Method and system for limiting the range of data transmissions
A system and method of detecting an unauthorized access, phish attempt, or ransomware attempt based on limiting network transmission of data packets within an authorized device range. The method includes establishing a router hop limit value to predetermine an authorized device range for data packets to be exchanged between communicating pair devices and limiting transmission of data packets to within the predetermined authorized device range by discarding data packets after reaching the predetermined authorized device range as a function of the established hop limit value, to exclude devices beyond the predetermined authorized device range. Analyzer, Explorer, Setter, Modifier and Monitor Modules interoperate to suppress spurious communications from remote intruders.
1. A method of detecting an unauthorized access, phish attempt, or ransomware attempt based on limiting network transmission of data packets within an authorized device range, the method comprising:
establishing a router hop limit value to predetermine an authorized device range for data packets to be exchanged between communicating pair devices;
limiting transmission of data packets to within the predetermined authorized device range by discarding data packets after reaching the predetermined authorized device range as a function of the established hop limit value, to exclude devices beyond the predetermined authorized device range;
sending an Internet Control Message Protocol (ICMP) message from a discarding router with a discarded packet Internet Protocol (IP) header and 64 bits of protocol layer data, the message IP header data including a unique IP Socket Fragment ID used to identify a particular packet sent by an originator, source and destination IP addresses (IPv4 & IPv6); and wherein the 64 bits of protocol layer data identify an application protocol on which the attempt was made.
2. The method of claim 1 , further comprising using the unique IP Socket Fragment ID, the source and destination IP addresses and a protocol UDP/TCP (Transmission Control Protocol/User Datagram Protocol) port number to notify a Security Operations Center (SOC) of at least one of an unauthorized attempt, phish attempt, and a ransomware attempt.
3. The method of claim 2 , wherein notification of at least one of an unauthorized attempt, phish attempt, and a ransomware attempt trigger automated actions to quarantine the unauthorized access, phish attempt or ransomware attempt.
4. The method of claim 1 , further comprising notifying a Security Operations Center (SOC) of a Man-in-the-middle scenario upon detection of incongruent hop counts for a given unique communications pair UDP/TCP socket and IP Socket Fragment IDs in a respective IP header.
5. The method of claim 1 , wherein internal (Request For Comment 1918) RFC 1918 private IP addresses are geo-located using a GeoIP of a nearest Internet router to a private subnet.
6. The method of claim 5 , further comprising locating the private subnet IP Addresses, using the nearest Internet IP Address.
7. The method of claim 5 , further comprising notifying a Security Operations Center (SOC) of a Man-in-the-middle scenario upon detection of at least one of a man-in-the-middle Virtual Private Network device by detection of disproportionate round trip latency from the GeoIP or RFC1918GeoIP.
8. The method of claim 1 , further comprising setting a gateway of hop-protected devices to a system to enable forced collection of sessions and to execute hop changes to establish the predetermined authorized device range within a Cloud environment.
9. The method of claim 1 , executed by at least one of an Analyzer Module, Collector Module, Alarm Module, Explorer Module, Setter Module resident within at least one of a Router, Switch, Firewall, Network Component, Security Device and End Computing Device.
10. The method of claim 1 , further comprising determining which devices communicated with a suspect IP Address and alerting such devices of a potential threat.