Method to authenticate packet payloads
An architecture for authenticating packets is provided that includes: an input 322 operable to receive a packet, the packet comprising at least one of a transport, session and presentation header portion and a transport agent 312 operable to compute a first message authentication code based on at least some of the contents of the packet and compare the first message authentication code with a second message authentication code in the at least one of a transport, session, and presentation header portion to authenticate the packet.
1. A method, comprising:
(a) receiving, by a destination node and from a source node, a packet comprising a header that includes a first message authentication code and source port and checksum fields, the header having been altered by a firewall;
(b) computing, by the destination node and over the packet, a second message authentication code; and
(c) applying the following rules:
(c1) when the first and second message authentication codes match, the packet is authenticated successfully; and
(c2) when the first and second message authentication codes do not match, the packet is not authenticated successfully;
wherein each of the first and second message authentication codes is computed by the source and destination nodes, respectively, based on values for the source port and checksum fields that are different from the values for the source port and checksum fields in the packet before and after alteration by the firewall.
2. The method of claim 1 , wherein the first message authentication code is contained in an Open Systems Interconnect transport layer portion of the header.
3. The method of claim 2 , wherein the first message authentication code is contained in an authentication option.
4. The method of claim 3 , wherein the authentication option comprises an option indicator having a value associated with the authentication option, a length having a value associated with the length of the first message authentication code, and the first message authentication code, and wherein the first message authentication code is truncated to a selected number of bits.
5. The method of claim 2 , wherein, in computing the first and second message authentication codes, the values for the source port, destination port, and checksum fields are independent of the corresponding values in the header.
6. The method of claim 1 , wherein the first and second message authentication codes are computed based on values for members of a set of fields, the values being the same as the values for the members of the set of fields contained in the header, both before and after firewall alteration, and wherein the set of fields comprise a plurality of an urgent pointer flag, PSH flag, finished flag, acknowledgment flag, synchronize flag, reset flag, sequence number, acknowledgment number, data offset, window, options, and padding.
7. The method of claim 3 , further comprising, after the receiving step:
(d) in a first mode, discarding the packet when the packet header does not include the authentication option; and
(e) in a second, different mode, discarding the packet when the packet header includes an authentication option, whether valid or invalid, wherein the computing and applying steps occur only in the first mode.
8. The method of claim 7 , further comprising:
(f) negotiating, by the source and destination nodes, protocol parameters over an insecure channel;
(g) receiving a start cipher and/or change cipher spec command;
(h) in response initiating receive authentication using a shared secret, wherein, in receive authentication, the first mode is performed; and
(i) thereafter resetting to a no authentication mode in which the second mode is performed.
9. A computer comprising, in memory, software, wherein, when the software is executed by the computer, the computer performs the steps of claim 1 .
10. A system, comprising:
(a) an input operable to receive, from a source node, a packet comprising a header that includes a first message authentication code and source port and checksum fields, the header having been altered by a firewall;
(b) a transport agent, at a destination node, operable to compute, for the packet, a second message authentication code and apply the following rules:
(b1) when the first and second message authentication codes match, the packet is authenticated successfully; and
(b2) when the first and second message authentication codes do not match, the packet is not authenticated successfully;
wherein each of the first and second message authentication codes is computed by the source and destination nodes, respectively, based on values for the source port and checksum fields that are different from the values for the source port and checksum fields in the packet before and after alteration by the firewall.
11. The system of claim 10 , wherein the first message authentication code is contained in an Open Systems Interconnect transport layer portion of the header.
12. The system of claim 10 , wherein the first message authentication code is contained in an authentication option.
13. The system of claim 12 , wherein the authentication option comprises an option indicator having a value associated with the authentication option, a length having a value associated with the length of the first message authentication code, and the first message authentication code, and wherein the first message authentication code is truncated to a selected number of bits.
14. The system of claim 10 , wherein, in computing the first and second message authentication codes, the values for the source port, destination port, and checksum fields are independent of the corresponding values in the header.
15. The system of claim 10 , wherein the first and second message authentication codes are computed based on values for members of a set of fields, the values being the same as the values for the members of the set of fields contained in the header, both before and after firewall alteration, and wherein the set of fields comprise a plurality of an urgent pointer flag, PSH flag, finished flag, acknowledgment flag, synchronize flag, reset flag, sequence number, acknowledgment number, data offset, window, options, and padding.
16. The system of claim 10 , wherein the transport agent:
in a first mode, discarding the packet when the packet header does not include the authentication option; and
in a second, different mode, discarding the packet when the packet header includes an authentication option, whether valid or invalid, wherein the computing and applying steps occur only in the first mode.
17. A method, comprising:
(a) generating, by a source node, a packet, the packet comprising a header that includes a first message authentication code and source port and checksum fields; and
(b) altering, by a firewall, the packet header;
wherein a destination node authenticates the packet by computing a second message authentication code; and
wherein each of the first and second message authentication codes is computed by the source and destination nodes, respectively, based on values for the source port and checksum fields that are different from the values for the source port and checksum fields in the packet before and after alteration by the firewall.
18. The method of claim 17 , wherein the first message authentication code is contained in an Open Systems Interconnect transport layer portion of the header.
19. The method of claim 17 , wherein the first message authentication code is contained in an authentication option.
20. The method of claim 19 , wherein the authentication option comprises an option indicator having a value associated with the authentication option, a length having a value associated with the length of the first message authentication code, and the first message authentication code, and wherein the first message authentication code is truncated to a selected number of bits.
21. The method of claim 17 , wherein, in computing the first and second message authentication codes, the values for the source port, destination port, and checksum fields are independent of the corresponding values in the header.
