Fight-through nodes for survivable computer network

Patent metadata

Field	Value
Publication number	US-9838415-B2
Application number	US-201615295778-A
Country	US
Kind code	B2
Filing date	Oct 17, 2016
Priority date	Sep 14, 2011
Publication date	Dec 5, 2017
Grant date	Dec 5, 2017

Abstract

A network node includes enhanced functionality to fight through cyber-attacks. A plurality of virtual machines run at the network node. The network node receives a plurality of transaction requests and distributes a copy of each of the transaction requests to the plurality of virtual machines over a plurality of time steps. Based on the first virtual machine having executed (n) transaction requests in the plurality of transaction requests, the node detects whether any of the virtual machines has been compromised. In response to detecting the plurality of virtual machines includes a compromised virtual machine, the network node isolates the compromised virtual machine. Furthermore, after isolating the compromised virtual machine, the network node may receive a subsequent transaction request and dispatch the subsequent transaction request to the compromised virtual machine. The compromised virtual machine may execute the subsequent transaction request.

First claim

The invention claimed is:

1. A method comprising:
running a plurality of virtual machines that includes (n) virtual machines, each respective virtual machine of the plurality of virtual machines associated with a respective position in an ordered sequence of the virtual machines, wherein a first virtual machine of the plurality of virtual machines is associated with a position in the ordered sequence of virtual machines occurring first;
receiving, by a node, a plurality of transaction requests that consists of (n) transaction requests;
for each respective transaction request of the plurality of transaction requests:
dispatching the respective transaction request and each transaction request, if any, of the plurality of transaction requests previous to the respective transaction request to respective virtual machines of the ordered sequence of virtual machines; and
executing, by the respective virtual machines of the ordered sequence of virtual machines, the respective transaction request and each transaction request, if any, of the plurality of transaction requests previous to the respective transaction request, wherein a service provided by the node is usable as part of the respective virtual machines of the ordered sequence of virtual machines executing the respective transaction request and each transaction request, if any, of the plurality of transaction requests previous to the respective transaction request;

based on the first virtual machine having executed (n) transaction requests in the plurality of transaction requests, detecting whether any of the virtual machines has been compromised;
in response to detecting the plurality of virtual machines includes a compromised virtual machine, isolating the compromised virtual machine such that the compromised virtual machine is unable to subsequently use the service; and
after isolating the compromised virtual machine:
receiving a subsequent transaction request;
dispatching the subsequent transaction request to the compromised virtual machine; and
executing, by the compromised virtual machine, the subsequent transaction request.

2. The method of claim 1 , further comprising, in response to detecting the plurality of virtual machines includes the compromised virtual machine:
copying a state of a non-compromised virtual machine of the plurality of virtual machines, the non-compromised virtual machine having executed each transaction of the plurality of transactions up to, but not including, a last transaction of the plurality of transactions executed by the compromised virtual machine; and
comparing the state of the non-compromised virtual machine to a state of the compromised virtual machine.

3. The method of claim 2 , further comprising:
based on the comparison of the state of the non-compromised virtual machine and the state of the compromised virtual machine, updating a catalog of attack types.

4. The method of claim 1 , wherein the compromised virtual machine is associated with the c'th position in the ordered sequence of virtual machines, the method further comprising:
in response to detecting the plurality of virtual machines includes the compromised virtual machine, associating an additional virtual machine with the c'th position in the ordered sequence of virtual machines in place of the compromised virtual machine.

5. The method of claim 1 , wherein detecting whether any of the virtual machines has been compromised comprises:
determining, based on a comparison of a plurality of responses, whether any of the virtual machines has been compromised, each response of the plurality of responses being generated by different virtual machines of the ordered sequence of virtual machines in response to the same transaction request of the plurality of transaction requests.

6. The method of claim 1 , further comprising:
executing, by a non-compromised virtual machine in the ordered sequence of virtual machines, the subsequent transaction request; and
comparing a response to the subsequent transaction request generated by the compromised virtual machine with a response to the subsequent transaction request generated by the non-compromised virtual machine.

7. The method of claim 1 , further comprising:
modifying a response to the subsequent transaction request generated by the compromised virtual machine to include data or code to install or facilitate installation of malware on a device attacking the node; and
sending the modified response to the device attacking the node.

8. A network node comprising:
a network interface configured to receive a plurality of transaction requests that consists of (n) transaction requests; and
a set of one or more processing circuits configured to:
execute a plurality of virtual machines, the plurality of virtual machines including (n) virtual machines, wherein a first virtual machine of the plurality of virtual machines is associated with a position in the ordered sequence of virtual machines occurring first;
for each respective transaction request of the plurality of transaction requests:
dispatch the respective transaction request and each transaction request, if any, of the plurality of transaction requests previous to the respective transaction request to respective virtual machines of the ordered sequence of virtual machines; and
the respective virtual machines of the ordered sequence of virtual machines execute the respective transaction request and each transaction request, if any, of the plurality of transaction requests previous to the respective transaction request, wherein a service provided by the node is usable as part of the respective virtual machines of the ordered sequence of virtual machines executing the respective transaction request and each transaction request, if any, of the plurality of transaction requests previous to the respective transaction request;

based on the first virtual machine having executed (n) transaction requests in the plurality of transaction requests, detect whether any of the virtual machines has been compromised;
in response to detecting the plurality of virtual machines includes a compromised virtual machine, isolate the compromised virtual machine such that the compromised virtual machine is unable to subsequently use the service; and
after isolating the compromised virtual machine:
receive a subsequent transaction request;
dispatch the subsequent transaction request to the compromised virtual machine; and
execute, by the compromised virtual machine, the subsequent transaction request.

9. The network node of claim 8 , wherein the one or more processing circuits are further configured such that, in response to detecting the plurality of virtual machines includes the compromised virtual machine, the one or more processing circuits:
copy a state of a non-compromised virtual machine of the plurality of virtual machines, the non-compromised virtual machine having executed each transaction of the plurality of transactions up to, but not including, a last transaction of the plurality of transactions executed by the compromised virtual machine; and
compare the state of the non-compromised virtual machine to a state of the compromised virtual machine.

10. The network node of claim 9 , wherein the one or more processing circuits are configured to update, based on the comparison of the state of the non-compromised virtual machine and the state of the compromised virtual machine, a catalog of attack types.

11. The network node of claim 9 , wherein the compromised virtual machine is associated with the c'th position in the ordered sequence of virtual machines, the one or more processing circuits are further configured to:
in response to

Assignees

• Architecture Tech Corp

Inventors

• Powers Judson
• Brueckner Stephen K
• Thurber Kenneth J

Classifications

• H04L63/02

  for separating internal from external traffic, e.g. firewalls · CPC title

• G06F21/552

  involving long-term monitoring or reporting · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title