Intrusion handling system and method for a packet network with dynamic network address utilization

• US 20060179485A1
• Filed: 02/09/2005
• Published: 08/10/2006
• Est. Priority Date: 02/09/2005
• Status: Active Grant

• Current Assignee: Intrinsic Security, Inc.
• Original Assignee: Gary Longsine
• Inventors: Longsine, Gary W., Swiger, Charles, Cone, Alexander Brian
• Granted Patent: US 7,765,596 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

An intrusion handling system for a packet network is provided according to an embodiment of the invention. The intrusion handling system includes a communication interface configured to receive or detect a network event that is directed to a network address. The intrusion handling system further includes a processing system coupled to the communication interface and configured to receive the network event from the communication interface, determine whether to yield the network address, respond to the network event in order to retain the network address, and not respond to the network event in order to yield the network address.

Claims

1. An intrusion handling system for a packet network, comprising:

a communication interface configured to receive or detect a network event that is directed to a network address; and

a processing system coupled to the communication interface and configured to receive the network event from the communication interface, determine whether to yield the network address, respond to the network event in order to retain the network address, and not respond to the network event in order to yield the network address.

2. The intrusion handling system of claim 1, with the processing system being further configured to determine whether the network event is generated by an intruder and wherein the network address is not yielded if the network event is generated by the intruder.

3. The intrusion handling system of claim 1, with the processing system being further configured to determine whether the network event is generated by a network address allocation system and wherein the network address is not yielded if the network event is not generated by the network address allocation system.

4. The intrusion handling system of claim 1, with the determining further comprising determining whether the network address is being used by the intrusion handling system for intrusion handling.

5. The intrusion handling system of claim 1, with the determining further comprising determining whether the network address is being used by the intrusion handling system for trapping an intrusion occurrence.

6. The intrusion handling system of claim 1, with the determining further comprising determining whether the network address is trapping an intrusion occurrence and determining whether an address yield rule set indicates that the network address should be yielded.

7. The intrusion handling system of claim 1, with the intrusion handling system comprising a stand-alone network device.

8. The intrusion handling system of claim 1, with the intrusion handling system being integrated into a network component.

9. The intrusion handling system of claim 1, with the intrusion handling system being integrated into a network address allocation system.

10. The intrusion handling system of claim 1, with the network event comprising an address request message.

11. The intrusion handling system of claim 1, with the network event comprising an address signal.

12. An intrusion handling system for a packet network, comprising:

a Dynamic Host Configuration Protocol (DHCP) server;

a communication interface in the DHCP server, with the communication interface configured to receive or detect a network event that is directed to a network address; and

a processing system in the DHCP server, with the processing system configured to receive the network event from the communication interface, determine whether the network address is being used by the intrusion handling system for intrusion handling, yield the network address to the network address allocation routine if the network address is not being used by the intrusion handling system for intrusion handling, and retain the network address if the address is being used by the intrusion handling system for intrusion handling.

13. The intrusion handling system of claim 12, with the processing system being further configured to determine whether the network event is generated by an intruder and wherein the network address is not yielded if the network event is generated by the intruder.

14. The intrusion handling system of claim 12, with the determining further comprising determining whether the network address is being used by the intrusion handling system for trapping an intrusion occurrence.

15. The intrusion handling system of claim 12, with the determining further comprising determining whether the network address is trapping an intrusion occurrence and determining whether an address yield rule set indicates that the network address should be yielded.

16. The intrusion handling system of claim 12, with the network event comprising an address request message.

17. The intrusion handling system of claim 12, with the network event comprising an address signal.

18. An intrusion handling system for a packet network, comprising:

a communication interface configured to receive or detect a network event that is directed to a network address; and

a processing system coupled to the communication interface and configured to obtain a listing of one or more unused network addresses, employ at least a portion of the listing of one or more unused network addresses for intrusion handling operations in the intrusion handling system, and dynamically yield the network address from the intrusion handling system in response to the network event.

19. The intrusion handling system of claim 18, with the employing comprising the intrusion handling system iteratively obtaining a plurality of available network addresses.

20. The intrusion handling system of claim 18, further comprising obtaining additional network addresses when available.

21. The intrusion handling system of claim 18, wherein a network address is periodically re-requested by the intrusion handling system.

