Security alerting system with dynamic buffer size adaptation

• US 9,935,770 B1
• Filed: 06/20/2013
• Issued: 04/03/2018
• Est. Priority Date: 06/29/2012
• Status: Active Grant

• Current Assignee: EMC Corporation (Dell Technologies Inc.)
• Original Assignee: EMC Corporation (Dell Technologies Inc.)
• Inventors: Juels, Ari, Triandopoulos, Nikolaos, Bowers, Kevin D.
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): Bell, Kalish
• Application Number:
  US13/922,718
• Time in Patent Office: 1,748 Days
• Field of Search: 713168, 713150-152, 713160, 713161, 713176, 726 4, 726 22, 726 23, 726 25, 726 26
• CPC Class Codes: G06F 11/30 Monitoring
• CPC Class Codes: G06F 11/3003 Monitoring arrangements specially adapted to the computing system or computing system component being monitored
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 1/00 Arrangements for detecting or preventing errors in the information received correcting synchronisation H04L7/00
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees

Abstract

A Security Alerting System is provided with dynamic buffer size adaptation. An alert message from a Security Alerting System indicating a potential compromise of a protected resource is transmitted by obtaining the alert message from the Security Alerting System; authenticating the alert message using a secret key known by a server, wherein the secret key evolves in a forward-secure manner; storing the authenticated alert message in a buffer, wherein a size of the buffer is based on a connection history of the Security Alerting System; and transmitting the buffer to the server. The alert message can optionally be encrypted. The buffer can be increased in proportion to a duration of a disruption of a connection. The size of the buffer can be increased by adding buffer slots at a location of a current write pointer index. Techniques are also disclosed for detecting truncation attacks and alert message gaps. The alert messages can have a variable size by writing alert message into consecutive buffer slots.

Claims

1. A method performed by a host for transmitting an alert message from a Security Alerting System indicating a potential compromise of a protected resource to a server, comprising:

obtaining, by at least one processing device of said host, said alert message from said Security Alerting System;

authenticating, by at least one processing device of said host, said alert message using a secret key known by said server, wherein said secret key evolves in a forward-secure manner;

storing, by at least one processing device of said host, said authenticated alert message in a buffer that is local to said host, wherein a size of said buffer is based on a connection history of said Security Alerting System, wherein said connection history comprises a time duration since a last connection with said server, wherein said size of said buffer is increased based on a number of time intervals that have passed since a last alert message transmission and an increment size of the buffer per time interval;

storing a current write pointer index value and a forward secure counter indicating a number of buffer adaptations in said buffer; and

transmitting, by at least one processing device of said host, said authenticated alert message from said buffer over a communication channel to said server.

2. The method of claim 1, wherein said authenticating step further comprises the step of encrypting said alert message.

3. The method of claim 1, wherein said size of said buffer is increased in proportion to a time duration of a disruption of said connection.

4. The method of claim 1, wherein said size of said buffer is increased to a size R S(l 1), where R is an initial size of said buffer, l denotes said number of time intervals that have passed since said last alert message transmission and S denotes said increment of the buffer size per time interval.

5. The method of claim 1, wherein said size of said buffer is increased by adding buffer slots at a location of a current write pointer index.

6. The method of claim 1, further comprising the step of evaluating sequence numbers of a plurality of said alert messages to detect a gap in said alert messages.

7. The method of claim 1, further comprising the step of detecting a truncation attack based on generating different cryptographic keys for protection of inserted messages into said buffers and transmitted contents of said buffers, wherein said cryptographic keys for protection of inserted messages into said buffers are generated in a forward-secure manner in a same order that said messages are inserted in the buffer and wherein said cryptographic keys for protection of transmitted contents of said buffers are generated in a forward-secure manner in a same order that said contents of said buffers are transmitted over a network, wherein each cryptographic key is identified as being one of a “

message”

protection key and a “

buffer”

protection key.

8. The method of claim 1, further comprising the step of detecting a truncation attack based on an alert message m* written in the buffer when a said size of said buffer is adjusted.

9. The method of claim 1, wherein said alert message has a variable size by writing said alert message into a plurality of consecutive slots of said buffer.

