A method for detecting performance, security and privacy issues of a network attached storage device

Abstract

The application discloses a network attached storage device performance, security and privacy problem detection method, and a system thereof comprises a traffic collection module, which collects corresponding traffic by performing file operations and collects a large amount of redundant traffic possibly generated by the device; a performance problem detection module, which is based on the traffic captured by the traffic collection module, and the method compares the traffic with corresponding files to determine whether various performance optimization methods are deployed in the network attached storage (NAS) device to reduce network traffic consumption; and a security and privacy problem detection module, which launches passive traffic monitoring and replay attacks to test whether the network attached storage (NAS) device can defend against the two common network attacks, analyzes the network traffic to detect whether the privacy leakage problem is contained in the traffic exchanged between the mobile client and the network attached storage (NAS) device, and reduces the privacy violation risk.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of information security, and specifically relates to a system and method for detecting performance, security and privacy problems of a network attached storage (NAS) device. BACKGROUND

[0002] In recent years, many enterprises and individual users choose network attached storage (NAS) devices to store files instead of using personal cloud storage services. The main reason is that NAS devices are cheaper for the same storage space, and can prevent third-party access to personal files and reduce the occurrence of privacy leakage. However, attackers may target NAS devices to access sensitive information without authorization, modify system configurations, or launch denial-of-service attacks and ransomware attacks. Therefore, it is necessary to detect the performance, security and privacy problems of NAS systems. According to the European Union's General Data Protection Regulation (GDPR) and China's Personal Information Protection Law (PIPL), network attached storage (NAS) device manufacturers must take appropriate technical measures (such as communication encryption and access control) to ensure the safety of users' personal data and prevent privacy leakage. However, measuring NAS devices is challenging:

[0003] Challenge 1: The threat model of network attached storage (NAS) devices is complex, making it difficult to prevent network attacks and protect user privacy. The threat model of NAS includes three entities (i.e., the NAS device itself, the user client, and the manufacturer's remote server), and any two of them can communicate with each other.

[0004] Challenge 2: Since NAS devices store a large amount of personal files, it is necessary to solve the security and privacy problems of NAS while maintaining good performance, and simply analyzing the performance of NAS is not enough.

[0005] Challenge 3: Network attached storage (NAS) devices do not provide command-line tools or API interfaces for users to capture network traffic and obtain their internal working status, making it difficult to detect various problems. NAS devices have different operating systems and are closed source, so they can only be treated as black boxes, and their internal function implementation can be inferred from the input (uploaded and downloaded files) and output (network packets). SUMMARY

[0006] To better understand the performance, security, and privacy issues of NAS devices, this detection method is proposed: A detection method for the performance, security, and privacy issues of network-attached storage (NAS) devices. This method manually defines a threat model for NAS: the NAS device and the corresponding client are connected to the same home router, and users use the client to upload / download files to the NAS device. Both the client and the NAS device may communicate with a remote server, and an attacker may hack into the home router to launch an attack. Based on this model, the possible performance optimization methods that can be implemented in NAS devices are summarized, as well as the measurement system based on the background model of the network-attached storage (NAS) device, mobile application client, and remote server. Specifically, it includes the following modules:

[0007] Traffic collection module: Perform file operations (i.e., upload and download files) through mobile application clients and collect the corresponding traffic. It also monitors heartbeat traffic to determine the additional overhead caused by NAS devices and mobile clients.

[0008] Performance detection module: Determines whether performance optimization methods are deployed in the NAS device by comparing the collected network traffic with the uploaded / downloaded files.

[0009] The security and privacy detection module tests the security of NAS devices by analyzing URLs and file content contained in network traffic, performing passive traffic sniffing attacks and active replay attacks. This method also performs data flow analysis to detect whether private information is leaked in the network traffic generated by mobile clients and NAS devices.

[0010] Preferably, the performance optimization method includes file compression, duplicate file detection and file segmentation.

[0011] Preferably, a method for detecting performance, security, and privacy issues of NAS devices implemented by the system comprises the following steps:

[0012] Step 1: Traffic collection phase: After connecting the mobile application client to the network-attached storage (NAS) device, file upload and download operations are performed, and the corresponding traffic is collected for further analysis.

