Network security using encrypted subfields

In one embodiment, a method includes receiving from a secure device, an encrypted rule at a first network device, receiving at the first network device, a packet containing at least one encrypted subfield from a second network device, the subfield encrypted based on a key received at the second network device from the secure device, and determining if the encrypted subfield matches the encrypted rule. An apparatus and logic are also disclosed herein.

TECHNICAL FIELD

The present disclosure relates generally to communication networks, and more particularly, to network security.

BACKGROUND

Network firewalls use rules to determine which data packets should be allowed, and which should be dropped. In addition to causing a packet to be dropped, a rule might trigger another action on the firewall, such as creating a record in a log. A rule consists of information about the source, destination, network ports, protocols, application type, and data appearing in the packet. When a packet matches the information in a rule, the firewall performs the action associated with the rule on that packet. Rules for matching certain packets and action to be taken on the packets may be sensitive information, such as personal information or government classified information, in which case it is important to hide the content of the rules in order to keep secret the techniques used to generate the rules.

DESCRIPTION OF EXAMPLE EMBODIMENTS

Overview

In one embodiment, a method generally comprises receiving from a secure device, an encrypted rule at a first network device, receiving at the first network device, a packet containing at least one encrypted subfield from a second network device, the subfield encrypted based on a key received at the second network device from the secure device, and determining if the encrypted subfield matches the encrypted rule.

In another embodiment, an apparatus generally comprises a processor for receiving from a secure device, an encrypted rule at a first network device, processing a packet containing at least one encrypted subfield from a second network device, the subfield encrypted based on a key received at the second network device from the secure device, and determining if the encrypted subfield matches the encrypted rule. The apparatus further includes memory for storing the encrypted rule.

Example Embodiments

The following description is presented to enable one of ordinary skill in the art to make and use the embodiments. Descriptions of specific embodiments and applications are provided only as examples, and various modifications will be readily apparent to those skilled in the art. The general principles described herein may be applied to other applications without departing from the scope of the embodiments. Thus, the embodiments are not to be limited to those shown, but are to be accorded the widest scope consistent with the principles and features described herein. For purpose of clarity, details relating to technical material that is known in the technical fields related to the embodiments have not been described in detail.

Rules used to protect network traffic may be classified. In conventional systems, it is generally unacceptable to enter classified data into commercial non-high-assurance equipment.

The embodiments described herein provide compromise-resilient network security enforcement using encrypted subfields, which allows commercial network security equipment, such as firewalls and IPS/IDS (Intrusion Protection System/Intrusion Detection System) devices to be used to enforce classified network security rules. As described in detail below, target values of packet subfields may be encrypted by a trusted device and given to the commercial device in an encrypted form, as part of the configuration information. A partly trusted device encrypts the packet subfields on the fly, creating a partly-encrypted version of the packet that is inspected by the commercial device. The embodiments ensure that the compromise of a single network device does not compromise the confidentiality of the rules.

Referring now to the figures, and first toFIG. 1, an example of a network in which embodiments described herein may be implemented is shown. For simplification only a small number of nodes are shown. The network includes a fully trusted device (secure device)10in communication with two partly trusted devices (A and B)12,14.

The fully trusted device10may be, for example, an offline management workstation, secure remote management device, or any other secure device. Network device10stores rules15for matching certain packets and actions to be taken on the packets (referred to as signatures). The rules15may be used to protect at least some of the network traffic. As previously discussed, it may be important to hide the content of the rules in order to keep secret the techniques used to generate the rules and the actual rules. The trusted device10encrypts target values in the rule with a secret key and transmits the encrypted rule18to partly trusted device B, and the key16to partly trusted device A. The secure device10may transmit one or more keys16and one or more encrypted rules18. Different keys or rules may be used for encryption and inspection of different traffic flows, for example.

Data (e.g., private keys16, encrypted rules18) transmitted from the fully trusted device10to the partly trusted devices12,14is sent via secure management channels. The secure management channel may use, for example, SSH (Secure Shell), HTTPS (Hypertext Transfer Protocol Secure), or any other secure communication protocol. In addition, the data can be moved onto the partly trusted devices via a physically secure interface, for instance by removable storage media.

