Browse Prior Art Database

Hop Integrity in Computer Networks

IP.com Disclosure Number: IPCOM000015245D
Original Publication Date: 2001-Oct-22
Included in the Prior Art Database: 2003-Jun-20
Document File: 4 page(s) / 117K

Publishing Venue

IBM

Abstract

In a typical network, an adversary can insert new messages, modify current messages, or replay old messages. In many cases, the inserted, modified, or replayed messages can go undetected for some time until they cause severe damage. More importantly, the physical location in the network where the adversary attacks may never be determined. Two well-known examples of such attacks in networks that support the Internet Protocol (or IP, for short) and the Transmission Control Protocol (or TCP, for short) are as follows.

This text was extracted from a PDF file.
At least one non-text object (such as an image or picture) has been suppressed.
This is the abbreviated version, containing approximately 31% of the total text.

Page 1 of 4

Hop Integrity in Computer Networks

 In a typical network, an adversary can insert new messages, modify current messages, or replay old messages. In many cases, the inserted, modified, or replayed messages can go undetected for some time until they cause severe damage. More importantly, the physical location in the network where the adversary attacks may never be determined. Two well-known examples of such attacks in networks that support the Internet Protocol (or IP, for short) and the Transmission Control Protocol (or TCP, for short) are as follows.

 i. Smurf Attack: In an IP network, any computer can send a "ping" message to any other computer, which replies by sending back a "pong" message to the first computer as required by Internet Control Message Protocol (or ICMP, for short) [5]. The ultimate destination in the pong message is the same as the original source in the ping message. An adversary can utilize these messages to attack a computer in such a network as follows. First, the adversary inserts into the network a ping message whose original source is computer d and whose ultimate destination is a multicast address for every computer in the network. Second, a copy of the inserted ping message is sent to every computer in the network. Third, every computer in the network replies to its ping message by sending a pong message to computer d. Thus, computer d is flooded by pong messages that it did not request.
ii. SYN Attack:

 To establish a TCP connection between two computers c and d, computer c sends a "SYN" message to computer d. When the latter receives the SYN message, it reserves some of its resources for the expected connection and sends back a "SYN-ACK" message to c. When c receives the SYN-ACK message, it replies by sending back an "ACK" message to d. If d receives the ACK message, the connection is fully established and the two computers can start exchanging their data messages over the established connection. On the other hand, if d does not receive the ACK message for a specified time period of T seconds after it has sent the SYN-ACK message, d discards the partially established connection and releases all the resources reserved for that connection. The net effect of this scenario is that computer d has lost some of its resources for T seconds. An adversary can take advantage of such a scenario to attack computer d as follows [1]. First, the adversary inserts into the network successive waves of SYN messages whose original sources are different (so that these messages cannot be easily detected and filtered out from the network) and whose ultimate destination is d. Second, d receives the SYN messages, reserves its resources for the expected connections, replies by sending SYN-ACK messages, then waits for the corresponding ACK messages which will never arrive. Third, the net effect of each wave of inserted SYN messages is that computer d loses all its resources for T seconds.

 In these (and other [4]) types of attacks,...