Control of Out-of-Band Multipath Connections

• US 20160142373A1
• Filed: 11/14/2014
• Published: 05/19/2016
• Est. Priority Date: 11/14/2014
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Ossipov, Andrew E.
• Granted Patent: US 9,930,013 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/163 In-band adaptation of TCP data exchange; In-band control procedures

Abstract

An intermediate device (such as a firewall) is disposed between first and second devices (such as a client and a server device, respectively). Communications between the first and second devices are intercepted in both directions by the intermediate device, which spoofs the receiving device by modifying messages sent by the transmitting device. The modified message uses a key held by the intermediate device instead of a key belonging to the sending device.

Claims

1. A method comprising:

at an intermediate device disposed in a network between a first device and a second device,

receiving a first communication from the first device;

modifying the first communication by substituting a first alternate key in place of a key of the first device; and

forwarding the modified first communication to the second device.

2. The method of claim 1, further comprising:

receiving a second communication from the second device;

modifying the second communication by substituting data based on a second alternate key in place of corresponding data in the second communication; and

forwarding the modified second communication to the first device.

3. The method of claim 2, wherein the first communication is a Transmission Control Protocol synchronization (TCP SYN) message, and the second communication is a TCP SYN acknowledgment (TCP SYN ACK) message, the method further comprising:

receiving a third communication from the first device, the third communication comprising a Transmission Control Protocol acknowledgment (TCP ACK);

modifying the third communication by substituting the first alternate key in place of the key of the first device, and by substituting the key of the second device in place of the second alternate key; and

forwarding the modified third communication to the second device.

4. The method of claim 2, wherein the modifying of the first communication comprises substituting a token based on the first alternate key in place of a token based on the key of the first device.

5. The method of claim 4, wherein modifying the second communication comprises:

computing a substitute hash value based on the key of the first device, the second alternate key, and random numbers derived from the first communication and second communication; and

substituting the substitute hash value in place of a hash value in the second communication.

6. The method of claim 4, further comprising:

receiving a third communication from the second device;

computing an additional substitute hash value, based on the key of the second device, the first alternate key, and additional random numbers derived from the first communication and second communication; and

modifying the third communication by substituting the additional substitute hash value in place of a hash value in the third communication.

7. The method of claim 6, wherein:

the first communication is a Transmission Control Protocol synchronization (TCP SYN) message,

the second communication is a TCP SYN acknowledgment (TCP SYN ACK) message, and

the third communication is a TCP acknowledgement (TCP ACK) message.

8. The method of claim 1, further comprising:

comparing a token associated with the first device with stored hash values that are based on a previously stored keys of the first device; and

if the comparing results in a mismatch, processing further communications in accordance with a security policy.

9. An apparatus comprising:

a plurality of network ports that receive communications from a network and send communications to a network; and

a network processor unit coupled to the network ports;

a processor coupled to the network processor unit, the processor;

receives a first communication from a first device;

modifies the first communication by substituting a first alternate key in place of a key of the first device; and

forwards the modified first communication to a second device.

10. The apparatus of claim 9, wherein the processor further:

receives a second communication from the second device;

modifies the second communication by substituting data based on a second alternate key in place of corresponding data in the second communication; and

forwards the modified the second communication to the first device.

11. The apparatus of claim 10, wherein the first communication comprises a Transmission Control Protocol synchronization (TCP SYN) message, and the second communication comprises a TCP SYN acknowledgment (TCP SYN ACK) message, and wherein the processor further:

receives a third communication from the first device, the third communication comprising a Transmission Control Protocol acknowledgment (TCP ACK);

modifies the third communication by substituting the first alternate key in place of the key of the first device, and by substituting the key of the second device in place of the second alternate key; and

forwards the modified third communication to the second device.

12. The apparatus of claim 10, wherein the processor modifies the first communication by substituting a token based on the first alternate key in place of a token based on the key of the first device.

13. The apparatus of claim 12, wherein the processor modifies the second communication by:

computing a substitute hash value based on the key of the first device, the second alternate key, and random numbers derived from the first communication and second communication; and

substituting the substitute hash value in place of a hash value in the second communication.

14. The apparatus of claim 12, wherein the processor further :

receives a third communication from the second device;

computes an additional substitute hash value, based on the key of the second device, the first alternate key, and additional random numbers derived from the first communication and second communication; and

modifies the third communication by substituting the additional substitute hash value in place of a hash value in the third communication.

15. The apparatus of claim 14, wherein:

the first communication is a Transmission Control Protocol synchronization (TCP SYN) message,

the second communication is a TCP SYN acknowledgment (TCP SYN ACK) message, and

the third communication is a TCP acknowledgement (TCP ACK) message.

16. The apparatus of claim 9, wherein the processor further:

compares a token associated with the first device with stored hash values that are based on a previously stored keys of the first device; and

when the comparing results in a mismatch, processes further communications in accordance with a security policy.

17. One or more computer readable non-transitory storage media encoded with computer-readable instructions that, when executed by a processor, cause the processor to:

receive a first communication from a first device;

modify the first communication by substituting a first alternate key in place of a key of the first device; and

forward the modified first communication to a second device.

18. The computer readable storage media of claim 17, wherein the instructions further cause the processor to:

receive a second communication from the second device;

modify the second communication by substituting data based on a second alternate key in place of corresponding data in the second communication; and

forward the modified the second communication to the first device.

19. The computer readable storage media of claim 18, wherein the first communication comprises a Transmission Control Protocol synchronization (TCP SYN) message, and the second communication comprises a TCP SYN acknowledgment (TCP SYN ACK) message, wherein the instructions further cause the processor to:

receive a third communication from the first device, the third communication comprising a Transmission Control Protocol acknowledgment (TCP ACK);

modify the third communication by substituting the first alternate key in place of the key of the first device, and by substituting the key of the second device in place of the second alternate key; and

forward the modified third communication to the second device.

20. The computer readable storage media of claim 18, wherein the instructions that cause the processor to modify the first communication cause the processor to substitute a token based on the first alternate key in place of a token based on the key of the first device.

21. The computer readable storage media of claim 20, wherein the instructions that cause the processor to modify the second communication cause the processor to:

compute a substitute hash value based on the key of the first device, the second alternate key, and random numbers derived from the first communication and second communication; and

substitute the substitute hash value in place of a hash value in the second communication.

22. The computer readable storage media of claim 20, wherein the instructions further cause the processor to:

receive a third communication from the second device;

compute an additional substitute hash value, based on the key of the second device, the first alternate key, and additional random numbers derived from the first communication and second communication; and

modify the third communication by substituting the additional substitute hash value in place of a hash value in the third communication.

23. The computer readable storage media of claim 22, wherein:

the first communication is a Transmission Control Protocol synchronization (TCP SYN) message,

the second communication is a TCP SYN acknowledgment (TCP SYN ACK) message, and

the third communication is a TCP acknowledgement (TCP ACK) message.

24. The computer readable storage media of claim 17, wherein the instructions further cause the processor to:

compare a token associated with the first device with stored hash values that are based on a previously stored keys of the first device; and

when results from the compare are a mismatch, process further communications in accordance with a security policy.