10. The method of claim 1, further comprising the step of reducing said size of said buffer when said connection is re-established.

11. The method of claim 10, wherein said reduction is delayed until a predefined number of said buffers have been transmitted on said re-established connection.

12. A non-transitory machine-readable recordable storage medium for transmitting by a host an alert message from a Security Alerting System indicating a potential compromise of a protected resource to a server, wherein said non-transitory machine-readable recordable storage medium stores one or more software programs, wherein the one or more software programs when executed by one or more processing devices implement steps comprising:

obtaining, by at least one processing device of said host, said alert message from said Security Alerting System;

authenticating, by at least one processing device of said host, said alert message using a secret key known by said server, wherein said secret key evolves in a forward-secure manner;

storing, by at least one processing device of said host, said authenticated alert message in a buffer that is local to said host, wherein a size of said buffer is based on a connection history of said Security Alerting System, wherein said connection history comprises a time duration since a last connection with said server, wherein said size of said buffer is increased based on a number of time intervals that have passed since a last alert message transmission and an increment size of the buffer per time interval;

storing a current write pointer index value and a forward secure counter indicating a number of buffer adaptations in said buffer; and

transmitting, by at least one processing device of said host, said authenticated alert message from said buffer over a communication channel to said server.

13. An apparatus of a host for transmitting an alert message from a Security Alerting System indicating a potential compromise of a protected resource to a server, the apparatus comprising:

a memory; and

at least one processing device, coupled to the memory, operative to implement the following steps;

obtaining, by said at least one processing device of said host, said alert message from said Security Alerting System;

authenticating, by at least one processing device of said host, said alert message using a secret key known by said server, wherein said secret key evolves in a forward-secure manner;

storing, by at least one processing device of said host, said authenticated alert message in a buffer that is local to said host, wherein a size of said buffer is based on a connection history of said Security Alerting System, wherein said connection history comprises a time duration since a last connection with said server, wherein said size of said buffer is increased based on a number of time intervals that have passed since a last alert message transmission and an increment size of the buffer per time interval, wherein said at least one processing device is further configured to store a current write pointer index value and a forward secure counter indicating a number of buffer adaptations in said buffer; and

transmitting, by at least one processing device of said host, said authenticated alert message from said buffer over a communication channel to said server.

14. The apparatus of claim 13, wherein said authentication of said alert message further comprises an encryption of said alert message.

15. The apparatus of claim 13, wherein said size of said buffer is increased in proportion to a time duration of a disruption of said connection.

16. The apparatus of claim 13, wherein said size of said buffer is increased to a size R S(l 1), where R is an initial size of said buffer, l denotes said number of time intervals that have passed since said last alert message transmission and S denotes said increment of the buffer size per time interval.

17. The apparatus of claim 13, wherein said size of said buffer is increased by adding buffer slots at a location of a current write pointer index.

18. The apparatus of claim 13, wherein said at least one processing device is further configured to evaluate sequence numbers of a plurality of said alert messages to detect a gap in said alert messages.

19. The apparatus of claim 13, wherein said at least one processing device is further configured to detect a truncation attack based on generating different cryptographic keys for protection of inserted messages into said buffers and transmitted contents of said buffers, wherein said cryptographic keys for protection of inserted messages into said buffers are generated in a forward-secure manner in a same order that said messages are inserted in the buffer and wherein said cryptographic keys for protection of transmitted contents of said buffers are generated in a forward-secure manner in a same order that said contents of said buffers are transmitted over a network, wherein each cryptographic key is identified as being one of a “

message”

protection key and a “

buffer”

protection key.

20. The apparatus of claim 13, wherein said at least one processing device is further configured to detect a truncation attack based on an alert message m* written in the buffer when said size of said buffer is adjusted.

21. The apparatus of claim 13, wherein said alert message has a variable size by writing said alert message into a plurality of consecutive slots of said buffer.

22. The apparatus of claim 13, further comprising the step of reducing said size of said buffer when said connection is re-established.

23. The apparatus of claim 22, wherein said reduction is delayed until a predefined number of said buffers have been transmitted on said re-established connection.