WO2006136692A1

WO2006136692A1 - Method and system for protecting an information system formed around a local network

Info

Publication number: WO2006136692A1
Application number: PCT/FR2006/001389
Authority: WO
Inventors: Benoît DOLEZ; Willy Tarreau
Original assignee: Exosec
Priority date: 2005-06-21
Filing date: 2006-06-20
Publication date: 2006-12-28
Also published as: FR2887384B1; FR2887384A1

Abstract

The invention relates to a method for protecting an information system comprising a plurality of workstations and servers communicating via a local network (LAN). The inventive method consists in delivering a static routing to each workstation in such a way that any station-to-station communication is at least partially locked, in identifying a critical flux transmitted by said workstations, in particular the flux between the workstations and servers, wherein said critical fluxes are transmissible without processing, and in controlling other fluxes through filtering means.

Description

"Method and system for protecting an information system constituted around a local network"

The present invention relates to a method for protecting an information system constituted around a local network. It also aims a protection system implementing this method.

The field of the invention is that of the protection of information systems and local computer networks particularly exposed to various threats such as the spread of worms and viruses.

When a worm-infected workstation is connected to a company's local network, almost all other workstations become contaminated within seconds, and the costs associated with their resettlement and Downtime is very high. Firewall solutions for workstations aiming to protect against this scourge exist, but are very poorly adapted to corporate networks because of the diversity of flows to be taken into account, and the diversity of user needs that makes the task of the administrator very complicated especially when it comes to move on the workstations to adapt the configurations to the daily needs.

Centralized firewall ("firewall") solutions that implement the VLAN method and isolate each user station in a dedicated network to contain the risks, but the entire network of the local network of the company transit through this firewall which becomes a real bottleneck even on small networks of a few dozen posts and some servers.

New firewalls with multiple ports are emerging to achieve a compromise between filtering quality and performance, and allow the partitioning of user groups with little degradation in performance. performance while declining sacrificial areas on the network. As a result, the access to the servers remain efficient, but that the appearance of a worm in a zone can still make all the stations connected in the latter out of use. There are thus needs of internal security of the companies, in particular for the following reasons:

- the worms circulate directly from station to station on the local network whereas these workstations never need to be able to communicate directly except in very rare exceptions (ex: file sharing, printer sharing, ... );

- the user base is very difficult to maintain in a known and homogeneous state of software configuration, especially because of the high volume of weekly updates to be made, the increasing mobility of users, and the rapid obsolescence of the versions of software, the durability of which is far below the depreciation time of the equipment;

- Access to file servers and internal services, such as e-mail, must be as fast and reliable as possible, especially when the mass arrival of users in the morning.

The object of the present invention is to achieve simultaneously these three objectives by proposing a method for protecting an information system comprising a plurality of workstations and server equipment communicating via a local area network (LAN). According to the invention, this process comprises:

a provision of a static routing for each station, so as to effect a partial or total blocking of any peer-to-peer communication,

an identification, according to predetermined criteria, of flows originating from said workstations, in particular flows between workstations and server equipment, said flows thus identified being transmitted without processing, and

a control of the other flows through filtering means.

Static routing can be advantageously achieved by providing each workstation with a subnet mask and a routing table specifying for said workstation the equipment that is accessible to it.

The protection method according to the invention is preferably implemented within a DHCP server connected to the local network. When the method according to the invention is implemented in a local network based on the Internet Protocol (IP), the subnet mask supplied to each workstation is for example a 32-bit subnet mask (255.255 .255.255). An implementation of this protection method can also advantageously comprise, following an analysis of the information flows, a triggering of LAN protection actions and alerts, which can be initiated, for example, in response to detection of an exceeding of an anomaly threshold. According to another aspect of the invention, there is provided a system for protecting an information system comprising a plurality of workstations and server equipment communicating via a local area network (LAN), implementing the method according to the invention , characterized in that it comprises: means for at least partially blocking any peer-to-peer communication,

means for analyzing information flows within said local network, arranged to identify critical flows, in particular flows between workstations and server equipment, said critical flows can then be transmitted without processing, and

means for controlling all the other flows through filtering means.