Network device A stores the security key16received from the secure device10and uses the key to encrypt traffic received at the device. As described below, the network device A encrypts one or more subfields of packets13received at the network device. As described below, a subfield may be an IP address, network port, network protocol number, or any other well-known data that can appear in a packet, or it may be only part of the subfields described above. For example, a subfield may consist of the first 16 bits of the 32-bit source address that appears in an IP packet. Network device A may be any device configured for performing encryption on received traffic (packet13) and transmitting the encrypted traffic (packet17) to network device B.

Network device B stores the encrypted rules (e.g., ciphertexts)18received from the secure device10and uses the rules determine if received traffic matches the rules. Network device B may be, for example, commercial network security equipment such as a firewall, IPS device, IDS device, or other network security device.

The network devices12,14may be physically separate devices or the devices may be co-located (e.g., different blades on same blade server, different line cards on same physical device). The functions provided by each of the network devices12,14may also be distributed across more than one network device.

Data flow paths between the nodes10,12and14may include any number or type of intermediate nodes (e.g., routers, switches, gateways, or other network devices) and communication links, which facilitate passage of data between the nodes. The traffic may traverse one or more networks (e.g., local area network, metropolitan area network, wide area network, enterprise network, Internet, intranet, radio access network, public switched network, or any other network).

The example shown inFIG. 1illustrates the flow of traffic between network devices12and14. Network device A receives packet13and encrypts one or more subfields of the packet. Network device A encrypts the subfields using information (e.g., secret key)16received from fully trusted device10and then transmits encrypted packet17to network device B. Network device B uses the encrypted rule (or rules)18received from fully trusted device10to inspect the packet17. In one embodiment, network device B may filter the traffic received from network device A based on results of the inspection. For example, network device B may forward the encrypted packet17if the encrypted subfield matches the rule18, or filter the packet if the encrypted subfield does not match the rule. Filtering may include, for example, dropping, modifying (e.g., editing or fixing one or more fields, stripping files), redirecting (e.g., putting blocked packets on a particular VLAN (Virtual Local Area Network)), or marking the packet.

In another embodiment, network device B transmits inspection results (e.g., matching information). As described below with respect to the examples shown inFIGS. 6 and 7, network device B may forward inspection results to another device (e.g., management station, forwarding device (router, switch) for each packet, group of packets, traffic stream, or class, for example.

In yet another embodiment, network device B forwards or filters the packet and transmits inspection results to another device.

It is to be understood that the network shown inFIG. 1and described herein is only an example and that the embodiments may be implemented in networks having different network topologies or network devices, or utilizing different protocols, without departing from the scope of the embodiments.

FIG. 2is a block diagram illustrating an example of a network device20(e.g., network device B inFIG. 1) that may be used to implement embodiments described herein. The network device20is a programmable machine that may be implemented in hardware, software, or any combination thereof. The network device20includes a processor22, memory24and interfaces26. Memory24may be a volatile memory or non-volatile storage, which stores various applications, modules, and data for execution and use by the processor22. Memory24may store, for example, encrypted rules18.

Logic may be encoded in one or more tangible computer readable media for execution by the processor22. For example, the processor22may execute codes stored in a computer-readable medium such as memory24. The computer-readable medium may be, for example, electronic (e.g., RAM (random access memory), ROM (read-only memory), EPROM (erasable programmable read-only memory)), magnetic, optical (e.g., CD, DVD), electromagnetic, semiconductor technology, or any other suitable medium.

The interfaces26may comprise any number of interfaces (linecards, ports) for receiving data or transmitting data to other devices.

The network device20may further include any suitable combination of hardware, software, algorithms, processors, devices, components, or elements operable to facilitate the capabilities described herein.

FIG. 3is a flowchart illustrating an overview of a process for network security using encrypted subfields, in accordance with one embodiment. At step30, a first network device (e.g., partly trusted device B inFIG. 1) receives an encrypted rule18from secure device10. Network device B then receives traffic from network device A (second network device) (step32). The traffic includes one or more packets17comprising at least one encrypted subfield. As described above, network device A receives the secret key16from secure network device10and uses the key to encrypt one or more subfields of the packet, and then forwards the resulting packet to network device B. Network device B inspects the packet17to determine if the encrypted subfield in the packet matches the encrypted rule18received from secure device10(steps34and35). If there is a match between the subfield and the encrypted rule, the packet is forwarded (steps35and36). If the subfield does not match the rule, the packet is filtered (step38). As previously discussed, network device B may transmit inspection results (step39) instead of (or in addition to) forwarding or filtering the packet.

