Distributed online wireless security test system

Patent metadata

Field	Value
Publication number	US-10362048-B2
Application number	US-201615153695-A
Country	US
Kind code	B2
Filing date	May 12, 2016
Priority date	May 12, 2016
Publication date	Jul 23, 2019
Grant date	Jul 23, 2019

Abstract

Systems and methods are disclosed herein to provide improved online security testing of security devices and networks, including but not limited to networks containing wireless access points. In accordance with one or more embodiments and aspects thereof, a distributed online test system is disclosed that combines an online test manager with one or more remote probes to generate simulated attacks and verify their effectiveness. Such a system may offer improved capabilities such as the ability to conduct attacks over geographically distributed network topologies, the ability to assess the security functions of wireless networks, and simpler and more cost-effective online security testing.

First claim

What is claimed is:

1. A distributed security tester for a System Under Test (SUT), comprising:
a probe including at least one processor;
an attack generator and checker co-located with said probe and implemented by the at least one processor and operative to generate simulated attack traffic for injection into said SUT to simulate a security attack on said SUT, and further to process simulated attack traffic that has passed through said SUT; and
an online test manager device located remotely from the probe and including an attack terminator operative to receive said simulated attack traffic that has passed through said SUT from said SUT and operative to return, via a tunnel, said simulated attack traffic that has passed through said SUT from said attack terminator to said probe and said attack generator and checker, wherein said attack generator and checker is configured to operate in a separate physical location from said attack terminator, and wherein said online test manager instructs the probe to generate and inject said simulated attack traffic into said SUT via an access point local to said probe, wherein said simulated attack traffic is addressed to known target addresses within a network in which said online test manager device operates, the target addresses including an address of the online test manager device, wherein said simulated attack traffic passes through said access point, and at least some of said simulated attack traffic passes through a security device in a first office location of said SUT, from the first office location of said SUT to a second office location of said SUT via a virtual private network (VPN) link, and to said attack terminator, wherein said attack terminator returns said at least some simulated attack traffic from said second office location of said SUT to said first office location of said SUT via said tunnel over said VPN link, and to said remote probe and said attack generator and checker.

2. The distributed security tester of claim 1 , further including a data encapsulation function operatively coupled to said attack terminator and operative to encapsulate said simulated attack traffic that has passed through said SUT in tunnel packets for return to said attack generator and checker via said tunnel.

3. The distributed security tester of claim 1 , wherein said probe includes a wireless interface operatively coupled to said attack generator and checker and operative to inject said simulated attack traffic into said SUT via said access point, which comprises a wireless access point.

4. The distributed security tester of claim 1 , wherein said probe includes a local attack database operatively coupled to said attack generator and checker for storing data usable to generate said simulated attack traffic.

5. The distributed security tester of claim 1 comprising a remote reflector operative to accept said simulated attack traffic and inject it into said SUT.

6. The distributed security tester of claim 5 wherein said remote reflector is configured to simulate an Internet-originating attack on said SUT.

7. The distributed security tester of claim 1 wherein said attack generator and checker injects said simulated attack traffic into said SUT.

8. The distributed security tester of claim 7 comprising a remote reflector, wherein said attack generator and checker simulates exfiltration of data by attempting to transmit simulated exfiltration traffic from within a protected network to said remote reflector and wherein said remote reflector is configured to transmit simulated exfiltration traffic that exits said protected network to said attack generator and checker.

9. The distributed security tester of claim 1 wherein said online test manager device configures said attack generator and checker to generate said simulated attack traffic.

10. A method of distributed security testing of a system under test (SUT), the method comprising:
configuring an online test manager device located remotely from a probe which includes an attack generator and checker implemented on at least one processor of the probe to generate simulated attack traffic for injection into said SUT;
configuring a remote attack terminator to receive simulated attack traffic that has passed through said SUT and to return said received traffic over a tunnel to said probe and said attack generator and checker;
triggering said attack generator and checker to generate said simulated attack traffic for injection into said SUT; and
wherein said simulated attack traffic represents a security attack test on said SUT, and wherein said online test manager instructs the probe to generate and inject said simulated attack traffic into said SUT via an access point local to said probe, wherein said simulated attack traffic is addressed to known target addresses within a network in which the online test manager operates, the target addresses including an address of the online test manager device, wherein said simulated attack traffic passes through said access point, and at least some of said simulated attack traffic passes through a security device in a first office location of said SUT, from the first office location of said SUT to a second office location of said SUT via a virtual private network (VPN) link, and to said attack terminator, wherein said attack terminator returns said at least some simulated attack traffic from said second office location of said SUT to said first office location of said SUT via said tunnel over said VPN link, and to said remote probe and said attack generator and checker.

11. The method of claim 10 comprising encapsulating said received traffic prior to returning it over said tunnel.

12. The method of claim 10 comprising downloading a plurality of security attack tests into a local database prior to said configuration of said attack generator and checker to generate said simulated attack traffic.

13. The method of claim 10 comprising providing a remote reflector operative to accept said simulated attack traffic and inject it into said SUT.

14. The method of claim 13 wherein said remote reflector is configured to simulate an Internet-originating attack on said SUT.

15. The method of claim 10 wherein said attack generator and checker injects said simulated attack traffic into said SUT.

16. The method of claim 15 comprising providing a remote reflector, wherein said attack generator and checker simulates exfiltration of data by attempting to transmit simulated exfiltration traffic from within a protected network to said remote reflector and wherein said remote reflector is configured to transmit simulated exfiltration traffic that exits said protected network to said attack generator and checker.

17. The method of claim 10 wherein said online test manager device configures said attack generator and checker to generate said simulated attack traffic.

18. A non-transitory computer readable medium having stored thereon executable instructions that, when executed by the processor of a computer, controls said computer to perform steps including:
configuring online test manager device located remotely from a probe which includes an attack generator and checker implemented on at least one processor of the probe to generate simulated attack traffic for injection into a system under test (SUT);
configuring a remote attack terminator to receive simulated attack traffic that has passed through said SUT, and to return said received traffic over a tunnel to said probe and said attack generator and checker;
triggering said attack generator and checker to generat

Assignees

• Ixia
• Keysight Tech Singapore Sales Pte Ltd

Inventors

• Alexander Thomas
• Stott Lester Noel
• Sundhar Kalyan R

Classifications

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title