[0013] Step 2, performance problem detection phase, based on the traffic captured by the traffic collection module, the method determines whether the network attached storage NAS device has deployed a performance optimization method by comparing the traffic with the original uploaded / downloaded files;

[0014] In the third step, the security and privacy issue detection phase, passive traffic monitoring and replay attacks are performed to test whether the NAS device can defend against these two common network attacks, and data flow analysis is performed to detect whether the traffic generated by mobile clients and NAS devices contains privacy leakage issues.

[0015] Preferably, the step one includes:

[0016] 1) Manually create files, create files of different sizes, and then upload the files to the network attached storage (NAS) device through the mobile client, and for each size of the file, the method prepares two different versions: one version contains only the same characters of the compressible file, and the other version is an incompressible file containing random bytes;

[0017] 2) Collect traffic, use tcpdump to capture the generated traffic when uploading or downloading files using the mobile client, and since some mobile clients use HTTPS to encrypt traffic, in order to analyze these encrypted traffic, the method uses mitmproxy to initiate MITM to the mobile client to obtain the plaintext content of the encrypted message;

[0018] 3) Heartbeat packet detection, during which no operation is performed to avoid generating irrelevant traffic, and during which tcpdump is used to capture the traffic generated by the mobile client and the network attached storage (NAS) device.

[0019] Preferably, the step two includes the following three aspects of detection, respectively judging whether the network attached storage (NAS) device contains one:

[0020] 1) File compression detection: for compressible files, the method collects the total size of the traffic generated by file upload or download, compares the file size of the transmitted compressible file with the total size of the data packet containing the file content, and if the total size of the data packet is less than half of the transmitted file size, it is considered that the network attached storage (NAS) device implements file compression function to save bandwidth;

[0021] 2) Duplicate file detection: first upload an incompressible file to the network attached storage (NAS) device, then rename the file and upload the renamed file again, when uploading the incompressible file for the first time, calculate the total size of the data packet sent by the mobile client Size1, when uploading the renamed file, calculate the total size of the data packet sent by the mobile client Size2, finally, compare Size1 and Size2, if Size2 is found to be much smaller than Size1, it is considered that the network attached storage (NAS) device has duplicate file detection function;

[0022] 3) File Chunking: To determine whether a NAS device implements the file chunking feature, we extract the plaintext of the request message sent when uploading a file. We then search for chunking-related keywords and fields in these request messages. If these keywords or fields are identified, we assume that the device has the file chunking feature and manually extract the chunk size. Otherwise, the NAS device does not have this capability.

[0023] Preferably, the step three includes the following parts:

[0024] Passive traffic sniffing attack: After obtaining the traffic captured during the file upload process, use tcpdump and wireshark to extract the traffic sent by the mobile client. Finally, search for the uploaded file content in the extracted traffic. If the file content can be found, it means that the network attached storage (NAS) device does not use any encryption technology to protect the file content and cannot resist the passive traffic sniffing attack.

[0025] Active replay attack: After collecting traffic during the file download process, this method uses tcpdump and wireshark to extract the traffic sent by the mobile client, identify HTTP / HTTPS requests containing the download operation field, and then extract the URL. When launching a replay attack, the extracted URL is directly used to download the file using a browser. If the same file can be downloaded, the network-attached storage (NAS) device is considered to be vulnerable to replay attacks.

[0026] Preferably, the method further includes identifying privacy leakage issues: based on the obtained network traffic collected during different file operations, identifying the privacy information leaked in the traffic; in order to further evaluate the privacy compliance risk of the network attached storage NAS device, checking whether these leakages are described in the privacy policy of the network attached storage NAS device; if the privacy policy does not describe the leaked privacy information, the privacy policy is incomplete and the network attached storage NAS device has a privacy compliance issue.

[0027] Preferably, the method further includes a list of privacy information types: before identifying the leakage of privacy information in the traffic, the method manually obtains the values ​​of different privacy information and divides them into three categories according to the source of the privacy information, namely, privacy information of smartphones, privacy information of users, and privacy information of network attached storage (NAS) devices.

[0028] Preferably, the method further includes identifying private information leaked in network traffic: filtering network traffic sent from a network attached storage (NAS) device or a mobile client to a remote server. Since such private information may be encoded before being sent to the remote server, in addition to directly searching for the original string value of the private information in the traffic, the encoded string of each private information is calculated and then searched in the traffic. If private information leaked in the network traffic is identified, the target IP address is recorded and then the IP address is reversely resolved to the server domain name.

