Method for detecting performance, security and privacy problems of network attached storage device

Abstract

The invention discloses a method for detecting performance, security and privacy problems of network attached storage equipment, and a system comprises a traffic collection module which collects corresponding traffic by executing file operation and collects a large amount of redundant traffic possibly generated by the equipment; the performance problem detection module is used for determining whether various performance optimization methods are deployed in NAS (Network Attached Storage) equipment or not to reduce the network traffic consumption by comparing the traffic with corresponding files based on the traffic captured by the traffic collection module; the security and privacy problem detection module is used for detecting the security and privacy problems of the NAS equipment, starting passive traffic monitoring and replay attacks to test whether the NAS equipment can defend the two common network attacks, analyzing the network traffic and sending the network traffic to the NAS equipment; the method and the device are used for detecting whether the privacy leakage problem exists in the interactive flow of a mobile client and a network attached storage (NAS) device or not, and the privacy violation risk is reduced.

Description

Technical Field

[0001] The present invention belongs to the field of information security, and in particular relates to a system and method for detecting performance, security and privacy issues of network attached storage (NAS) devices. Background Art

[0002] In recent years, many enterprises and individual users have chosen network-attached storage (NAS) devices to store files instead of personal cloud storage services. The main reason is that NAS devices are cheaper with the same storage space, and can prevent personal files from being accessed by third parties, reducing privacy leaks. However, attackers may target NAS devices to gain unauthorized access to sensitive information, modify system configurations, or launch denial of service attacks and ransomware attacks. Therefore, it is necessary to detect the performance, security, and privacy issues of NAS systems. According to the EU General Data Protection Regulation (GDPR) and China's Personal Information Protection Law (PIPL), network-attached storage (NAS) device manufacturers must take appropriate technical measures (such as communication encryption and access control) to ensure the security of users' personal data and prevent privacy leaks. However, measuring NAS devices is challenging: Challenge 1: The threat model of network-attached storage (NAS) devices is complex, making it difficult to prevent cyber attacks and protect user privacy. The threat model of NAS includes three entities (i.e., the NAS device itself, the user client, and the manufacturer's remote server), and any two of them can communicate with each other.

[0003] Challenge 2: Since NAS devices store a large number of personal files, the security and privacy issues of NAS must be addressed while maintaining good performance. Simply analyzing the performance of NAS is not enough.

[0004] Challenge 3: Network-attached storage (NAS) devices do not provide command-line tools or API interfaces for users to capture network traffic and obtain their internal working status, which makes it very difficult to detect various problems. NAS devices have different operating systems, and they are all closed source. They can only be regarded as black boxes, and their internal functions can be inferred based on input (uploaded and downloaded files) and output (network data packets). Summary of the invention

[0005] In order to better understand the performance, security and privacy issues of NAS devices, this detection method is proposed: A detection method for performance, security and privacy issues of network attached storage (NAS) devices. This method manually defines the threat model of NAS: NAS devices and corresponding clients are connected to the same home router, and users use the client to upload / download files to the NAS device. Both the client and the NAS device may communicate with the remote server, and the attacker may invade the home router to launch an attack. Based on this model, the performance optimization methods that may be implemented in NAS devices and the measurement system under the background model based on network attached storage (NAS) devices, mobile application clients and remote servers are summarized, which specifically includes the following modules: Traffic collection module: Through the mobile application client, perform file operations (i.e., upload and download files) and collect the corresponding traffic, and monitor the heartbeat traffic to determine the additional overhead caused by the NAS device and the mobile client.

[0006] Performance detection module. Determines whether performance optimization methods are deployed in the NAS device by comparing the collected network traffic with the uploaded / downloaded files.

[0007] Security and privacy detection module. The security system of NAS devices is tested by analyzing the URLs and file contents contained in the network traffic, performing passive traffic monitoring attacks and active replay attacks. The method also performs data flow analysis to detect whether there is any privacy information leakage in the network traffic generated by mobile clients and NAS devices.

[0008] Preferably, the performance optimization method includes file compression, duplicate file detection, file segmentation and breakpoint resume.

