System to enable detecting attacks within encrypted traffic
View Patent ↗Systems and methods for identification of network attacks are disclosed. An example system includes an adaptor module to route a received encrypted packet to a decryption module, receive a decrypted packet corresponding to the encrypted packet from the decryption module, and transmit the decrypted packet and the encrypted packet to a sensor module. The decryption module is to receive an encrypted packet, decrypt the encrypted packet to form the decrypted packet, and transmit the decrypted packet to the adaptor module. The sensor module is to inspect the decrypted packet and the encrypted packet received from the adaptor module to determine when an attack is detected.
1. A system to identify network attacks within packets received by a network, the system comprising:
an adaptor to route an encrypted packet to a decryption circuit, receive a decrypted packet corresponding to the encrypted packet from the decryption circuit, and transmit the decrypted packet and the encrypted packet to a sensor;
the decryption circuit to receive the encrypted packet, decrypt the encrypted packet to form the decrypted packet, and transmit the decrypted packet to the adaptor; and
the sensor to inspect the decrypted packet received from the adaptor to determine whether an attack is detected, to inspect the encrypted packet received from the adaptor to determine whether the attack is detected, and to block transmission of the encrypted packet to a destination identified in the encrypted packet when the attack is detected in at least one of the decrypted packet and the encrypted packet, wherein the adaptor is to detect an alert from the sensor, the alert indicating an attack detected within the decrypted packet, the adaptor to transmit a reset message to a sender of the encrypted packet when the attack is detected within the decrypted packet.
2. The system of claim 1 , wherein the sensor is further to generate an alert when an attack is detected.
3. The system of claim 1 , wherein the decryption circuit and the adaptor are in-line in the network.
4. The system of claim 3 , wherein the decryption circuit is to encrypt the decrypted packet to form a second encrypted packet, and the adaptor is to insert the second encrypted packet into a network traffic flow.
5. An intrusion detection system for detecting network attacks within encrypted network traffic, the system comprising:
a physical network interface card (NIC) to receive network traffic;
a virtual NIC to receive network traffic from the physical NIC, route encrypted network traffic from the physical NIC to a decryption circuit, receive decrypted network traffic from the decryption circuit, route the decrypted network traffic and the encrypted network traffic to the sensor, transmit a reset message in response to the encrypted network traffic when a potential attack is identified in at least one of the encrypted network traffic and the decrypted network traffic, and block the encrypted network traffic when the potential attack is identified;
the decryption circuit to receive the encrypted network traffic from the virtual NIC, decrypt the encrypted network traffic to form the decrypted network traffic, and transmit the decrypted network traffic to the virtual NIC; and
the sensor to receive the decrypted network traffic and the encrypted network traffic from the virtual NIC, to analyze the decrypted network traffic and the encrypted network traffic to identify the potential attack.
6. The system of claim 5 , wherein the decryption circuit is to wrap the decrypted network traffic with a Transmission Control Protocol/Internet Protocol (TCP/IP) envelope and route it to the virtual NIC.
7. The system of claim 5 , wherein the adaptor is to label the decrypted network traffic as preprocessed network traffic before it is sent to the sensor.
8. The system of claim 5 , wherein the physical NIC, the decryption circuit, and the virtual NIC are in-line in the network.
9. The system of claim 8 , wherein the decryption circuit is to encrypt the decrypted packet to form a second encrypted packet and to insert the second encrypted packet into a network traffic flow.
10. A method for identifying network attacks, the method comprising:
routing an encrypted packet from a network to a security circuit,
decrypting the encrypted packet at the security circuit to form a decrypted packet,
receiving the decrypted packet from the security circuit;
maintaining a mapping of the encrypted packet and the decrypted packet;
routing the encrypted packet from the network to a sensor,
routing the decrypted packet received from the security circuit to the sensor;
monitoring the sensor to identify whether the sensor attempts to block at least one of the decrypted packet and the encrypted packet, the attempt to block the at least one of the decrypted packet and the encrypted packet indicating an attack; and
transmitting a reset message when the sensor attempts to block the at least one of the decrypted packet and the encrypted packet.
11. The method of claim 10 , further comprising emulating a network interface card (NIC).
12. A tangible machine-readable storage disk or storage device comprising instructions which, when executed, cause a machine to at least:
decrypt an encrypted packet to form a decrypted packet;
record a mapping of the encrypted packet and the decrypted packet;
route the encrypted packet to a sensor;
route the decrypted packet to the sensor;
monitor the sensor to identify whether the sensor attempts to block at least one of the decrypted packet and the encrypted packet, the attempt to block the at least one of the decrypted packet and the encrypted packet indicating an attack; and
transmit a reset message if the sensor attempts to block the at least one of the decrypted packet or the encrypted packet.
13. The machine-readable storage disk or storage device of claim 12 , further comprising instructions which cause the machine to emulate a network interface card (NIC).
14. The system of claim 1 , wherein the adaptor is to transmit a reset message in response to the received encrypted packet when the attack is detected by the sensor.
15. The system of claim 2 , wherein the alert is a reset message.
16. The system of claim 1 , wherein the decryption circuit comprises a programmed processor.