This system according to the invention includes for example, as locking means, analysis means and control means, a DHCP server connected to the local network and arranged to provide each workstation a configuration based on a mask subnet and static routes by IP address.

It may further comprise, as filtering means, a "firewall" type equipment, preferably disengageable, arranged to perform at least a partial filtering workstations between them.

The method according to the invention thus implements the following concepts aimed at: • Take advantage of network distribution capabilities of workstations to force them to cross a centralized firewall for any communication requiring analysis, without modification of the network architecture; • exploit these configuration distribution capabilities to enable them to reach high-traffic services directly, without impacting performance;

• Filter only the residual traffic through the "firewall" equipment (very low or zero), so as not to impact the performance of the flows submitted to analysis, and providing a very rapid detection of anomalies with very low risk of false positives. The method according to the invention thus meets the following need:

• confine any potentially dangerous IP traffic by segmenting the network to its lowest granularity ie, the workstation,

• In the case of anomalies detected, partially or totally block the source station of suspicious traffic and alert the administrator.

The protection method according to the invention thus rests on the configuration of a more restrictive subnet IP mask than that applied to the local network on the network interfaces of the equipment attached to it, the optimum case being the subnet mask to 32 bits

(255.255.255.255) which limits the possibilities of connection of the latter to themselves. Then, using the routing table, it is possible to specify with the precision of the IP address, the different machines that will be accessible to it on the network, the default gateway thus representing the first control point for all the routed flows .

This type of network configuration is never used because it goes against the principle of letting the workstations communicate as they wish on the network. To configure this level of routing granularity on a computer using the MS Windows ^® operating system, either the configuration must be imposed by a DHCP server or the registry must be modified directly, which remains a delicate operation to be performed manually. A DHCP server can provide workstations with a 32-bit subnet mask (255.255.255.255) so that the machine can not communicate without control over the network and then distribute each of the desired routes with DHCP options adequate. For configurations with a static IP address, the possibilities will be the same but the configuration methods will be specific to each system (ex: MS Windows registry, Unix configuration files).

The protection method according to the invention can be implemented without any change of architecture.

The physical architecture of the network is not modified by the implementation of the protection method according to the invention, all the critical flows can be identified and can be transmitted without processing (and without protocol control), the other flows are controlled and potentially stopped by the "firewall" equipment.

Other advantages and features of the invention will appear on examining the detailed description of a non-limiting embodiment, and the attached drawings in which:

FIG. 1 illustrates a first example of implementation of the protection method according to the invention;

FIG. 2 illustrates a second example of implementation of the protection method according to the invention;

FIG. 3 illustrates a comparison of the possible communications as a function of the configured subnet mask; and FIG. 4 illustrates various protection configurations provided by the method according to the invention.

We will now describe, with reference to the above figures, the operating principle of the protection method according to the invention, as well as an example of implementation of a protection system according to the invention, in an information system. installed on two separate sites.

A protection system S according to the invention comprises a DHCP server 1 and a "firewall" type equipment 2 both connected to a local area network LAN of an information system SI comprising for example a plurality of workstations. Pl, ... PN and a file server 3. Direct communication between two workstations is inhibited and the corresponding Fl flows are controlled and filtered by the "firewall" 2.

On the other hand, the streams F of the stations P1,..., P _N towards the file server 3 are not filtered, as schematically illustrates FIG. 2.

The use of the subnet mask 255.255.255.255 allows a total control of all the workstations of the information system, giving them a reduced vision of the network, while the mask

On the contrary, 255.255.255.0 provides a complete view of the network, as shown schematically in FIG.