[0009] Preferably, a method for detecting performance, security and privacy issues of NAS devices implemented by the system comprises the following steps: Step 1, traffic collection phase, connects the mobile application client to the network attached storage NAS device, performs file upload and download operations, and collects the corresponding traffic for further analysis; Step 2, performance problem detection phase, based on the traffic captured by the traffic collection module, the method determines whether the network attached storage NAS device has deployed a performance optimization method by comparing the traffic with the original files uploaded / downloaded; In step 3, the security and privacy issue detection phase, passive traffic monitoring and replay attacks are performed to test whether the network-attached storage NAS device can defend against these two common network attacks, and data flow analysis is performed to detect whether the traffic generated by mobile clients and network-attached storage NAS devices contains privacy leakage issues.

[0010] Preferably, the step one comprises: 1) Manually create files of different sizes and then upload them to a network-attached storage (NAS) device through a mobile client. For each file size, the method prepares two different versions: one version is a compressible file containing only identical characters, and the other version is an incompressible file containing random bytes. 2) Collect traffic. When using a mobile client to upload or download files, use tcpdump to capture the generated traffic. Since some mobile clients use HTTPS to encrypt traffic, in order to analyze these encrypted traffic, this method uses mitmproxy to initiate MITM on the mobile client to obtain the plaintext content of the encrypted message; 3) Perform heartbeat packet detection without performing any operations during the detection to avoid generating irrelevant traffic, and use tcpdump to capture the traffic generated by the mobile client and the network attached storage NAS device during the detection.

[0011] Preferably, the step 2 includes the following three aspects of detection, respectively determining whether the network attached storage NAS device includes one of: 1) File compression detection: For compressible files, this method collects the total traffic size generated by file upload or download, and compares the file size of the transmitted compressible file with the total size of the data packet containing the file content. If the total size of the data packet is less than half of the size of the transmitted file, it is considered that the network attached storage NAS device implements the file compression function to save bandwidth; 2) Duplicate file detection: First, upload an incompressible file to the network attached storage NAS device, then rename the file and upload the renamed file again. When uploading the incompressible file for the first time, calculate the sum of the sizes of the data packets sent by the mobile client, Size1. When uploading the renamed file, calculate the sum of the sizes of the data packets sent by the mobile client, Size2. Finally, compare Size1 and Size2. If it is found that Size2 is much smaller than Size1, it is considered that the network attached storage NAS device has a duplicate file detection function. 3) File Chunking: In order to determine whether the network attached storage NAS device implements the file chunking function, the plain text of the request message sent when uploading the file is extracted. Then, keywords and fields related to chunking are searched in these request messages. If these keywords or fields are identified, it is considered that the device has the file chunking function, and the chunk size is manually extracted. Otherwise, the network attached storage NAS device does not have this capability.

[0012] Preferably, the step three includes the following parts: Passive traffic monitoring attack: After obtaining the traffic captured during the file upload process, use tcpdump and wireshark to extract the traffic sent by the mobile client, and finally search for the content of the uploaded file in the extracted traffic. If the file content can be found, it means that the network attached storage NAS device does not use any encryption technology to protect the file content and cannot resist passive traffic monitoring attacks; Active replay attack: After collecting the traffic during the file download process, this method uses tcpdump and wireshark to extract the traffic sent by the mobile client, identify the HTTP / HTTPS request containing the download operation field, and then extract the URL. When launching a replay attack, the extracted URL is directly used, and then the file is downloaded using the browser. If the same file can be downloaded, it is considered that the network attached storage NAS device cannot resist replay attacks.

[0013] Preferably, the method further includes identifying privacy leakage issues: based on the obtained network traffic collected during different file operations, identifying the privacy information leaked in the traffic, and in order to further evaluate the privacy compliance risk of the network attached storage NAS device, checking whether these leakages are described in the privacy policy of the network attached storage NAS device; if the privacy policy does not describe the leaked privacy information, the privacy policy is incomplete and the network attached storage NAS device has privacy compliance issues.

[0014] Preferably, the method further includes a list of privacy information types: before identifying the leakage of privacy information in the traffic, the method manually obtains the values ​​of different privacy information, and divides the privacy information into three categories according to the source of the privacy information, namely, the privacy information of the smartphone, the privacy information of the user, and the privacy information of the network attached storage NAS device.

[0015] Preferably, the method further comprises identifying the privacy information leaked in the network traffic: filtering the network traffic sent from the network attached storage NAS device or the mobile client to the remote server. Since the privacy information may be encoded before being sent to the remote server, in addition to directly searching the original string value of the privacy information in the traffic, the encoded string of each privacy information is calculated and then searched in the traffic. If the privacy information leaked in the network traffic is identified, the target IP address is recorded and then the IP address is reversely resolved to the server domain name.

