Electrical computers and digital processing systems: support – Digital data processing system initialization or configuration – Loading initialization program
Reexamination Certificate
1998-04-20
2002-05-14
Peeso, Thomas R. (Department: 2132)
Electrical computers and digital processing systems: support
Digital data processing system initialization or configuration
Loading initialization program
C713S002000, C713S002000
Reexamination Certificate
active
06389532
ABSTRACT:
FIELD OF THE INVENTION
The present invention relates generally to network communications. More specifically, the present invention is a method and apparatus for using digital signatures to filter packets in a network.
BACKGROUND OF THE INVENTION
Internet protocol (IP) Multicasting is a form of network communication in which a single message is sent to multiple destinations at once. A multicast group owner sets up a multicast group address. Senders and receivers may join the group by accessing the group address.
One problem with IP multicast is that it allows unauthorized senders to transmit to the multicast group, requiring the end host system to keep state and to process packets which are not authorized to be sent to the group. The packets are transmitted by the unauthorized sender and forwarded by routers to the end host. Routers are systems which can be used to forward packets between networks.
One solution to this problem is for the group owner to encrypt the session and require authorized members to obtain a group key in order to decrypt the data. However, this mechanism does not prevent denial of service attacks where unauthorized senders from a network on one side of a router or a firewall transmit numerous IP messages to an end host in a network on the other side of the router or firewall. The router or firewall passes the packets from the network where the sender is located to the network where the end host is located, without processing the packets. The end host receives and processes each packet to determine whether the sender may join the encrypted session. If the sender is not authorized to join the session, the end host denies service to that sender. A malicious user, in what is called a denial of service attack, may send numerous unauthorized messages to an end host system on the other side of a router or a firewall. Even though the malicious user is not authorized to access the system, it can cause a network bottleneck because the end host at the other side of the router or firewall must process all of the incoming messages to determine whether the sender may join the encrypted session, thereby using up network bandwidth and resources.
SUMMARY OF THE INVENTION
Consistent with the present invention, a method and apparatus for using digital signatures filters packets in a network in order to avoid wasting router bandwidth and resources on processing packets associated with unauthorized senders.
An embodiment consistent with the present invention includes a method and apparatus for filtering packets, performed by a data processing system, which comprises the steps of receiving a packet including a header; detecting the existence of a signature in the header, and forwarding the packet in accordance with the validity of the signature. The data processing system that performs these steps may be, for example, a router or a firewall. An embodiment consistent with the present invention may be implemented as a computer program product or as a computer data signal embodied in a carrier wave. An embodiment consistent with the present invention also includes a method and apparatus for sending packets, performed by a data processing system, which comprises the steps of storing a private key in a memory of the data processor, generating a signature using the private key, installing the signature into a header of a packet, and sending the packet. An embodiment consistent with the present invention may be implemented as a computer program product or as a computer data signal embodied in a carrier wave.
An owner disseminates private keys to the senders. When there are numerous keys, the keys may be stored in indexed tables. A sender signs the packet using the one of the private keys. A router or a firewall then determines the validity of the signature by checking the signature using the public key. If the signature is valid, the router or firewall forwards the packet. Packets having an invalid signature are discarded.
The method for signing the packet may include creating a fingerprint corresponding to the data and encrypting the fingerprint using a private key to yield a signature. The method for checking the signature may include decrypting the fingerprint using a public key and comparing the decrypted fingerprint to a newly created fingerprint of the data.
An embodiment consistent with the present invention also includes a method for filtering packets, performed by a data processing system, which comprises the steps of receiving a plurality of packets, each of which includes a header, determining a number of packets received from a particular source, detecting the existence of a signature in the header, and forwarding the packet in accordance with the validity of the signature and with whether a router limit has been exceeded. The router limit may be associated with a number of packets per predetermined set of senders in order to limit the size of the group of authorized senders. The router limit also may be associated with a predetermined period of time to limit the rate at which senders transmit packets to the router.
Advantages of the invention will be set forth, in part, in the description that follows and in part, will be understood by those skilled in the art from the description or may be learned by practice of the invention. The advantages of the invention will be realized and attained by means of the elements and combinations particularly pointed out in the appended claims and equivalents.
REFERENCES:
patent: 5175765 (1992-12-01), Perlman
patent: 5268962 (1993-12-01), Abadi et al.
patent: 5455865 (1995-10-01), Perlman
patent: 5511122 (1996-04-01), Atkinson
patent: 5850449 (1998-12-01), McManis
patent: 0464563 (1992-01-01), None
patent: WO9613113 (1996-05-01), None
patent: WO9700471 (1997-01-01), None
Microsoft Press Computer Dictionary, Microsoft Press, 1997, pp. 64 and 318.*
Comer, Internetworking with TCP/IP, 1995, pp. 130 and 479.*
D. Katz, RFC 2113 entitled “IP Router Alert Option”, published Feb. 1997.
Douglas E. Comer, Chapter 17, entitled “Multicast Addressing (IGMP)” in Book entitled “Internetworking with TCP/IP vol. 1 Principles, Protocols, and Architecture” 2ndEdition, published by Prentice Hall, 1991, pp. 281-290.
Bruce Schneier, Chapter 18, entitled “One-Way Hash Functions” in Book entitledApplied Cryptography, 2ndEdition, published by John Wiley & Sons, Inc., 1996, pp. 436-441.
Bruce Schneier, Chapter 19, entitled “Public-Key Algorithms”, in Book entitledApplied Cryptography2ndEdition, published by John Wiley & Sons, Inc., 1996, pp. 466-474.
U.S. application No. 08/885,817, Gupta et al., filed Jun. 30, 1997.
Smith, B. R. et al, “Securing The Border Gateway Routing Protocol”, Communications: The Key To Global Prosperity, Globecom, 1996, Global Internet '96 Conference Record, London, Nov. 18-22, 1996, vol. Supp. Nov. 18, 1996, Institute of Electrical and Electronics Engineers, pp. 81-85.
Gupta Amit
Perlman Radia J.
Peeso Thomas R.
Squire Sanders & Dempsey L.L.P.
Sun Microsystems Inc.
LandOfFree
Method and apparatus for using digital signatures to filter... does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Method and apparatus for using digital signatures to filter..., we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Method and apparatus for using digital signatures to filter... will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-2842478