[0029] Compared to existing technologies, the present invention offers the following advantages: To overcome challenges 1 and 2, this method manually defines a NAS threat model: a NAS device and its corresponding client are connected to the same home router, and users use the client to upload / download files to the NAS device. Both the client and the NAS device may communicate with remote servers, allowing attackers to compromise the home router and launch attacks. Based on this model, it summarizes possible performance optimization methods that can be implemented in NAS devices, which can improve the time or bandwidth overhead of file operations. This method also lists potential security and privacy issues that may arise when performing file operations. To overcome challenge 3, this method modifies the files used for upload or download and then analyzes the resulting traffic to determine whether the NAS device has implemented performance optimization methods. Finally, this method analyzes the URLs and file content contained in the network traffic to determine whether passive traffic eavesdropping or active replay attacks are successful. This method also examines the data flows between the user client and the NAS device to determine whether any personally identifiable information (such as the device ID) has been leaked. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 1 is a flow chart of a method for detecting a NAS device in an embodiment of the present invention;

[0031] Figure 2 Schematic diagram of the threat model of the NAS device used in the present invention. DETAILED DESCRIPTION

[0032] The technical solution of the present invention is further described in detail below with reference to the accompanying drawings. This embodiment is a method for detecting performance, security and privacy issues of network attached storage devices. The method manually defines a threat model of NAS ( Figure 2 NAS devices and their corresponding clients are connected to the same home router. Users use the clients to upload and download files to the NAS devices. Both the client and the NAS device may communicate with remote servers, allowing attackers to compromise the home router and launch attacks. Based on this model, we summarize possible performance optimization methods for NAS devices. This method first collects NAS device traffic using a traffic collection module and then performs performance, security, and privacy checks based on the collected traffic.

[0033] Module 1: Traffic collection module. The traffic collection module collects traffic by uploading and downloading files. The steps are as follows:

[0034] The first step involves manually creating files of varying sizes (i.e., 1KB, 10KB, 100KB, 1MB, 10MB, and 100MB). These files are then uploaded to the NAS device using a mobile client. For each file size, two different versions are prepared: one compressible version containing only identical characters, and the other an incompressible version containing random bytes.

[0035] The second step is to collect traffic. This method uses tcpdump to capture the traffic generated when uploading or downloading files using a mobile client. Since some mobile clients use HTTPS to encrypt traffic, this method uses mitmproxy to launch a MITM attack on the mobile client to obtain the plaintext content of encrypted messages for analysis.

[0036] Step 3: Perform heartbeat packet detection. This means that no operations are performed within 30 minutes to avoid generating irrelevant traffic. During this period, tcpdump is used to capture the traffic generated by the mobile client and NAS device.

[0037] Module 2: Performance testing module. This module includes the following three aspects of testing, respectively to determine whether the network attached storage NAS device contains one of the following:

[0038] File compression detection: For compressible files, this method collects the total traffic volume generated by file uploads or downloads and compares the size of the transferred compressible file with the total size of the data packets containing the file content. If the total size of the data packets is less than half the size of the transferred file, this method assumes that the NAS device is implementing file compression to save bandwidth.

[0039] Duplicate file detection: This method first uploads an incompressible file to the NAS device. It then renames the file and uploads the renamed file again. When uploading the incompressible file for the first time, the total size of the data packets sent by the mobile client is calculated (denoted by Size1). When uploading the renamed file, the total size of the data packets sent by the mobile client is again calculated (denoted by Size2). Finally, Size1 and Size2 are compared. If Size2 is significantly smaller than Size1 (for example, Size2 < 0.1 * Size1), this method assumes that the NAS device has duplicate file detection capabilities.

[0040] File Chunking: To determine whether a NAS device implements file chunking, this method extracts the plaintext of the request message sent when uploading a file. These request messages are then searched for chunk-related keywords (e.g., "chunk," "boundary," "start," "end") and fields (e.g., "Content-Length," "Content-Range"). If these keywords or fields are identified, the device is assumed to have file chunking capabilities, and the chunk size is manually extracted. Otherwise, the NAS device does not have this capability.

