Patent Publication Number: US-8990573-B2

Title: System and method for using variable security tag location in network communications

Description:
CROSS REFERENCE TO RELATED APPLICATIONS 
     This application claims the benefit of U.S. Provisional Application No. 60/986,833, filed Nov. 9, 2007, entitled “System And Method For Using Variable Security Tag Location In Network Communications” the contents of which are hereby incorporated by reference. 
    
    
     FIELD OF THE INVENTION 
     This invention relates to computer system security and, more particularly, to a system and method for improved reliability in secure packet communication systems. 
     BACKGROUND OF THE INVENTION 
     Computer system resources such as web servers and database services may be directly accessible through networks such as LANs, WANs, and the Internet. Communication between computer systems over a network typically takes place through transmitted data structures called packets. A packet may include data being transported from one system to another system. Such data is generally referred to as payload. A packet may also include other data that defines the structure and nature of the packet, including information indicating the origin and destination of the packet and information indicating other packet characteristics. A stream of packets may constitute a communication from one system to another system. 
     SUMMARY OF THE INVENTION 
     The invention may be embodied as a method or system for inserting a security tag into a packet in one or more locations within the packet so that the packet may pass through a number of network impediments with the security tag or tags intact. 
     The sending node and receiving node may determine security tag placement using different methods. They may negotiate placement when they first establish secure communications. The sending node may determine placement based on known network impediments between it and the receiving node. The sending node may send a test packet to the receiving node to determine locations where security tags are removed and then determine placement based on the results (the received test packet). The sending node may arbitrarily or randomly determine one or more placement locations in each packet and the receiving node may check for the security tag in various placement locations when it receives the packet. 
     By providing a variety of security tag placement locations within a packet and then determining one or more locations to overcome network impediments between the sending node and the receiving node, secure communications may be enabled using security tags in network environments that may not typically allow such security tags within packets. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
       The invention is best understood from the following detailed description when read in connection with the accompanying drawings. According to common practice, various features/elements of the drawings may not be drawn to scale. Common numerical references represent like features/elements. The following figures are included in the drawings: 
         FIG. 1A  is a schematic diagram illustrating a network using secure communications in accordance with an exemplary embodiment of the invention; 
         FIG. 1B  is a schematic diagram of sending and receiving nodes in accordance with an exemplary embodiment of the invention; 
         FIG. 2  is a data schema of an exemplary packet structure illustrating variable placement locations for a security tag in accordance with another exemplary embodiment of the invention; 
         FIGS. 3A and 3B  are flow charts illustrating a method of creating an authenticated session between a sending node and a receiving node and of determining a location in which to insert a security tag in packets sent to the receiving node in accordance with yet another exemplary embodiment of the invention; 
         FIG. 4  is a block diagram illustrating a network conditions table in accordance with various embodiments of the invention, and 
         FIGS. 5A ,  5 B and  5 C are flow charts illustrating a method of sending packets from a sending node to a receiving node over an authenticated session and of finding and reading the security tags in the packets when the receiving node receives the packets in accordance with yet another exemplary embodiment of the invention. 
     
    
    
     DETAILED DESCRIPTION OF THE INVENTION 
     Although the invention is illustrated and described herein with reference to specific embodiments, the invention is not intended to be limited to the details shown. Rather, various modifications may be made in the details within the scope and range of equivalents of the claims and without departing from the invention. 
     Direct user/client access through networks such as LANs, WANs, and the Internet may make them vulnerable to malicious trespasses. Computer security systems may prevent such trespasses by authenticating users that desire to use resources and then ensuring that the communications between authenticated users and resources are not taken over by outside entities intent on malicious trespass. 
     One method to maintain secure communications via packets is to insert a security tag into each packet. The security tag may include information that the sender and receiver may verify, and, thus ensures to the receiver that the packet is from a known (verified) sender and, for example, is not from an outside source that is attempting to break into a stream of packets. It may also ensure that the packet&#39;s payload has not been altered during transmission. 
