is an external zone like the Internet for example, referenced 2 on the <figref idref="f0001">figure 1</figref>.

0017The second zone, referenced 3, commonly known as DMZ for DeMilitarized Zone, is provided with an intermediate security between the outside and the inside. In this zone, we can find one or more servers 4.

0018The third zone is the inner zone itself, which can be divided into several segments. The first segment 5 corresponds to the wired portion of the internal network and optionally comprises one or more servers 6. The segments 7 and 8 respectively correspond to two local areas 9 and 10, each of which may comprise one or more workstations respectively referenced 11 and 12 .

0019The device and the method of the invention take advantage of the central position of the firewall in this type of configuration.

0020The <figref idref="f0002">figure 2</figref> represents the functional details of a firewall integrating the device according to the invention. Thus, inside the firewall 1, there are the network interfaces 13 through which the communication data arrive and depart, on the one hand from or to the internal users (within an enterprise by example) and external users (outside the company for example), and identified by reference 14, and secondly from and to resources such as information systems, servers, enterprise, and in general any client infrastructure of the enterprise servers, identified by the reference 15.

0021By the term user, external or internal means not only natural persons, but also applications for example, and, in general, the transmitters and / or receivers of information that communicate on the network.

0022Upstream of the network interfaces 13, and possibly, but not necessarily, inside the firewall 1, the communications transit through a module 16 of the NAT (Network Address Translation) type which implements, in particular, the translation of addresses. for routing, then by a module 17 of the VPN (Virtual Private Network) type which implements including encryption and decryption of data.

0023The data finally passes through the module 18 for detecting and preventing intrusion into the network. This module 18 implements the method of the invention which will be explained in detail later. It implements the filtering policy specified by the user (or administrator) 190, through an administration interface 19 for entering the criteria defining this filtering policy in natural language. The input of these criteria can thus be done for example by specifying the name of a protocol, rather than the probable ports used by this protocol. It is this filtering policy that serves as a basis for the protocol analysis implemented in the method of the invention.

0024Furthermore, the intrusion detection and prevention module in the network generates alarms processed by the module 20. Finally, the connection information that passes through this firewall, is transmitted by the module 18 to a means 21 of type "audit log", that is to say, storage of the connection history, after a possible treatment.

0025The <figref idref="f0001">figure 3</figref> schematically represents the functional details of a protocol analyzer of the device according to the invention, integrated in the module 18 of the <figref idref="f0002">figure 2</figref>. On this<figref idref="f0001">figure 3</figref>, there is therefore an analysis module 23 which comprises one or more modules 24, 25, 26 specific analysis of a given protocol. Each of these modules is connected to a storage means 27 in which are stored the data that will make it possible to check compliance with each of the protocols. Of course, the choice of a single storage means 27 for all the data of all the protocols treated, is not limiting of the invention. It is indeed possible to consider separately storing the respective data of each protocol. This analysis module 23 receives as input the filtering criteria that are specified by the user via the administration interface 19, and which are optionally stored in a storage means 22. These criteria define which modules are actually activated and which ones are deactivated. Each of the activated modules 24, 25, 26 receives as input the connection data to be analyzed and, firstly, determines whether these data follow the protocol for which it has been predefined. If no module 24, 25, 26 recognizes the protocol, then the connection is considered unanalyzed.

0026The <figref idref="f0003">figure 4</figref> schematically represents an autonomous communication protocol analysis module of the device according to the invention. This module 24 comprises a sub-module 28 for automatic recognition of the protocol, and a sub-module 29 for verifying compliance with the protocol. Each of the modules 24, 25, 26 of the<figref idref="f0001">figure 3</figref> is, in its structure and function, identical. Each of these modules is autonomous in that it can be added to or removed from the set without disruption, depending on the needs (module type "plugins").

0027The device of the invention, described in <figref idref="f0001 f0002 f0003">Figures 1 to 4</figref>, implements the method of the invention which will now be explained in more detail, in an alternative embodiment, and with reference to FIG. <figref idref="f0004">figure 5</figref>.

0028If the coverage of the protocols is complete (ideally a stand-alone module for protocol analysis possible), when a new connection is presented it is automatically attached to an analysis module. It is also possible to use, in addition to specific modules each dedicated to a given protocol, a module of generic type. This module tracks the traffic for which none of the other modules recognize the protocol. This is particularly useful in the case in particular of attacks of the data evasion type.

0029As long as the protocol identification is not performed, the data is accepted but not transmitted. Whenever new information arrives (reference 60), the detection functions of the different autonomous modules are executed in sequence (reference 65), module after module. At each execution, the detection function returns its opinion on the data packet (reference 70). This opinion can be of three types:<ol id="ol0001" compact="compact" ol-style=""><li>a) detected protocol; the module has therefore automatically recognized the protocol and will be responsible for analyzing it,</li><li>b) protocol not detected, generic module present and activated; the generic module will be in charge of the analysis</li><li>c) protocol not detected, generic module absent or present but not activated</li><li>d) Insufficient information in the data packet to detect.</li></ol>

0030When the detection function responds with a) or b), the specific module or the generic analysis module attaches to the connection (reference 75).

0031In particular, in case b) where the generic module mentioned above is present and activated, a connection based on a protocol that is not recognized by any of the other specific modules is automatically attached to this generic module (at the referenced step 75).