[0041] Module 3: Security and Privacy Issue Detection. For security detection, this method uses passive network monitoring attacks and active replay attacks to attack NAS devices to test their security. For privacy issue detection, this method mainly detects whether the traffic of NAS devices contains privacy leaks.

[0042] Passive traffic sniffing attack: After obtaining the traffic captured during the file upload process, use tcpdump and wireshark to extract the traffic sent by the mobile client. Finally, search for the uploaded file content in the extracted traffic. If the file content can be found, it means that the network attached storage (NAS) device does not use any encryption technology to protect the file content and cannot resist passive traffic sniffing attacks.

[0043] Active replay attack: After collecting traffic during the file download process, this method uses tcpdump and wireshark to extract the traffic sent by the mobile client, identify HTTP / HTTPS requests containing the download operation field, and then extract the URL. When launching a replay attack, the extracted URL is directly used to download the file using a browser. If the same file can be downloaded, the NAS device is considered to be vulnerable to replay attacks.

[0044] Identifying Privacy Leakages: Based on the network traffic collected during various file operations, this method identifies leaked private information. To further assess the privacy compliance risk of the NAS device, this method checks whether these leaks are described in the NAS device's privacy policy. If the privacy policy does not describe the leaked private information, the privacy policy is incomplete and the NAS device has privacy compliance issues.

[0045] List of private information types: Before identifying private information leaks in traffic, this method manually obtains the values ​​of different private information and categorizes them into three types based on their source: smartphone private information (i.e., MAC address, IMEI, serial number, and latitude and longitude), user private information (i.e., name and phone number), and NAS device private information (i.e., NAS device serial number and MAC address).

[0046] Identifying Leaked Private Information in Network Traffic: This method filters network traffic sent from NAS devices or mobile clients to remote servers. Because this private information may be encoded before being sent to the remote server, in addition to searching directly for the original string value of the private information in the traffic, this method also calculates the encoded string (e.g., base64, sha256) for each private information and then searches for it in the traffic. If this method identifies leaked private information in the network traffic, it records the destination IP address and then reverse-analyzes the IP address to the server domain name.

[0047] Privacy Policy Compliance Analysis: Compare the private information leaked in the traffic with the behavior described in the NAS device's privacy policy to determine whether the privacy policy is complete. If the privacy policy does not describe the leaked private information, the privacy policy is incomplete and the NAS device is at risk of privacy violations.

[0048] It should be noted that the above content merely illustrates the technical idea of ​​the present invention and cannot be used to limit the scope of protection of the present invention. For ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications all fall within the scope of protection of the claims of the present invention.

Claims

1. A method for detecting performance, security, and privacy issues of a network attached storage device, characterized in that: The method includes the following modules: Traffic collection module collects corresponding traffic by performing file operations; A performance problem detection module, based on the traffic captured by the traffic collection module, determines whether various performance optimization methods are deployed in the network attached storage (NAS) device to reduce network traffic consumption by comparing the traffic with corresponding files; The performance optimization method includes file compression, duplicate file detection and file segmentation; The performance optimization method includes the following three aspects of detection, respectively determining whether the network attached storage NAS device includes one of the following: File compression detection: For compressible files, this method collects the total traffic size generated by file uploads or downloads, compares the file size of the transmitted compressible file with the total size of the data packets containing the file content, and if the total size of the data packets is less than half the size of the transmitted file, it is considered that the network attached storage (NAS) device has implemented file compression to save bandwidth; Duplicate file detection: First, upload an incompressible file to a NAS device. Then, rename the file and upload the renamed file again. When uploading the incompressible file for the first time, calculate the sum of the sizes of the data packets sent by the mobile client (Size1). When uploading the renamed file, calculate the sum of the sizes of the data packets sent by the mobile client (Size2). Finally, compare Size1 and Size2. If Size2 is much smaller than Size1, it is considered that the NAS device has a duplicate file detection function. File Chunking: To determine whether a NAS device implements file chunking, we extract the plaintext of the request message sent when uploading a file. We then search for chunking-related keywords and fields in these request messages. If we identify these keywords or fields, we assume the device has file chunking capabilities, and we manually extract the chunk size. Otherwise, the NAS device does not have this capability. The security and privacy issue detection module detects security and privacy issues of network-attached storage (NAS) devices by launching passive traffic monitoring and replay attacks to test whether the NAS devices can defend against these two common network attacks. It also analyzes network traffic to detect whether the traffic interacting between mobile clients and NAS devices contains privacy leaks.

