SECURITY LEVEL AND STATUS EXCHANGE BETWEEN TCP/UDP CLIENT(S) AND SERVER(S) FOR SECURE TRANSACTIONS

• US 20170134399A1
• Filed: 01/24/2017
• Published: 05/11/2017
• Est. Priority Date: 01/09/2014
• Status: Active Grant

• Current Assignee: Kyndryl Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Kamble, Keshav G., Pandey, Vijoy A., Pandya, Vaishali V.
• Granted Patent: US 10,027,687 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]

Abstract

According to one embodiment, a method includes informing a second peer about a security issue in one or more secure transmission control protocol/user datagram protocol (TCP/UDP) using a first peer of the one or more TCP/UDP sessions. The method also includes performing at least one action at the first peer in response to detecting the security issue. The at least one action resolves the security issue, avoids the security issue, or resolves and avoids the security issue. Also, the at least one action includes informing, via a socket call or an extension of a socket call on the one or more TCP/UDP sessions, one or more applications operating on the second peer to limit information exchange based on a severity of the security issue. Other systems, methods, and computer program products are described in accordance with more embodiments.

Claims

1. A system, comprising:

a processor; and

logic integrated with the processor, executable by the processor, or integrated with and executable by the processor, the logic being configured to cause the processor to;

inform a second peer about a security issue in one or more secure transmission control protocol/user datagram protocol (TCP/UDP) sessions using a first peer of the one or more TCP/UDP sessions; and

perform at least one action at the first peer in response to detecting the security issue, the at least one action resolving the security issue, avoiding the security issue, or resolving and avoiding the security issue,

wherein the at least one action comprises informing, via a socket call or an extension of a socket call on the one or more TCP/UDP sessions, one or more applications operating on the second peer to limit information exchange based on a severity of the security issue.

2. The system as recited in claim 1, wherein the logic is further configured to cause the processor to:

identify the security issue affecting the first peer in the one or more TCP/UDP sessions; and

send a packet from the first peer to the second peer to inform the second peer about the security issue in the one or more TCP/UDP sessions, the packet comprising an indication of the security issue in a TCP header of the packet,

wherein the TCP header further comprises one or more type-length-value (TLV) elements indicating the severity of the security issue.

3. The system as recited in claim 1, wherein the logic configured to inform the second peer about the security issue using the first peer is further configured to cause the processor to send a packet from the first peer to the second peer, the packet comprising an indication of the security issue in a TCP header of the packet.

4. The system as recited in claim 3, wherein the logic is further configured to cause the processor to:

receive a second packet at the first peer indicating that the security issue has been acknowledged by the second peer, the second packet comprising a second TCP header having a security acknowledgement flag set therein to indicate that the security issue has been acknowledged by the second peer, wherein the security acknowledgement flag is stored within a reserve field of the second TCP header.

5. The system as recited in claim 3, wherein the TCP header comprises:

a source port;

a destination port; and

a security flag set to indicate the security issue at the first peer stored within a reserve field of the TCP header.

6. The system as recited in claim 3, wherein the TCP header comprises one or more type-length-value (TLV) elements indicating the severity of the security issue.

7. The system as recited in claim 6, wherein the one or more TLV elements are stored within an options field of the TCP header.

8. The system as recited in claim 1, wherein the logic is further configured to cause the processor to inform the first peer that the security issue has been acknowledged by the second peer.

9. The system as recited in claim 1, wherein the at least one action is further selected from a group consisting of:

resetting and closing any TCP/UDP sockets affected by the security issue, re-authenticating and resetting the one or more TCP/UDP sessions affected by the security issue, waiting for a predetermined amount of time for the security issue to be resolved, and adjusting a type of information exchanged across the one or more TCP/UDP sessions.