22. The intrusion handling system of claim 18, with the processing system being further configured to determine whether the network event is generated by an intruder and wherein the network address is not yielded if the network event is generated by the intruder.

23. The intrusion handling system of claim 18, with the processing system being further configured to determine whether the network event is generated by a network address allocation system and wherein the network address is not yielded if the network event is not generated by the network address allocation system.

24. The intrusion handling system of claim 18, with the employing comprising the intrusion handling system using a network address for intrusion handling without requesting the network address.

25. The intrusion handling system of claim 18, with the employing comprising the intrusion handling system using a network address for intrusion handling after requesting the network address.

26. The intrusion handling system of claim 18, with the employing comprising the intrusion handling system using a network address for intrusion handling after requesting the network address from a network address allocation system.

27. The intrusion handling system of claim 18, wherein a network address is requested from a network address allocation system by the intrusion handling system and wherein the requested network address is allocated to the intrusion handling system for a predetermined time period by the network address allocation system.

28. The intrusion handling system of claim 18, with the obtaining further comprising identifying a network address allocation system.

29. The intrusion handling system of claim 18, with the obtaining comprising:

listening to network traffic; and

removing used network addresses from a listing of all network addresses in order to form the listing of one or more unused network addresses.

30. The intrusion handling system of claim 18, with the obtaining comprising:

obtaining a listing of all network addresses;

listening to network traffic; and

removing used network addresses included in the network traffic from a listing of all network addresses in order to form the listing of one or more unused network addresses.

31. The intrusion handling system of claim 18, with the obtaining comprising querying the packet network for a particular network address and adding the particular network address to the listing of one or more unused network addresses if the particular network address is unused.

32. The intrusion handling system of claim 18, with the obtaining comprising querying a network address allocation system for a particular network address and adding the particular network address to the listing of one or more unused network addresses if the particular network address is unused.

33. The intrusion handling system of claim 18, with the obtaining comprising querying a network address allocation system for a particular network address and adding the particular network address to the listing of one or more unused network addresses if the network address allocation system does not respond to the query.

34. The intrusion handling system of claim 18, with the obtaining comprising:

requesting a network address of the one or more unused network addresses;

receiving a request response;

employing the network address in the intrusion handling system if the request response signals that the network address can be used by the intrusion handling system; and

not employing the network address in the intrusion handling system if the request response signals that the network address cannot be used by the intrusion handling system.

35. The intrusion handling system of claim 34, with the requesting comprising requesting the network address from a network address allocation system.

36. The intrusion handling system of claim 18, with the processing system being further configured to determine whether the network address is being used by the intrusion handling system for trapping an intrusion occurrence before yielding the network address.

37. The intrusion handling system of claim 18, with the processing system being further configured to determine whether the network address is being used by the intrusion handling system for trapping an intrusion occurrence and to determine whether the address yield rule set indicates that the network address should be yielded.

38. The intrusion handling system of claim 18, with the intrusion handling system comprising a stand-alone network device.

39. The intrusion handling system of claim 18, with the intrusion handling system being integrated into a network component.

40. The intrusion handling system of claim 18, with the intrusion handling system being integrated into a network address allocation system.

41. The intrusion handling system of claim 18, with the network event comprising an address request message.

42. The intrusion handling system of claim 18, with the network event comprising an address signal.

43. A method of managing network address utilization in an intrusion handling system for a packet network, the method comprising:

receiving or detecting a network event that is directed to a network address;

determining whether to yield the network address;

responding to the network event in order to retain the network address; and

not responding to the network event in order to yield the network address.

44. The method of claim 43, with the determining further comprising determining whether the network event is generated by an intruder and wherein the network address is not yielded if the network event is generated by the intruder.

45. The method of claim 43, with the determining further comprising determining whether the network event is generated by a network address allocation system and wherein the network address is not yielded if the network event is not generated by the network address allocation system.

46. The method of claim 43, with the determining further comprising determining whether the network address is being used by the intrusion handling system for intrusion handling.

47. The method of claim 43, with the determining further comprising determining whether the network address is being used by the intrusion handling system for trapping an intrusion occurrence.

