Patent SG-11201808254W-A (SG)
Title: Cloud-based forensic ip traceback
Inventor: CHENG LONG
IPC: G06F21/60
Filed: 2017-03-23
Abstract: INTERNATIONAL APPLICATION PUBLISHED UNDER THE PATENT COOPERATION TREATY (PCT) (19) World Intellectual Property -, Organization 11111111011110111010101111101011111011101111001111111010101101111101111011111 International Bureau .. .... ..Yejd (10) International Publication Number (43) International Publication Date .... ...,,, WO 2017/164820 Al 28 September 2017 (28.09.2017) WIP0 I PCT (51) International Patent Classification: pore 138632 (SG). LIM, Wee Yong; c/o PKM, Institute HO4L 12/26 (2006.01) G06F 21/60 (2013.01) for Infocomm Research, 1 Fusionopolis Way, #21-01 Con- HO4L 9/32 (2006.01) nexis, South Tower, Singapore 138632 (SG). THING, (21) International Application Number: Vrizlynn; c/o PKM, Institute for Infocomm Research, 1 Fusionopolis Way, #21-01 Connexis, South Tower, Singa- PCT/SG2017/050149 pore 138632 (SG). (22) International Filing Date: (74) Agent: VIERING, JENTSCHURA & PARTNER LLP; 23 March 2017 (23.03.2017) P.O. Box 1088, Rochor Post Office, Rochor Road, Singa- (25) Filing Language: English pore 911833 (SG). (26) Publication Language: English (81) Designated States (unless otherwise indicated, for every kind of national protection available): AE, AG, AL, AM, (30) Priority Data: AO, 10201602280X 23 March 2016 (23.03.2016) SG BZ, AT, AU, AZ, BA, BB, BG, BH, BN, BR, BW, BY, CA, CH, CL, CN, CO, CR, CU, CZ, DE, DJ, DK, DM, (71) Applicant: AGENCY FOR SCIENCE, TECHNOLOGY DO, AND RESEARCH [SG/SG]; 1 Fusionopolis Way, #20- HN, DZ, EC, EE, EG, ES, FI, GB, GD, GE, GH, GM, GT, HR, HU, ID, IL, IN, IR, IS, JP, KE, KG, KH, KN, 10, Connexis North Tower, Singapore 138632 (SG). KP, MD, KR, KW, KZ, LA, LC, LK, LR, LS, LU, LY, MA, ME, MG, MK, MN, MW, MX, MY, MZ, NA, NG, (72) Inventors: CHENG, Long; c/o PKM, Institute for In- NI, focomm Research, 1 Fusionopolis Way, #21-01 Connexis, RU, NO, NZ, OM, PA, PE, PG, PH, PL, PT, QA, RO, RS, RW, SA, SC, SD, SE, SG, SK, SL, SM, ST, SV, SY, South Tower, Singapore 138632 (SG). DIVAKARAN, TH, TJ, TM, TN, TR, TT, TZ, UA, UG, US, UZ, VC, VN, — Dinil Mon; c/o PKM, Institute for Infocomm Research, 1 ZA, ZM, ZW. Fusionopolis Way, #21-01 Connexis, South Tower, Singa- = = = [Continued on next page] Title: CLOUD-BASED FORENSIC IP TRACEBACK (54) = 300 (57) : A method for IP traceback is provided comprising receiving a traceback request including the identity of a traceback-deployed autonomous sys- —= = — pr ) tem closest to the destination node in a network rout- ing path, recursively querying a traceback server as- sociated with the traceback-deployed autonomous system to receive the identity of a preceding trace- back-deployed autonomous system in the network routing path, and determining the network routing = = Traceback query path based on the received identities of traceback-de- 302 ployed autonomous systems. Additionally, authentic- ation for traceback request is achieved using token = (---- --\"e ` Traceback Coordinator , delivery, wherein token is fragmented and marking of = WS-API '' ' WS-API WS-API, a packet is performed when a field on the packet matches at least one token fragment. End! ' A\ ; ii c .. , ..' , ' f. :' Query AS, , ASA — AS \:./ AS 4 ', ,______-; t \V , Traceback serve r Legacy AS AS, — 1±1 - 1 1-1 © ei co FIG. 3 1-1 IN 1-1 0 ei O WO 2017/164820 All#1101M011010EIR0101301110011111010101101110V0IMIE (84) Designated States (unless otherwise indicated, for every SI, SK, SM, TR), OAPI (BF, BJ, CF, CG, CI, CM, GA, kind of regional protection available): ARIPO (BW, GM, KE, LR, LS, MW, MZ, NA, RW, SD, SL, ST, GH, SZ, GN, GQ, GW, KM, ML, MR, NE, SN, TD, TG). TZ, UG, ZM, ZW), Eurasian (AM, AZ, BY, KG, KZ, Published: RU, TJ, TM), European (AL, AT, BE, BG, CH, CY, DK, EE, ES, FI, FR, GB, GR, HR, HU, IE, IS, LU, LV, MC, MK, MT, NL, NO, PL, PT, RO, CZ, IT, RS, DE, — LT, SE, with international search report (Art. 21(3))