[0016] Compared with the prior art, the beneficial effects of the present invention are as follows: In order to overcome challenges 1 and 2, the method manually defines the threat model of NAS: the NAS device and the corresponding client are connected to the same home router, and the user uses the client to upload / download files to the NAS device. Both the client and the NAS device may communicate with a remote server, and an attacker may invade the home router to launch an attack. Based on this model, performance optimization methods that may be implemented in NAS devices are summarized, which can improve the time or bandwidth overhead of file operations. The method also lists the security and privacy issues that may arise when performing file operations. In order to overcome challenge 3, the method changes the file used for uploading or downloading, and then analyzes the differences in the generated traffic to determine whether the NAS device has deployed a performance optimization method. Finally, the method analyzes the URL and file content contained in the network traffic to determine whether passive traffic monitoring or active replay attacks can be successful. The method also checks the data stream of the interaction between the user client and the NAS device to determine whether there is any leakage of personal identity information (such as device ID). BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 is a flow chart of a detection method for a NAS device in an embodiment of the present invention; Figure 2 It is a schematic diagram of the threat model of the NAS device used in the present invention. DETAILED DESCRIPTION

[0018] The technical solution of the present invention is further described in detail below in conjunction with the accompanying drawings. This embodiment is a method for detecting performance, security and privacy issues of a network attached storage device. The method manually defines a threat model of NAS ( Figure 2 ): NAS devices and corresponding clients are connected to the same home router, and users use the client to upload / download files to the NAS device. Both the client and the NAS device may communicate with the remote server, and attackers may invade the home router to launch attacks. Based on this model, the performance optimization methods that may be implemented in NAS devices are summarized. The method first collects the NAS device traffic through the traffic collection module, and then performs performance, security and privacy detection based on the collected traffic.

[0019] Module 1: Traffic collection module. The traffic collection module collects traffic by uploading and downloading files. The steps are as follows: Step 1: Manually create files, that is, create files of different sizes (i.e., 1KB, 10KB, 100KB, 1MB, 10MB, 100MB), and then upload the files to the NAS device through the mobile client. For each file size, the method prepares two different versions: one version is a compressible file containing only the same characters, and the other version is an incompressible file containing random bytes.

[0020] Step 2: Collect traffic, that is, when using a mobile client to upload or download files, this method uses tcpdump to capture the traffic generated. Since some mobile clients use HTTPS to encrypt traffic, in order to analyze these encrypted traffic, this method uses mitmproxy to initiate MITM on the mobile client to obtain the plaintext content of the encrypted message.

[0021] Step 3: Perform heartbeat packet detection, that is, do not perform any operations within 30 minutes to avoid generating irrelevant traffic, and use tcpdump to capture the traffic generated by the mobile client and NAS device during this period.

[0022] Module 2: Performance test module. This module includes the following three tests to determine whether the network attached storage NAS device contains one of the following: File compression detection: For compressible files, this method collects the total traffic size generated by file upload or download, and compares the file size of the transmitted compressible file with the total size of the data packet containing the file content. If the total size of the data packet is less than half of the size of the transmitted file, this method considers that the NAS device implements file compression to save bandwidth.

[0023] Duplicate file detection: This method first uploads an incompressible file to the NAS device. Then, rename the file and upload the renamed file again. When uploading the incompressible file for the first time, calculate the sum of the sizes of the data packets sent by the mobile client (represented by Size1). When uploading the renamed file, calculate the sum of the sizes of the data packets sent by the mobile client again (represented by Size2). Finally, compare Size1 and Size2. If Size2 is found to be much smaller than Size1 (for example, Size2<0.1*Size1), this method considers that the NAS device has a duplicate file detection function.

[0024] File Chunking: To determine whether the NAS device implements the file chunking feature, this method extracts the plain text of the request message sent when uploading a file. Then, chunking-related keywords (such as "chunk", "boundary", "start", "end") and fields (such as "Content-Length", "Content-Range") are searched in these request messages. If these keywords or fields are identified, the device is considered to have file chunking capabilities, and the chunk size is manually extracted. Otherwise, the NAS device does not have this capability.

[0025] Module 3: Security and privacy problem detection. For security detection, this method uses passive network monitoring attacks and active replay attacks to attack NAS devices to detect the security of NAS devices; for privacy problem detection, this method mainly detects whether the traffic of NAS devices contains privacy leaks.