It is to be understood that the process illustrated inFIG. 3and described above is only an example and that steps may be added, removed, or modified, without departing from the scope of the embodiments.

FIG. 4illustrates an example of a packet40with encrypted subfields. In this example, subfields containing the source IP address and destination port are encrypted. The rule may be, for example, if srcip==44.1.0.0 and dest.port==555 then drop. The entire IP address and destination port or a portion thereof may be encrypted. It is to be understood that the term ‘subfield’ as used herein may refer to any field, element, header, address, port, or identifier, or portion thereof. For example, the subfield may comprise an entire address or port field, portion of the address or port field, an XML (Extensible Markup Language) element, or URL (Uniform Resource Locator) file name. The packet may include any number or type of fields and any subfield may be encrypted as long as both devices A and B use the same method for parsing packets into subfields.

As previously described, the network security system may be implemented using any number of network devices and configurations. The following describes examples of network devices and topologies that may be used to implement the embodiments described herein.

FIG. 5illustrates an example of an embodiment in which stream duplication is used between the partly trusted devices. The system includes fully trusted device50in communication with partly trusted devices52(A) and54(B). The fully trusted device50transmits one or more private keys56to network device A and one or more encrypted rules58to network device B. In this example, network device A forwards both unencrypted packet53and encrypted packet57to network device B. Network device B makes a decision on the encrypted packet57based on the encrypted rules58and if the encrypted subfields match the rules, forwards the unencrypted packet53.

FIG. 6illustrates an embodiment in which network device B does not see plaintext (unencrypted) packet63. As described above, the system includes fully trusted device60in communication with partly trusted devices62(A) and64(B). The system further includes a third network device65(C) operable to receive inspection results from network device B and forward or filter the plaintext packet63received from network device A. Network devices B and C may be physically separate devices or co-located. One or more functions of network devices B and C may be performed by a firewall. The fully trusted device60transmits one or more private keys66to network device A and one or more encrypted rules68to network device B. In this example, network device A forwards encrypted packet67to network device B. Network device B makes a decision on the encrypted packet and forwards an indication of a match or no-match (inspection results)69to network device C (65) (third network device). Network device A also forwards the unencrypted packet63to network device C, which forwards the unencrypted packet63if network device B indicates that the rules matched the corresponding encrypted subfields in packet67. If the encrypted subfields in packet67do not match the encrypted rules68, the packet is filtered by network device C.

FIG. 7illustrates an embodiment in which network device B is an IDS (Intrusion Detection System) or IPS (Intrusion Protection System) device. The system includes fully trusted device70in communication with partly trusted devices72(A) and74(B). The fully trusted device70transmits one or more private keys76to network device A and one or more encrypted rules78to network device B. Network device A encrypts received packet73and forwards encrypted packet77to network device B. Network device A also forwards the unencrypted packet along its network path to a separate device (not shown). Network device B applies IDS/IPS with encrypted target values to the encrypted packet77. Network device B collects inspection results for network traffic and sends the information to a management station (not shown) configured to alert the network of any intrusion attempts.

The system ofFIG. 8includes fully trusted device80in communication with partly trusted devices82(A),84(B), and85(C). The fully trusted device80transmits one or more private keys86to network device A and network device C. The fully trusted device80also transmits one or more encrypted rules88to network device B. Network device A encrypts received packet83and transmits encrypted packet87to network device B. Network device B inspects the encrypted packet87and if the encrypted subfields of the packet match the rules88, forwards the encrypted packet to network device C. Network device C uses the key86received from the fully trusted device80to decrypt the packet and then forwards the plaintext packet83. Network device C decrypts the subfields using the same parsing and encryption values as network device A.

It is to be understood that the embodiments shown inFIGS. 5-8are only examples and that other network devices and network configurations may be used, without departing from the scope of the embodiments.

Although the method and apparatus have been described in accordance with the embodiments shown, one of ordinary skill in the art will readily recognize that there could be variations made without departing from the scope of the embodiments. Accordingly, it is intended that all matter contained in the above description and shown in the accompanying drawings shall be interpreted as illustrative and not in a limiting sense.