0032In case c), if this generic module is not present, or is present but not activated, the data is accepted but not transmitted (reference 80). If all the modules answer by c) or d), then the connection is considered as unanalyzed, so it is not allowed

0033Moreover, beyond a certain threshold of unidentified data packets, and / or beyond a certain time of unsuccessful identification attempts, which is determined at the step referenced 85, the evaluation ends and a dynamic refusal is generated (reference 90). If the threshold (s) are not exceeded, the evaluation ends and the connection is considered as unanalyzed (reference 95). These thresholds of data packet number and / or time can be predefined and fixed in the device, or parameterizable for example via the interface 19 of the device administration. They can possibly be calculated dynamically.

0034When a specific module is attached to the connection (at the step referenced 75), it will verify that the information flowing on said connection corresponds to the detected protocol (reference 110). It is therefore a verification of the compliance of the data of the protocol and a verification of the use that is made of this protocol, these checks on the grammar and the syntax These verifications can be based on the standards that define these protocols and their uses such as RFC (Request for Comments) well known to those skilled in the art.

0035When the generic module is attached to the connection (at the step referenced 75), the latter does not verify that the information flowing on said connection corresponds to the detected protocol. Indeed, by definition, the attachment to the generic module means that no protocol has been recognized by the other modules. In this case, the generic module checks the coherence of the packets. This consistency check can relate for example to sequencing and retransmissions. In these cases, it is verified that two packets of data successively analyzed are strictly identical or not (reference 110). The strict identity makes it possible to verify that a packet, supposed to be a retransmission, is indeed the retransmission of the previous one (attack by "data evasion"). If the expected retransmission does not

0036It can therefore be seen that if the verification of compliance with a given protocol previously recognized or the generic verification (reference 110), return a negative response, which is determined at the step referenced 120, the evaluation ends and a dynamic refusal is generated (reference 90). Otherwise, a dynamic authorization is issued (reference 125), and the multi-layer analysis loop continues.

0037If a specific module, and not the generic module, is attached, which is determined in step 100, the module associated with the protocol immediately superior to the previously attached module is automatically attached (at the step referenced 105) for verification. subsequent compliance (at reference step 110). Otherwise, the generic module remains attached and the loop continues with a generic check at the step referenced 110.

0038Each communication circulating on a connection is therefore either dynamically authorized or dynamically denied, depending on whether the protocol verification module attached to the connection determines that the communication results from the normal or abnormal operation of the protocol.

0039Thus each module systematically receives the new input connection for a protocol detection at first. Therefore, this detection which, if successful, will be followed by a protocol analysis, does not depend on the communication port used by said protocol, as is generally the case in the state of the art. In this way, one gets rid of the problems related to the use of dynamic ports by some applications.

0040In addition, the protocol verification, once recognized, overcomes the problems associated with applications that use an open channel to communicate with other protocols. Indeed, in the latter case, an alarm will be generated because the module intended to verify a given protocol will detect, at one time or another, in a data packet information not in accordance with the initial protocol.

0041In addition, each module thus designed makes it possible to issue a dynamic authorization of the connections resulting from the normal operation of the protocol. It makes it possible to obtain the information necessary for the dynamic opening of the connections induced by the protocol, a main connection can indeed induce one or more secondary connections (or induced). In this case, it is essential that all secondary connections are properly attached to the authorization of the main connection. Only a module for deep and precise analysis of the operation of the protocol can precisely know the communication ports to open and close.

0042The network analysis implemented by these modules is a multi-layer analysis: at each step, the current module analyzes the part of the data packet corresponding to the protocol for which it is designed, and transmits the other part to the analysis module of the module. higher protocol in the hierarchy (for example: Ethernet, then IP, then TCP, then HTTP).

0043Thus, the analysis based on the verification of the compliance of the protocol and its use, defined by the standards such as the RFCs, makes it possible, among other things, to prevent not only the known attacks but also the unknown attacks. Any traffic that does not meet the specifications of these standards will be blocked in real time. In addition, the automatic recognition modules and protocol analysis are autonomous, they can be added or removed simply, without disrupting the device. When present, they can also be enabled or disabled simply, depending on the filtering policy specified by the user. Thus, each new security gap can be filled easily. These intelligent agents that constitute the modules of automatic recognition and

0044The whole of the description above is given by way of example, and is not limiting of the invention. In particular, the firewall described above can integrate a large number of other functional modules in addition to those mentioned here. One will think in particular to the use of proxies, well known to those skilled in the art.

0045Similarly, the fact that the description above has 3 modules 24, 25, 26, automatic recognition and verification of a given protocol, is not limiting of the invention. The total number of such modules depends on the number of protocols managed (HTTP, FTP, H323, DNS, RIP, ...). Moreover, a generic type module as described above can be added or not, depending on the needs. Also, as described above, each module, specific or generic if it is present, can be simply activated or deactivated as needed. Finally, the verification performed by the generic module, in particular concerning the correct sequencing and retransmission of the packets (in particular verification of the strict identity of two data packets successively analyzed), is only an example of verification that can be performed by such a module. Any other verification unrelated to compliance with a given protocol, falls into the category of generic verifications and can be integrated into said generic module.