2. The method for detecting performance, security, and privacy issues of a network attached storage device according to claim 1, wherein: The traffic collection module further includes monitoring the heartbeat packet of the network attached storage NAS device to determine whether the network attached storage NAS device and the corresponding mobile client generate additional bandwidth overhead.

3. The method for detecting performance, security, and privacy issues of a network attached storage device according to claim 1, wherein: The method comprises the following steps: Step 1: Traffic collection phase: After connecting the mobile application client to the network-attached storage (NAS) device, file upload and download operations are performed, and the corresponding traffic is collected for further analysis. Step 2, the performance problem detection phase, based on the traffic captured by the traffic collection module, determines whether the network attached storage NAS device has deployed a performance optimization method by comparing the traffic with the original uploaded / downloaded files; In the third step, the security and privacy issue detection phase, passive traffic monitoring and replay attacks are performed to test whether the NAS device can defend against these two common network attacks, and data flow analysis is performed to detect whether the traffic generated by mobile clients and NAS devices contains privacy leakage issues.

4. The method for detecting performance, security, and privacy issues of a network attached storage device according to claim 3, wherein: The step one comprises: 1) Manually create files of different sizes and upload them to a network-attached storage (NAS) device using a mobile client. For each file size, two different versions are prepared: one compressible version containing only identical characters, and the other an incompressible version containing random bytes. 2) Traffic collection: When using a mobile client to upload or download files, tcpdump is used to capture the generated traffic. Since some mobile clients use HTTPS to encrypt traffic, mitmproxy is used to launch a MITM attack on the mobile client to obtain the plaintext content of the encrypted messages for analysis. 3) Perform heartbeat packet detection without performing any operations during the detection to avoid generating irrelevant traffic, and use tcpdump to capture the traffic generated by the mobile client and the network attached storage (NAS) device during the detection.

5. The method for detecting performance, security, and privacy issues of a network attached storage device according to claim 3, wherein: The step three includes the following parts: Passive traffic sniffing attack: After obtaining the traffic captured during the file upload process, use tcpdump and wireshark to extract the traffic sent by the mobile client. Finally, search for the uploaded file content in the extracted traffic. If the file content can be found, it means that the network attached storage (NAS) device does not use any encryption technology to protect the file content and cannot resist the passive traffic sniffing attack. Active replay attack: After collecting traffic during the file download process, use tcpdump and wireshark to extract the traffic sent by the mobile client, identify HTTP / HTTPS requests containing the download operation field, and then extract the URL. When launching a replay attack, directly use the extracted URL and then use the browser to download the file. If the same file can be downloaded, it is considered that the network attached storage (NAS) device cannot resist replay attacks.

6. The method for detecting performance, security, and privacy issues of a network attached storage device according to claim 3, wherein: The method also includes identifying privacy leakage issues: based on the network traffic collected during different file operations, identifying the privacy information leaked in the traffic, and in order to further evaluate the privacy compliance risk of the network attached storage NAS device, checking whether these leakages are described in the privacy policy of the network attached storage NAS device; if the privacy policy does not describe the leaked privacy information, the privacy policy is incomplete and the network attached storage NAS device has a privacy compliance issue.

7. The method for detecting performance, security, and privacy issues of a network attached storage device according to claim 3, wherein: The method also includes a list of privacy information types: before identifying privacy information leakage in traffic, manually obtaining values ​​of different privacy information, and classifying them into three categories based on the source of the privacy information, namely, privacy information of smartphones, privacy information of users, and privacy information of network-attached storage (NAS) devices.

8. The method for detecting performance, security, and privacy issues of a network attached storage device according to claim 3, wherein: The method also includes identifying private information leaked in network traffic: filtering network traffic sent from a network attached storage (NAS) device or a mobile client to a remote server. Since the private information may be encoded before being sent to the remote server, in addition to directly searching for the original string value of the private information in the traffic, the encoded string of each private information is calculated and then searched in the traffic. If private information leaked in the network traffic is identified, the target IP address is recorded and then the IP address is reversely resolved to the server domain name.

Images