[0026] Passive traffic monitoring attack: After obtaining the traffic captured during the file upload process, use tcpdump and wireshark to extract the traffic sent by the mobile client, and finally search for the content of the uploaded file in the extracted traffic. If the file content can be found, it means that the network attached storage NAS device does not use any encryption technology to protect the file content and cannot resist passive traffic monitoring attacks.

[0027] Active replay attack: After collecting the traffic during the file download process, this method uses tcpdump and wireshark to extract the traffic sent by the mobile client, identify the HTTP / HTTPS request containing the download operation field, and then extract the URL. When launching a replay attack, directly use the extracted URL and then use the browser to download the file. If the same file can be downloaded, it is considered that the NAS device cannot resist replay attacks.

[0028] Identification of privacy leakage issues: Based on the network traffic collected during different file operations, the method identified the privacy information leaked in the traffic. To further assess the privacy compliance risk of the NAS device, the method checked whether these leakages were described in the privacy policy of the NAS device. If the privacy policy does not describe the leaked privacy information, the privacy policy is incomplete and the NAS device has privacy compliance issues.

[0029] List of privacy information types: Before identifying the leakage of privacy information in traffic, this method manually obtains the values ​​of different privacy information. According to the source of the privacy information, this method divides them into three categories: smartphone privacy information (i.e., MAC address, IMEI, serial number, and latitude and longitude), user privacy information (i.e., name, mobile phone number), and NAS device privacy information (i.e., NAS device serial number, MAC address).

[0030] Identify private information leaked in network traffic: This method filters network traffic sent from NAS devices or mobile clients to remote servers. Since this private information may be encoded before being sent to the remote server, in addition to searching for the original string value of the private information directly in the traffic, the encoded string (such as base64, sha256) of each private information is calculated and then searched in the traffic. If this method identifies private information leaked in network traffic, it will record the target IP and then reverse resolve the IP address to the server domain name.

[0031] Privacy policy compliance analysis: Compare the private information leaked in the traffic with the behavior described in the NAS device privacy policy to determine whether the privacy policy is complete. If the privacy policy does not describe the leaked private information, the privacy policy is incomplete and the NAS device is at risk of privacy violations.

[0032] It should be noted that the above content only illustrates the technical idea of ​​the present invention and cannot be used to limit the protection scope of the present invention. For ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications all fall within the protection scope of the claims of the present invention.

Claims

1. A method for detecting performance, security and privacy issues of a network attached storage device, characterized in that: The method includes the following modules: Traffic collection module collects corresponding traffic by performing file operations; A performance problem detection module, based on the traffic captured by the traffic collection module, determines whether various performance optimization methods are deployed in the network attached storage NAS device to reduce network traffic consumption by comparing the traffic with corresponding files; The security and privacy problem detection module detects the security and privacy problems of the network attached storage NAS device by launching passive traffic monitoring and replay attacks to test whether the network attached storage NAS device can defend against these two common network attacks. It also analyzes the network traffic to detect whether the traffic interacting between the mobile client and the network attached storage NAS device contains privacy leakage issues.

2. The method for detecting performance, security and privacy issues of a network attached storage device according to claim 1, characterized in that: The performance optimization method includes file compression, duplicate file detection, file segmentation and breakpoint resume.

3. The method for detecting performance, security and privacy issues of a network attached storage device according to claim 1, characterized in that: The traffic collection module further includes monitoring the heartbeat packet of the network attached storage NAS device to determine whether the network attached storage NAS device and the corresponding mobile client generate additional bandwidth overhead.

4. The method for detecting performance, security and privacy issues of a network attached storage device according to claim 1, characterized in that: The method comprises the following steps: Step 1, traffic collection phase, connects the mobile application client to the network attached storage NAS device, performs file upload and download operations, and collects the corresponding traffic for further analysis; Step 2, the performance problem detection phase, based on the traffic captured by the traffic collection module, by comparing the traffic with the original files uploaded / downloaded, it is determined whether the network attached storage NAS device has deployed a performance optimization method; In step 3, the security and privacy issue detection phase, passive traffic monitoring and replay attacks are performed to test whether the network-attached storage NAS device can defend against these two common network attacks, and data flow analysis is performed to detect whether the traffic generated by mobile clients and network-attached storage NAS devices contains privacy leakage issues.

