Network anti-tampering system
A system and method detects or prevents tampering of computer networks by transmitting address messages indicating that unused network addresses are in use. The systems and method handles requests for network resources, such as Address Resolution Protocol (ARP) messages, and provides fabricated information to a potential attacker to disrupt an attack on an information system.
1. A system to detect and prevent network tampering comprising:
an anti-tampering system,
a network interface connecting the anti-tampering system to a network, and
a software program running on the anti-tampering system, the software program containing instructions that, when executed by the anti-tampering system, cause the anti-tampering system to:
monitor communications on the network during normal network communication;
receive a plurality of Address Resolution Protocol (ARP) request messages from an information processing system connected to the network;
determine whether each of the plurality of ARP request messages are for an Internet Protocol (IP) address that is in use on the network:
identify ARP request messages directed to an IP address not in use on the network;
for ARP request messages directed to an IP address that is in use on the network, determine whether the information processing system sending the ARP request messages is authorized to access the IP address; and
transmit a plurality of ARP reply messages to the information processing system in response to ARP request messages identified as being directed to an IP address not in use on the system or to an IP address the information processing system is not authorized to access, wherein each reply messages comprises the IP address in the ARP request message being replied to and a Media Access Control (MAC) address that does not correspond to a network device using the IP address.
2. The system of claim 1 , wherein the information processing system is a general purpose computer.
3. The system of claim 1 , wherein the information processing system is a custom programmed FPGA.
4. The system of claim 1 , wherein the information processing system is a custom programmed ASIC.
5. The system of claim 1 , wherein the information processing system is a virtual machine running under the control of a hypervisor.
6. The system of claim 1 , wherein the information processing system is a virtual machine running under the control of a hypervisor and the software program is a network device driver.
7. The system of claim 1 , wherein the information processing system is a general purpose computer and the software program is a network device driver.
8. The system of claim 1 , wherein the MAC address is the MAC address of the anti-tampering system, a MAC address of a device on the network that is configured to receive unauthorized requests, or a MAC address that does not correspond to any physical device on the network.
9. The system of claim 1 , wherein the software program executed by the anti-tampering system is further configured to, in response to determining that the information processing system ARP request messages are directed to an IP address not in use on the network or an IP address the information processing system is not authorized to access:
removing the information processing system from the network;
disabling the information processing system's ability to communicate with selected other information processing systems on the network; or
sending a communication including the IP or MAC address of the information processing system to one or more third parties.
10. The system of claim 1 , wherein the software program executed by the anti-tampering system is further configured to flag the IP address of, MAC address of, or network activity of the information processing system as compromised.
11. A method to detect and prevent network tampering over a network connected to an anti-tampering system through a network interface comprising:
monitoring, with the anti-tampering system, communications on the network during normal network communication;
receiving, with the anti-tampering system, an Address Resolution Protocol (ARP) request message from an information processing system connected to the network;
determine whether the ARP request message is for an Internet Protocol (IP) address that is in use on the network or that is not in use on the network, and, if the message is directed to an IP address that is in use on the network, further determining whether the information processing system is authorized to access the IP address;
transmitting, with the anti-tampering system, an ARP reply message to the information processing system in response to determining that the ARP request message is directed to an IP address not in use on the system or to an IP address the information processing system is not authorized to access, wherein the reply comprises the IP address in the ARP message request being replied to and a Media Access Control (MAC) address that does not correspond to a network device using the IP address.
12. The method of claim 11 , wherein the information processing system is a general purpose computer.
13. The method of claim 11 , wherein the information processing system is a general purpose computer and the software program is a network device driver.
14. The method of claim 11 , wherein the MAC address is the MAC address of the anti-tampering system, a MAC address of a device on the network that is configured to receive unauthorized requests, or a MAC address that does not correspond to any physical device on the network.
15. The method of claim 11 , further comprising, in response to determining that the information processing system ARP request message is directed to an IP address not in use on the network or an IP address the information processing system is not authorized to access:
removing the information processing system from the network;
disabling the information processing system's ability to communicate with selected other information processing systems on the network; or
sending a communication including the IP or MAC address of the information processing system to one or more third parties.
16. The method of claim 11 , wherein the method further comprises flagging, with the anti-tampering system, the IP address of, MAC address of, or network activity of the information processing system as compromised.