     A security tag within a packet, however, may not make it through (across) a network. Different network elements that check (verify) packets as the packets pass through the network may, for example, remove the security tag from a passing packet. A proxy server may, for example, consider a security tag as extraneous data and remove it, or stateful firewalls and intrusion detection systems may misinterpret the security tag and generate false alarms. In such cases, these network element (impediments) may reduce or eliminate the effectiveness of the security of the communication. 
       FIG. 1A  is a schematic diagram illustrating an exemplary network (environment) for secure communications using variable placement locations for placement of a security tag. 
     Referring to  FIG. 1A , a user  10  may work with (operate) a sending node  20 , which may be a personal computer or other computing device. Sending node  20  may have an operating system (OS)  30  that allows sending node  20  to communicate via a network  50  with other devices. 
     In certain exemplary embodiments, a security plug-in  40  that may run within OS  30 , may examine (analyze) and/or may modify packets sent by sending node  20 . In other exemplary embodiments, the security plug-in may be an application program, other program or hardware module executing on sending node  20 . 
     A receiving node  60  may be a gateway to a sub-network  90  of network  50  that connects to one or more network resources  95  such as web servers, database servers, and other services that user  10  may desire to access. A security gateway  70  (e.g., a program or hardware module) may run on receiving node  60 . A security server  80  may run as part of security gateway  70  to examine and/or modify incoming packets and may communicate with sending node  20  via sub-network  90  and/or network  50 . 
     Although the security plug-in and security gateway are illustrated in the network application and security server, respectively, the security plug-in and security gateway may be provided in any device on the network or sub-network that interacts with the stream of packets being secured. 
     Referring to  FIG. 1B , sending node  20  may include: (1) a placement determination unit  22  for selecting at least one placement location among a plurality of locations for the security tag to be embedded in each of the plurality of packets; (2) an insertion unit  24  for inserting the security tag at the at least one placement location for each of the packets; and (3) a transmission/reception unit  26  for transmitting/receiving information such as transmission of the tagged packets from sending node  20  toward receiving node  60 . 
     In certain exemplary embodiments, receiving node  60  may include: (1) a receiving unit  62  for receiving the tagged packets from sending node  20 ; (2) a packet processor  64  for authenticating each of the security tags of the tagged packets, and (3) a transmitting unit  66  for transmitting information such as the network conditions table  68 . 
       FIG. 2  is a data schema illustrating an exemplary packet structure (i.e., a Transmission Control Protocol/Internet Protocol (TCP/IP) packet  110  structure) that may be used to transport data between sending node  20  and receiving node  60 .  FIG. 2  illustrates exemplary locations  130 ,  150 ,  170  and  180  within packet  110  where a security tag may be inserted to secure (verify) the packet (including its origin). Other placement locations are also possible. 
     A TCP/IP packet may include; (1) an IP header  120  that includes Internet Protocol (IP) information about packet  110 ; (2) a TCP header  140  that includes transmission control protocol information about packet  110 ; and (3) payload  160  may include data that one node requested to send to another node. IP header  120  may include an IP option field  130  that may include optional information. The TCP header  140  may include a TCP option field  150  that may include optional information. The payload  160  may include any kind of data or information a node desires to communicate to another node. 
     In certain exemplary embodiments, security plug-in  40  may insert a security tag in one or more placement locations within the packet  110  (e.g., in the IP option field  130 , in the TCP option field  150 , at the start of the payload field  170 , at the end of the payload field  180  and/or, anywhere within the payload). 
     If the security tag is inserted in either IP option field  130  or TCP option field  150 , the option field having the inserted security tag may start with an op-code, (for example, a one-byte value that may indicate the rest of the contents of the option field. The op-code value may be inserted in TCP or IP option field  130  or  150  to specify to receiving node  60  that the TCP or IP option field  130  or  150  includes a security tag. 
       FIGS. 3A and 3B  are flow charts illustrating a method of using variable placement locations for inserting a security tag. The method includes, for example, sensing a user&#39;s  10  request to login to the sending node  20  and then to use a protected network resource  95 , and the action taken for initiating an authenticated session in which user  10  communicates with a network resource  95 . 
     Now referring to  FIGS. 3A and 3B , the sending node  20 , may include an operating system plug-in  40  and the receiving node  60  may include the security server  80 . 