48. The method of claim 43, with the determining further comprising determining whether the network address is being used by the intrusion handling system for trapping an intrusion occurrence and determining whether the address yield rule set indicates that the network address should be yielded.

49. The method of claim 43, with the network event being generated by a network address allocation system.

50. The method of claim 43, with the network event comprising an address request message.

51. The method of claim 43, with the network event comprising an address signal.

52. A method of managing network address utilization in an intrusion handling system for a packet network, the method comprising:

receiving or detecting a network event that is directed to a network address;

determining whether the network address is being used by the intrusion handling system for intrusion handling;

yielding the network address if the network address is not being used by the intrusion handling system for intrusion handling; and

retaining the network address if the address is being used by the intrusion handling system for intrusion handling.

53. The method of claim 52, with the yielding further comprising determining whether the network event is generated by an intruder and wherein the network address is not yielded if the network event is generated by the intruder.

54. The method of claim 52, with the yielding further comprising determining whether the network event is generated by a network address allocation system and wherein the network address is not yielded if the network event is not generated by the network address allocation system.

55. The method of claim 52, with the determining further comprising determining whether the network address is being used by the intrusion handling system for trapping an intrusion occurrence and determining whether the address yield rule set indicates that the network address should be yielded.

56. The method of claim 52, with the network event being generated by a network address allocation system.

57. The method of claim 52, with the network event comprising an address request message.

58. The method of claim 52, with the network event comprising an address signal.

59. A method of managing network address utilization in an intrusion handling system for a packet network, the method comprising:

receiving or detecting a network event that is directed to a network address;

determining whether the network address is being used by the intrusion handling system for trapping an intrusion occurrence;

not responding to the network event if the network address is not being used by the intrusion handling system for trapping an intrusion occurrence or if the address yield rule set indicates that the network address should be yielded; and

responding to the network event if the network address is being used by the intrusion handling system for trapping an intrusion occurrence and if the address yield rule set indicates that the network address should not be yielded.

60. The method of claim 59, with the responding further comprising determining whether the network event is generated by an intruder and wherein the intrusion handling system responds and the network address is not yielded if the network event is generated by the intruder.

61. The method of claim 59, with the responding further comprising determining whether the network event is generated by a network address allocation system and wherein the intrusion handling system responds and the network address is not yielded if the network event is not generated by the network address allocation system.

62. The method of claim 59, with the network event being generated by a network address allocation system.

63. The method of claim 59, with the network event comprising an address request message.

64. The method of claim 59, with the network event comprising an address signal.

65. A method of managing network address utilization in an intrusion handling system for a packet network, the method comprising:

obtaining a listing of one or more unused network addresses;

employing at least a portion of the listing of one or more unused network addresses for intrusion handling operations in the intrusion handling system; and

dynamically yielding a requested network address from the intrusion handling system when a network event that is directed to the requested network address is received or detected.

66. The method of claim 65, with the employing comprising the intrusion handling system iteratively obtaining a plurality of available network addresses.

67. The method of claim 65, further comprising obtaining additional network addresses when available.

68. The method of claim 65, wherein a network address is periodically re-requested by the intrusion handling system.

69. The method of claim 65, with the network event being generated by a network address allocation system.

70. The method of claim 65, with the employing comprising the intrusion handling system using a network address for intrusion handling without requesting the network address.

71. The method of claim 65, with the employing comprising the intrusion handling system using a network address for intrusion handling after requesting the network address.

72. The method of claim 65, with the employing comprising the intrusion handling system using a network address for intrusion handling after requesting the network address from a network address allocation system.

73. The method of claim 65, wherein a network address is requested from a network address allocation system by the intrusion handling system and wherein the requested network address is allocated to the intrusion handling system for a predetermined time period by the network address allocation system.

74. The method of claim 65, further comprising attempting to detect a network address allocation system before the obtaining.

75. The method of claim 65, with the obtaining comprising:

listening to network traffic; and

removing used network addresses from a listing of all network addresses in order to form the listing of one or more unused network addresses.

76. The method of claim 65, with the obtaining comprising:

obtaining a listing of all network addresses;

listening to network traffic; and

removing used network addresses included in the network traffic from a listing of all network addresses in order to form the listing of one or more unused network addresses.

