Granted Patent B2

US 10,320,839 · App. 15/708,504 · Granted Jun 11, 2019

Inventors: Ville Mattila (Helsinki, FI); Tomi Salminen (Helsinki, FI); Tuomo Syvänne (Helsinki, FI)

Assignee: Forcepoint, LLC

H04L63/1466H04L47/20H04L61/2007H04L63/0227H04L63/1425

Abstract

Claims (58)

1. A computer-implementable method for performing an automated anti-spoofing configuration operation, comprising:

determining whether a source address of an internet protocol (IP) packet is allowed by a receiving interface of a firewall;

determining whether the IP packet comprises a multicast packet when the IP packet is allowed by the receiving interface of the firewall;

replacing the source address with a rendezvous point address;

using the rendezvous point address to determine whether routing path information associated with the multicast packet matches information stored within a multicast routing information base for the receiving interface of the firewall; and,

identifying the multicast packet as spoofed when the routing path information associated with the multicast packet does not have corresponding information stored within the multicast routing information base;

comparing the rendezvous point address of the multicast packet with a rendezvous point address for any active multicast joins to determine whether the rendezvous point address of the multicast packet has an associated active multi cast join; and,

identifying the multicast packet as spoofed when the rendezvous point address does not have an associated active multicast join.

2. The method of claim 1 , wherein:

the receiving interface of the firewall comprises a network interface.

3. The method of claim 1 , wherein:

the active multicast join comprises a recipient network address associated with a rendezvous address designated as a destination of a group of multicast packets associated with a particular multicast session.

4. The method of claim 1 , further comprising:

determining whether logging of the multicast packet is required; and,

logging information relating to the multicast packet when logging of the multicast packet is required.

5. The method of claim 1 , further comprising:

determining whether the multicast packet is received by a Protocol independent Multicast (PIM) enabled interface of a firewall when the IP packet comprises the multicast packet.

6. A system comprising:

a processor;

a data bus coupled to the processor; and

a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:

determining whether a source address of an internet protocol (IP) packet is allowed by a receiving interface of a firewall;

determining whether the IP packet comprises a multicast packet when the IP packet is allowed by the receiving interface of the firewall;

replacing the source address with a rendezvous point address;

using the rendezvous point address to determine whether routing path information associated with the multicast packet matches information stored within a multicast routing information base for the receiving interface of the firewall; and,

identifying the multicast packet as spoofed when the routing path information associated with the multicast packet does not have corresponding information stored within the multicast routing information base;

comparing the rendezvous point address of the multicast packet with a rendezvous point address for any active multicast joins to determine whether the rendezvous point address of the multicast packet has an associated active multicast join; and,

identifying the multicast packet as spoofed when the rendezvous point address does not have an associated active multicast join.

7. The system of claim 6 , wherein:

the receiving interface of the firewall comprises a network interface.

8. The system of claim 6 , wherein:

the active multicast join comprises a recipient network address associated with a rendezvous address designated as a destination of a group of multicast packets associated with a particular multicast session.

9. The system of claim 6 , wherein the instructions executable by the processor are further configured for:

determining whether logging of the multicast packet is required; and,

logging information relating to the multicast packet when logging of the multicast packet is required.

10. The system of claim 6 , wherein the instructions executable by the processor are further configured for:

determining whether the multicast packet is received by a Protocol independent Multicast (PIM) enabled interface of a firewall when the IP packet comprises the multicast packet.

11. A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:

determining whether a source address of an internet protocol (IP) packet is allowed by a receiving interface of a firewall;

determining whether the IP packet comprises a multicast packet when the IP packet is allowed by the receiving interface of the firewall;

replacing the source address with a rendezvous point address;

using the rendezvous point address to determine whether routing path information associated with the multicast packet matches information stored within a multicast routing information base for the receiving interface of the firewall; and,

identifying the multicast packet as spoofed when the routing path information associated with the multicast packet does not have corresponding information stored within the multicast routing information base;

comparing the rendezvous point address of the multicast packet with a rendezvous point address for any active multicast joins to determine whether the rendezvous point address of the multicast packet has an associated active multicast join; and,

identifying the multicast packet as spoofed when the rendezvous point address does not have an associated active multicast join.

12. The non-transitory, computer-readable storage medium of claim 11 , wherein:

the receiving interface of the firewall comprises a network interface.

13. The non-transitory, computer-readable storage medium of claim 11 , wherein:

the active multicast join comprises a recipient network address associated with a rendezvous address designated as a destination of a group of multicast packets associated with a particular multicast session.

14. The non-transitory, computer-readable storage medium of claim 11 , wherein the computer executable instructions are further configured for:

determining whether logging of the multicast packet is required; and,

logging information relating to the multicast packet when logging of the multicast packet is required.

15. The non-transitory, computer-readable storage medium of claim 11 , wherein the computer executable instructions are further configured for:

determining whether the multicast packet is received by a Protocol Independent Multicast (PIM) enabled interface of a firewall when the IP packet comprises the multicast packet.

16. The non-transitory, computer-readable storage medium of claim 11 , wherein:

the computer executable instructions are deployable to a client system from a server system at a remote location.

17. The non-transitory, computer-readable storage medium of claim 11 , wherein:

the computer executable instructions are provided by a service provider to a user on an on-demand basis.

Assignments (12)

Continuity (1)