     At block  202  when user  10  logs into a network-connected computer and presents user credentials, such as user name and password, sending node  20  may send an authentication request including the user credentials along with information about the sending node&#39;s capabilities and a profile of sending node  20 . This information about sending node  20  may be pre-established. For example, such information may be entered into security plug-in  40  when it was installed on sending node  20 . 
     At block  204 , receiving node  60  authenticates user  10  using the information in the request and an authentication server, such as a Light Directory Access Protocol (LDAP) server, that may be accessed by receiving node  60 . Receiving node  60 , may also read packet data from the packets that include the log-in information. The packet data may indicate to receiving node  60 , sending node&#39;s  20  (i) IP address, (ii) system health status (e.g., security compliance information), (iii) host capabilities and/or (iv) profile. 
     At block  206 , receiving node  60  may then create a unique client ID and session key for user  10  for the authenticated session. Receiving node  60  may also assemble session data that may include security tag directives, a list of protected subnets that are available through receiving node  60 , and a network conditions table  310  (shown in  FIG. 4 ) for sending node  20 . The list of protected subnets and the network conditions table  310  may be stored in a location accessible by receiving node ( 60 ). 
     Security tag directives may specify a tag location in a TCP/IP packet that sending node  20  may use when it inserts a security tag into outgoing packets traversing through receiving node  60 . If the security tag directives specify an IP option location or a TCP option location, then an op-code value may also be specified for IP/TCP option field  130  or  150  to indicate that it contains a security tag. 
     In various exemplary embodiments, security tag directives may also specify that sending node  20  may auto sense a tag location. That is, sending node  20  may automatically determine the best (optimum) security tag location by performing an automated test procedure. 
     At block  208 , receiving node  60  may send a client ID, a session key, and any other relevant connection data to sending node  20 . At block  210 , sending node  20  may use the client ID, the session key, and the other session data, as appropriate, to create a digital signature for the outgoing packet. The digital signature may be created in many ways including hashing the client ID with all or part of the packet&#39;s payload using the session key. 
     At block  212 , sending node  20  may check whether receiving node  60  specified an auto-sense, as a security tag directive. If receiving node  60  did not specify the auto-sense, at block  214 , sending node  20  checks for (e.g., notes) the tag location that receiving node  60  may have specified. Sending node  20  has then established an authenticated session to receiving node  60  for user  10 . 
     If receiving node  60  specified the auto-sense, as a security tag directive, at block  216 , sending node  20  may insert a security tag at each possible location (e.g., in the IP header field, in the TCP header field, and/or the beginning or end of the payload field) in a test packet and may send the test packet to receiving node  60 . 
     At block  218 , receiving node  60  may check for security tags in each possible location and may detect from which locations the security tags have been removed by the network impediments. At block  220 , receiving node  60  may send a placement message to sending node  20 . The placement message may indicate one or more successful tag locations (e.g., locations which were not affected by the network impediments). At block  222 , sending node  20  may choose one of those tag locations. 
     In certain exemplary embodiments, the tag locations are prioritized such that when the successful tag locations are determined, sending and receiving nodes  20  and  60  both determine the actual tag location based on the predetermined prioritization. 
     At block  224 , sending node  20  establishes an authenticated session to receiving node  60  for user  10 . 
       FIG. 4  is a block diagram illustrating a network conditions table in accordance with various embodiments of the invention. 
     Now referring to  FIG. 4 , network conditions table  310  may be sent by receiving node  60  to sending node  20  when sending node  20  establishes the authenticated session. Table  310  may include a set of entries  320 . Each entry  320  may include an IP address range  330  that may specify a network address and subnet mask, and tag placement directives  340  that are provisioned based on information related to, for example, location and type of network impediments (e.g., predetermined network impediments) located between sending node  20  and receiving node  60  that may remove security tags from packets. Sending node  60  may read network conditions table  310  to determine if sending node  20  is located at an IP address defined within the IP address ranges in network conditions table  310  and, if so, to determine one or more tag locations most likely to carry a security tag intact over network  50  to receiving node  60 . 