5. The method for detecting performance, security and privacy issues of a network attached storage device according to claim 4, characterized in that: The step one comprises: 1) Manually create files of different sizes and then upload them to a network-attached storage (NAS) device through a mobile client. For each file size, two different versions are prepared: one version is a compressible file containing only identical characters, and the other version is an incompressible file containing random bytes. 2) Collect traffic. When using a mobile client to upload or download files, use tcpdump to capture the generated traffic. Since some mobile clients use HTTPS to encrypt traffic, in order to analyze the encrypted traffic, use mitmproxy to initiate MITM on the mobile client to obtain the plaintext content of the encrypted message. 3) Perform heartbeat packet detection without performing any operations during the detection to avoid generating irrelevant traffic, and use tcpdump to capture the traffic generated by the mobile client and the network attached storage NAS device during the detection.

6. The method for detecting performance, security and privacy issues of a network attached storage device according to claim 4, characterized in that: The step 2 includes the following three aspects of detection, respectively determining whether the network attached storage NAS device includes one: File compression detection: For compressible files, this method collects the total traffic size generated by file upload or download, and compares the file size of the transmitted compressible file with the total size of the data packet containing the file content. If the total size of the data packet is less than half of the size of the transmitted file, it is considered that the network attached storage NAS device implements the file compression function to save bandwidth; Duplicate file detection: First, upload an incompressible file to the network attached storage NAS device, then rename the file and upload the renamed file again. When uploading the incompressible file for the first time, calculate the sum of the sizes of the data packets sent by the mobile client, Size1. When uploading the renamed file, calculate the sum of the sizes of the data packets sent by the mobile client, Size2. Finally, compare Size1 and Size2. If Size2 is much smaller than Size1, it is considered that the network attached storage NAS device has a duplicate file detection function. File Chunking: To determine whether a NAS device implements the file chunking feature, extract the plain text of the request message sent when uploading a file. Then, search for chunking-related keywords and fields in these request messages. If these keywords or fields are identified, the device is considered to have the file chunking feature, and the chunk size is manually extracted. Otherwise, the NAS device does not have this capability.

7. The method for detecting performance, security and privacy issues of a network attached storage device according to claim 4, characterized in that: The step three includes the following parts: Passive traffic monitoring attack: After obtaining the traffic captured during the file upload process, use tcpdump and wireshark to extract the traffic sent by the mobile client, and finally search for the content of the uploaded file in the extracted traffic. If the file content can be found, it means that the network attached storage NAS device does not use any encryption technology to protect the file content and cannot resist passive traffic monitoring attacks; Active replay attack: After collecting the traffic during the file download process, use tcpdump and wireshark to extract the traffic sent by the mobile client, identify the HTTP / HTTPS request containing the download operation field, and then extract the URL. When launching a replay attack, directly use the extracted URL and then use the browser to download the file. If the same file can be downloaded, it is considered that the network attached storage NAS device cannot resist replay attacks.

8. The method for detecting performance, security and privacy issues of a network attached storage device according to claim 4, characterized in that: The method also includes identifying privacy leakage issues: based on the network traffic collected during different file operations, identifying the privacy information leaked in the traffic, and in order to further evaluate the privacy compliance risk of the network attached storage NAS device, checking whether these leakages are described in the privacy policy of the network attached storage NAS device. If the privacy policy does not describe the leaked privacy information, the privacy policy is incomplete and the network attached storage NAS device has privacy compliance issues.

9. The method for detecting performance, security and privacy issues of a network attached storage device according to claim 4, characterized in that: The method also includes a list of privacy information types: before identifying the leakage of privacy information in the traffic, manually obtaining values ​​of different privacy information, and dividing the privacy information into three categories according to the source of the privacy information, namely, privacy information of a smartphone, privacy information of a user, and privacy information of a network attached storage NAS device.

10. The method for detecting performance, security and privacy issues of a network attached storage device according to claim 4, characterized in that: The method also includes identifying private information leaked in network traffic: filtering network traffic sent from a network attached storage NAS device or a mobile client to a remote server. Since the private information may be encoded before being sent to the remote server, in addition to directly searching for the original string value of the private information in the traffic, the encoded string of each private information is calculated and then searched in the traffic. If private information leaked in the network traffic is identified, the target IP address is recorded and then the IP address is reversely resolved to the server domain name.

Images