22. The method of claim 17 , wherein the first and second message authentication codes are computed based on values for members of a set of fields, the values being the same as the values for the members of the set of fields contained in the header, both before and after firewall alteration, and wherein the set of fields comprise a plurality of an urgent pointer flag, PSH flag, finished flag, acknowledgment flag, synchronize flag, reset flag, sequence number, acknowledgment number, data offset, window, options, and padding.
23. The method of claim 17 , further comprising, after the receiving step:
(c) in a first mode, generating the first message authentication code and locating the first message authentication code in an authentication option in a selected packet header; and
(d) in a second, different mode, not setting the authentication option in the selected packet header.
24. The method of claim 23 , further comprising:
(e) negotiating, by the source and destination nodes, protocol parameters over an insecure channel;
(f) initiating transmit authentication using a shared secret, wherein, in transmit authentication, the first mode is performed; and
(g) thereafter resetting to a no authentication mode in which the second mode is performed.
25. A computer comprising, in memory, software, wherein, when the computer executes the software, the computer performs the steps of claim 17 .
26. A method, comprising:
(a) receiving, by a destination node and from a source node, a packet comprising a header that includes first and second message authentication codes and source port and checksum fields, the header having been altered by a firewall;
(b) computing, by the destination node and over the packet, a third message authentication code; and
(c) applying the following rules:
(c1) when the first and third message authentication codes match, the packet is authenticated successfully; and
(c2) when the first and third message authentication codes do not match, the packet is not authenticated successfully;
wherein the first and third message authentication codes are computed by the source and destination nodes, respectively, and exclude values for the source port and checksum fields.
27. The method of claim 26 , wherein the first message authentication code is contained in an Open Systems Interconnect (“OSI”) transport layer portion of the header and the second message authentication code is contained in an authentication header used between OSI layers 3 and 4 .
28. The method of claim 26 , wherein the first message authentication code is contained in an authentication option.
29. The method of claim 28 , wherein the authentication option comprises an option indicator having a value associated with the authentication option, a length having a value associated with the length of the first message authentication code, and the first message authentication code, and wherein the first message authentication code is truncated to a selected number of bits.
30. The method of claim 26 , wherein, in computing the first and third message authentication codes, the value for the destination port is excluded.
31. The method of claim 26 , wherein the first and third message authentication codes are computed based on values for members of a set of fields, the values being the same as the values for the members of the set of fields contained in the header, both before and after firewall alteration, and wherein the set of fields comprise a plurality of an urgent pointer flag, PSH flag, finished flag, acknowledgment flag, synchronize flag, reset flag, sequence number, acknowledgment number, data offset, window, options, and padding.
32. The method of claim 26 , further comprising, after the receiving step:
(d) in a first mode, discarding the packet when the packet header does not include the authentication option; and
(e) in a second, different mode, discarding the packet when the packet header includes an authentication option, whether valid or invalid, wherein the computing and applying steps occur only in the first mode.
33. The method of claim 32 , further comprising:
(f) negotiating, by the source and destination nodes, protocol parameters over an insecure channel;
(g) receiving a start cipher and/or change cipher spec command;
(h) in response initiating receive authentication using a shared secret, wherein, in receive authentication, the first mode is performed; and
(i) thereafter resetting to a no authentication mode in which the second mode is performed.
34. A computer comprising software, wherein, when the computer executes the software, the computer performs the steps of claim 26 .
35. A system, comprising:
(a) an input to receive, from a source node, a packet comprising a header that includes first and second message authentication codes and source port and checksum fields, the header having been altered by a firewall;
(b) a transport agent, at a destination node, operable to compute, for the packet, a third message authentication code and apply the following rules:
(b1) when the first and third message authentication codes match, the packet is authenticated successfully; and
(b2) when the first and third message authentication codes do not match, the packet is not authenticated successfully;
wherein the first and third message authentication codes are computed by the source and destination nodes, respectively, and exclude values for the source port and checksum fields.
36. The system of claim 35 , wherein the first message authentication code is contained in an Open Systems Interconnect (“OSI”) transport layer portion of the header and the second message authentication code is contained in an authentication header used between OSI layers 3 and 4 .
37. The system of claim 35 , wherein the first message authentication code is contained in an authentication option.
38. The system of claim 37 , wherein the authentication option comprises an option indicator having a value associated with the authentication option, a length having a value associated with the length of the first message authentication code, and the first message authentication code, and wherein the first message authentication code is truncated to a selected number of bits.
39. The system of claim 35 , wherein, in computing the first and third message authentication codes, the value for the destination port is excluded.
40. The system of claim 35 , wherein the first and third message authentication codes are computed based on values for members of a set of fields, the values being the same as the values for the members of the set of fields contained in the header, both before and after firewall alteration, and wherein the set of fields comprise a plurality of an urgent pointer flag, PSH flag, finished flag, acknowledgment flag, synchronize flag, reset flag, sequence number, acknowledgment number, data offset, window, options, and padding.
41. The system of claim 35 , further comprising, after the receiving step:
(c) in a first mode, discarding the packet when the packet header does not include the authentication option; and
(d) in a second, different mode, discarding the packet when the packet header includes an authentication option, whether valid or invalid, wherein the computing and applying steps occur only in the first mode.
42. The system of claim 41 , further comprising:
(e) negotiating, by the source and destination nodes, protocol parameters over an insecure channel;
(f) receiving a start cipher and/or change cipher spec command;
(g) in response initiating receive authentication using a shared secret, wherein, in receive authentication, the first mode is performed; and
(h) thereafter resetting to a no authentication mode in which the second mode is performed.