       FIGS. 5A ,  5 B and  5 C are flow charts illustrating a method of sending packets from sending node  60  to receiving node  20  over an authenticated session and of finding and reading security tags in the packets when receiving node  60  receives the packets in accordance with yet another exemplary embodiment of the invention. 
     Referring to  FIGS. 5A ,  5 B and  5 C, at block  402 , when sending node  20  detects that an outgoing packet is destined for (going to) protected network resource  95  or protected network  90  to which sending node  20  has an authenticated session, sending node  20  may use the digital signature, client ID, placement directives, and other control information sent by receiving node  60  to create a security tag. 
     At block  404 , sending node  20  may check whether receiving node  60  sent network conditions table  310 . If not, at block  408  sending node  20  may insert a security tag in the packet at the specified location. The specified location was previously determined when sending node  20  established the authenticated session with receiving node  60  for user  10 . 
     At block  406 , if receiving node  60  sent network conditions table  310 , sending node  20  may check network conditions table  310  to determine if the sending node&#39;s current IP address is within the IP address ranges  320  defined by entries in network conditions table  310 . At block  408 , if the current IP address is not defined within an IP address range in the network conditions table  310 , sending node  20  may insert the security tag in the packet at the specified location. 
     At block  410 , if the current IP address is defined in an IP address range in the network conditions table  310 , sending node may read the table entry&#39;s tag placement directives  330  to determine network impediments which are located between sending and receiving nodes  20  and  60 . Sending node  20  may determine the tag location or locations that are most likely to carry the security tag intact over network  50  and may insert the security tag at one or more of these locations. 
     At block  412 , sending node  20  may send the packet with the security tag to receiving node  60 . At block  414 , when receiving node  60  receives the packet from sending node  20 , receiving node  60  may determine whether or not it previously specified a fixed tag location to sending node  20 . At block  416 , if receiving node  60  specified a fixed location, receiving node  60  may check for the security tag in the specified location. At block  418 , if receiving node  60  locates (finds) the security tag at the specified location, it may read the security tag and, at block  446 , may check whether the security tag is authentic. 
     Many different methods for authentication are possible including receiving node  60  reading the client ID in the security tag, retrieving the session key it created for that user for the authenticated session, then hashing the client ID with the packet&#39;s payload using the session key and checking the resultant value against the digital signature contained in the security tag. 
     At block  420 , if receiving node  60  had not previously specify a fixed tag location, or if receiving node  60  is unable to allocate the security tag in the fixed location, receiving node  60  may check a size of the packet&#39;s IP option field. At block  422 , if the IP option field size is greater than or equal to the security tag size, receiving node  60  may check the op code value of IP option field  130  to determine if it matches the op code value receiving node  60  previously specified when it first negotiated the session information with sending node  20 . At block,  424 , if so, receiving node  60  may read IP option field  130  to determine if it finds a valid security tag. At block  428 , if the size of IP option field  130  is less than the size of the security tag, if receiving node  60  does not find the specified op code value in IP option field  130  or if receiving node  60  cannot find a valid security tag, receiving node  60  may check TCP option field  150 . At block  424 , if receiving node  60  finds a valid security tag, receiving node  60  may read the security tag in IP option field  130  and then at block  446  may check to determine if the security tag is authentic. 
     If receiving node  60  does not find a security tag in IP option field  130 , it may check the size of the packet&#39;s TCP option field  150 . At block  430 , if the TCP option field size is greater than or equal to the security tag size, receiving node  60  may check the TCP option&#39;s op code value to determine if it matches the specified op code value the receiving node  60  previously specified when it first negotiated the session information with sending node  20 . At block  432 , if receiving node  60  does find the specified op code value, receiving node may read TCP option field  150  to determine if it finds a valid security tag. At block  438 , if the option field size is less than the size of the security tag, if receiving node  60  does not find the specified op code value in TCP option field  130 , or if receiving node  60  does not find a valid security tag, receiving node  60  may check the start of the payload field  170 . At block  436 , if the node finds a valid security tag, receiving node  60  may read the security tag in TCP option field  150  and then, at block  446 , may check to determine if the security tag is authentic. 