10. A method, comprising:

informing a second peer about a security issue in one or more secure transmission control protocol/user datagram protocol (TCP/UDP) sessions using a first peer of the one or more TCP/UDP sessions; and

performing at least one action at the first peer in response to detecting the security issue, the at least one action resolving the security issue, avoiding the security issue, or resolving and avoiding the security issue,

wherein the at least one action comprises informing, via a socket call or an extension of a socket call on the one or more TCP/UDP sessions, one or more applications operating on the second peer to limit information exchange based on a severity of the security issue.

11. The method as recited in claim 10, further comprising:

identifying the security issue affecting the first peer in the one or more TCP/UDP sessions; and

sending a packet from the first peer to the second peer to inform the second peer about the security issue in the one or more TCP/UDP sessions, the packet comprising an indication of the security issue in a TCP header of the packet,

wherein the TCP header further comprises one or more type-length-value (TLV) elements indicating the severity of the security issue.

12. The method as recited in claim 10, wherein the informing the second peer about the security issue using the first peer comprises sending a packet from the first peer to the second peer, the packet comprising an indication of the security issue in a TCP header of the packet.

13. The method as recited in claim 12, further comprising receiving a second packet at the first peer indicating that the security issue has been acknowledged by the second peer, the second packet comprising a second TCP header having a security acknowledgement flag set therein to indicate that the security issue has been acknowledged by the second peer, wherein the security acknowledgement flag is stored within a reserve field of the second TCP header.

14. The method as recited in claim 12, wherein the packet further comprises a TCP header, the TCP header comprising:

a source port;

a destination port; and

a security flag set to indicate the security issue at the first peer stored within a reserve field of the TCP header.

15. The method as recited in claim 12, wherein the TCP header comprises one or more type-length-value (TLV) elements indicating the severity of the security issue, the one or more TLV elements being stored within an options field of the TCP header.

16. The method as recited in claim 10, wherein the at least one action is further selected from a group consisting of:

resetting and closing any TCP/UDP sockets affected by the security issue, re-authenticating and resetting the one or more TCP/UDP sessions affected by the security issue, waiting for a predetermined amount of time for the security issue to be resolved, and adjusting a type of information exchanged across the one or more TCP/UDP sessions.

17. A computer program product, comprising a computer readable storage device having program code embodied therewith, the embodied program code being executable by a processor to cause the processor to:

inform, by the processor, a second peer about a security issue in one or more secure transmission control protocol/user datagram protocol (TCP/UDP) sessions using a first peer of the one or more TCP/UDP sessions; and

perform, by the processor, at least one action at the first peer in response to detecting the security issue, the at least one action resolving the security issue, avoiding the security issue, or resolving and avoiding the security issue, wherein the at least one action comprises informing, via a socket call or an extension of a socket call on the one or more TCP/UDP sessions, one or more applications operating on the second peer to limit information exchange based on a severity of the security issue.

18. The computer program product as recited in claim 17, wherein the embodied program code further causes the processor to:

identify, by the processor, the security issue affecting the first peer in the one or more TCP/UDP sessions; and

send, by the processor, a packet from the first peer to the second peer to inform the second peer about the security issue in the one or more TCP/UDP sessions, the packet comprising an indication of the security issue in a TCP header of the packet,

wherein the TCP header further comprises one or more type-length-value (TLV) elements indicating the severity of the security issue.

19. The computer program product as recited in claim 17, wherein the embodied program code that causes the processor to inform the second peer about the security issue using the first peer further causes the processor to send, by the processor, a packet from the first peer to the second peer, the packet comprising an indication of the security issue in a TCP header of the packet, and wherein the embodied program code further causes the processor to:

receive a second packet at the first peer indicating that the security issue has been acknowledged by the second peer, the second packet comprising a second TCP header having a security acknowledgement flag set therein to indicate that the security issue has been acknowledged by the second peer, wherein the security acknowledgement flag is stored within a reserve field of the second TCP header.

20. The computer program product as recited in claim 19, wherein the TCP header comprises:

a source port;

a destination port; and

a security flag set to indicate the security issue at the first peer stored within a reserve field of the TCP header.