The protection method according to the invention allows different configurations of protection of an information system, as illustrated in FIG. 4. For example, an information system SI comprising a first LAN LAN connected to the Internet via a firewall 21 and comprising several local subnets connected via a switch 4, and a second local area network LAN '.

In a first subnet, a first protection server 11 has quarantined a workstation P1 that has been detected as infected and filters a second workstation P2 that communicates with servers S1, S2 via the switch 4.

In a second subnet, a second protection server 12 blocks any direct communication between two workstations P3, P4.

In the second local area network LAN 'of the information system SI connected to the Internet via a second firewall 22, a third protection server 13 blocks the flows between two workstations P5, P6 but allows to communicate the workstation P6 with an S3 file server.

The protection servers 11, 12, 13 are DHCP servers capable of providing a client configuration based on a 32-bit subnet mask (255.255.255.255) and local static routes by IP address.

Firewalls 21, 22 are firewall type (disengageable).

The protection servers 11, 12, 13 implement an analysis engine whose role is to trigger protection actions (against measures) and alerting when anomaly thresholds are exceeded: MAC filtering, IP filtering, service filtering, notification and host identification.

The boxes of the protection servers 11, 12, 13 are simply connected to the network with a static IP address. Then simply adapt the static routing configuration as needed:

- if a DHCP server was already present: deactivation of the old server, activation of the integrated DHCP server with the same parameters as the old one, identification of the main servers accessible directly, activation of the DHCP configuration accordingly; the DHCP machines will then be controlled by the integrated firewall for access to unidentified internal services,

- identification of indirect services and creation of filters accordingly on the integrated firewall, implementation of the notification system, implementation of the protection system.

Of course, the invention is not limited to the examples that have just been described and many adjustments can be made to these examples without departing from the scope of the invention. In particular, the protection system according to the invention can be deployed without difficulty in complex architecture information systems since it is sufficient to install as many protection servers as local subnets.

Claims

A method for protecting an information system comprising a plurality of workstations and server equipment communicating via a local area network (LAN), characterized in that it comprises: providing a static routing for each station, so as to block at least part of any peer-to-peer communication, an identification, according to predetermined criteria, of flows from said workstations, including flows between workstations and server equipment, said flows can be transmitted without treatments, and control of other flows through filtering means.

2. Method according to claim 1, characterized in that the static routing is achieved by providing each workstation with a subnet mask and a routing table specifying for said workstation the equipment that it are accessible.

3. Method according to claim 2, characterized in that it is implemented within a DHCP server connected to the local network.

4. Method according to claim 3, implemented in a local area network whose workstations communicate using the IP protocol, characterized in that the subnet mask provided to each workstation is a subnet mask 32. bits (255.255.255.255).

5. Method according to one of the preceding claims, characterized in that it further comprises, following an analysis of information flows, a trigger actions of protection of the local network and alert.

6. Method according to claim 5, characterized in that the protection and alert actions are initiated in response to a detection of an exceeding of at least one anomaly threshold.

7. Method according to one of claims 5 or 6, characterized in that it further comprises, as protection actions, a quarantine of a workstation by sending a blocking configuration via the subnet mask,

8. System for protecting an information system comprising a plurality of workstations and server equipment communicating via a local area network (LAN), implementing the method according to any one of the preceding claims, characterized in that includes:

means for blocking all or part of the peer-to-peer communications,

means for analyzing information flows within said local network, arranged to identify critical flows, in particular flows between workstations and server equipments, said critical flows can then be transmitted without processing, and

means for controlling all the other flows through filtering means.

9. Protection system according to claim 8, characterized in that it includes, as locking means, analysis means and control means, a DHCP server connected to the local network and arranged to provide each station a configuration based on a subnet mask and static routes by IP address.

10. Protection system according to one of claims 8 or 9, characterized in that it further comprises, under the filtering means, a type of equipment "firewall" (firewall), arranged to perform a filtering at least some of the workstations between them.

11. Protection system according to claim 10, characterized in that the fireproof equipment is of the type disengageable.