     If receiving node  60  does not find a security tag in TCP option field  150 , it may read the start of the packet&#39;s payload field  160  to determine if there is a valid security tag. If so, at block  440 , receiving node  60  may read the security tag and then, at block  446 , may check to determine if the security tag is authentic. 
     At block  442 , if no security tag is located in the start of the payload field  170 , receiving node  60  may read the end of the packet&#39;s payload field  180  to determine if there is a valid security tag. If so, at block  440 , receiving node  60  may read the security tag and then, at block  446 , may check whether the security tag is authentic. If no security tag is located at the start or end of the payload field  170  or  180 , receiving node  60  has not found a valid security tag and, at block  444 , may drop the packet (e.g., to prevent or restrict access by the packet to the protected resource  95  and/or the protected network  90 ), thus blocking access to the protected resource  95  and/or the protected network  90 . In certain exemplary embodiments receiving node  60  may quarantine the packet and/or send the packet elsewhere for analysis. 
     At block  448 , if the security tag is authentic, receiving node  60  may remove the security tag from the packet and may send the packet to the desired network resource located behind (after) security gateway  70 . In certain exemplary embodiments, security gateway  70  may include receiving node  60 . 
     At block  450 , when a subsequent packet for this authenticated session arrives at receiving node  60 , receiving node  60  may check the same tag location where it found the security tag in the last session packet. At block  446 , if receiving node  60  finds a security tag at the same location, it may determine the security tag&#39;s authenticity. If receiving node  60  does not find a security tag at the same location, it may continue processing at block  420  and search for the security tag in other locations. 
     The security system and the method for inserting a security tag at variable locations in a packet disclosed herein have diverse applicability in a range of markets including financial services, wireless LAN (e.g., wireless sales force automation and contractor services), and government regulated markets such as banking and health care, among others. 
     Although tag location are disclosed as being selected using either placement messages, network conditions tables or auto sense procedures, it is also possible that sending node may insert the security tags randomly or at a predetermined location or locations and then may send the packet with the security tag. In such cases, it is possible for the receiving node to check for security tags in packets and to drop packets, for example, when a valid security tag is not found within a predetermined number of packets or after a predetermined timeframe from the last valid security tag. 
     Although the sending node is shown as inserting a single security tags in each packet sent to the receiving node, it is contemplated that the sending node may select one or more of tag locations and may insert the security tag into the first packet, each packet or selected packets (periodically or pseudo-randomly) of the session according to network security levels indicated by receiving node  60 . 
     Although verification of the security tag in placement locations is illustrated in a particular order (e.g., checking the IP option field, the TCP option field and then the payload), the verification may occur in any order. Moreover, the order of such checking may be based on any known network impediments. 
     Although various embodiments of the present invention have been described in terms of creating secure connections between nodes in a network, it is not limited thereto. The methods may be carried out between networks, for example, using any number of different protocols. 
     Although various embodiments of the present invention have been described in terms of messages being transmitted between client and server, it is not limited thereto. The identification techniques disclosed herein apply to communications transmitted with respect to a wide range of computer applications, and are not limited to server applications. 
     The terms message and communication as used herein are intended to refer to a broad class of transmissions carried out between computer systems or portions thereof; for example, inquiries, data updates, data edits, and data requests, among others. 
     As described herein, for example, the invention may be embodied in software, in a machine (e.g., a computer system, a microprocessor based appliance, etc.) that includes software in memory, or in a tangible computer storage carrier configured to carry out the protection scheme (e.g., in a self contained silicon device, a solid state memory, an optical disc, a magnetic disc, etc.). Further, when the invention is embodied in a remote system for a user to access a resource, the remote system is not limited to an application server, and the resource is not limited to an application on an application server. It is contemplated that the security system may be included in other layers of the network such as the network layer, or firewall layer of combinations of the other layers. 
     As described herein, the remote system may be any remotely accessible microprocessor based device (e.g., a PDA, a personal computer, a network server, etc.), and the resource may be any resource installed on (or accessible through a connection to) the remotely accessible device. 
     Although the invention is illustrated and described herein with reference to specific embodiments, the invention is not intended to be limited to the details shown. Rather, various modifications may be made in the details within the scope and range equivalents of the claims and without departing from the invention.