77. The method of claim 65, with the obtaining comprising querying the packet network for a particular network address and adding the particular network address to the listing of one or more unused network addresses if the particular network address is unused.

78. The method of claim 65, with the obtaining comprising querying a network address allocation system for a particular network address and adding the particular network address to the listing of one or more unused network addresses if the particular network address is unused.

79. The method of claim 65, with the obtaining comprising querying a network address allocation system for a particular network address and adding the particular network address to the listing of one or more unused network addresses if the network address allocation system does not respond to the query.

80. The method of claim 65, with the obtaining comprising:

requesting a network address of the one or more unused network addresses;

receiving a request response;

employing the network address in the intrusion handling system if the request response signals that the network address can be used by the intrusion handling system; and

not employing the network address in the intrusion handling system if the request response signals that the network address cannot be used by the intrusion handling system.

81. The method of claim 80, with the requesting comprising requesting the network address from a network address allocation system.

82. The method of claim 65, with the processing system being further configured to determine whether the network address is being used by the intrusion handling system for trapping an intrusion occurrence before yielding the network address.

83. The method of claim 65, with the processing system being further configured to determine whether the network address is being used by the intrusion handling system for trapping an intrusion occurrence and to determine whether the address yield rule set indicates that the network address should be yielded.

84. The method of claim 65, with the network event comprising an address request message.

85. The method of claim 65, with the network event comprising an address signal.

86. A method of managing network address utilization in an intrusion handling system for a packet network, the method comprising:

requesting a network address of the one or more unused network addresses;

receiving a request response;

employing the network address in the intrusion handling system if the request response signals that the network address can be used by the intrusion handling system; and

not employing the network address in the intrusion handling system if the request response signals that the network address cannot be used by the intrusion handling system.

87. The method of claim 86, further comprising the intrusion handling system iteratively obtaining a plurality of available network addresses.

88. The method of claim 86, further comprising obtaining additional network addresses when available.

89. The method of claim 86, wherein the network address is periodically re-requested by the intrusion handling system.

90. The method of claim 86, wherein the requested network address is allocated to the intrusion handling system for a predetermined time period.

91. The method of claim 86, wherein the requested network address is allocated to the intrusion handling system for a predetermined time period by a network address allocation system.

92. The method of claim 86, further comprising attempting to detect a network address allocation system before the requesting.

93. The method of claim 86, further comprising:

listening to network traffic; and

removing used network addresses from a listing of all network addresses in order to form the listing of one or more unused network addresses.

94. The method of claim 86, further comprising:

obtaining a listing of all network addresses;

listening to network traffic; and

removing used network addresses included in the network traffic from a listing of all network addresses in order to form the listing of one or more unused network addresses.

95. The method of claim 86, further comprising querying the packet network for a particular network address and adding the particular network address to the listing of one or more unused network addresses if the particular network address is unused.

96. The method of claim 86, further comprising querying a network address allocation system for a particular network address and adding the particular network address to the listing of one or more unused network addresses if the particular network address is unused.

97. The method of claim 86, further comprising querying a network address allocation system for a particular network address and adding the particular network address to the listing of one or more unused network addresses if the network address allocation system does not respond to the query.

98. The method of claim 86, further comprising:

receiving or detecting a network event that is directed to a particular network address; and

dynamically yielding the particular network address from the intrusion handling system.

99. The method of claim 86, further comprising:

receiving or detecting a network event that is directed to a particular network address;

determining whether the particular network address is being used by the intrusion handling system for trapping an intrusion occurrence; and

dynamically yielding the particular network address from the intrusion handling system if the particular network address is not being used by the intrusion handling system for trapping an intrusion occurrence.

100. The method of claim 86, further comprising:

receiving or detecting a network event that is directed to a particular network address;

determining whether the particular network address is being used by the intrusion handling system for trapping an intrusion occurrence;

determining whether the address yield rule set indicates that the particular network address should be yielded; and

dynamically yielding the particular network address from the intrusion handling system if the particular network address is not being used by the intrusion handling system for trapping an intrusion occurrence and if the address yield set indicates that the particular network address should be yielded.