Method for intercepting an encrypted communication stream

Abstract

The invention relates to a method for intercepting, by an analysis module, a communication stream destined for an application running in a container on a host environment comprising an operating system, the method comprising a configuration step (301) during which a set of code instructions is associated with a particular execution point of a data transfer system call, and an execution step (303) of said set of instructions in the kernel space of the host operating system when a system call triggered from at least one container reaches (302) the execution point, the execution of said set of instructions comprising at least the copying (304) of the contents of a memory area of ​​the kernel space modified by the system call to a memory area of ​​the user space. Figure 3.

Description

Title of the invention: Method for intercepting an encrypted communication stream Technical field

[0001] The invention belongs to the field of communications and relates more particularly to a method for intercepting an encrypted communication flow in a virtualized execution environment based on containers. Prior art

[0002] Modern communication networks increasingly rely on virtualization mechanisms. Virtualization allows multiple systems or applications to run on a single physical system by defining isolated execution environments called containers. Virtualization can be complete or partial.

[0003] In full virtualization, applications run on virtual machines whose input / output interfaces are abstractions of the corresponding physical interfaces provided by a hypervisor. In other words, the host machine emulates a machine running a complete operating system and the desired applications. The applications then run in a complete environment, which may be of a different type than that of the host system.

[0004] In the case of partial virtualization, only the resources necessary for its execution are made available to an application. This is called containerization. This mode of virtualization generally requires fewer resources than full virtualization, because applications running in containers use the native system call interface of the operating system. No emulation is then necessary.

[0005] Virtualization provides great flexibility and flexibility that is particularly appreciated in the field of service platforms and networks. 5G communication networks rely, for example, on the virtualization of VNF network functions (for Virtual Network Function in English, for example Firewall, DNS, NAT, Authentication, etc.), thus making it possible to decorrelate a network function from the physical equipment that corresponds to it or to define network slices.

[0006] The isolated nature of containers, however, limits the possibilities for analyzing and introspecting virtualized systems. For example, it may be tedious or even impossible for an operator of a virtualized communications network to deploy probes in the different containers that implement the network functions. For example, the network functions may be provided by different vendors under the form of "black boxes" without the possibility of instrumentation. In such a situation, the operator of the virtualized network may encounter difficulties in securing and monitoring its network. In particular, the operator may encounter difficulties in accessing the content of encrypted communications exchanged by network functions, for example the content of signaling messages, which could lead to security or quality of service problems.

[0007] There is therefore a need for a solution that allows encrypted communications to be intercepted to applications running in containers without the need to intervene in the containers themselves. Summary of the invention

[0008] To this end, according to a first aspect of the invention, a method is proposed for intercepting, by an analysis module, a communication flow intended for an application executed in a container on a host environment comprising an operating system, the method comprising the following steps: - A configuration step in which a set of code instructions is associated with a particular execution point of a data transfer system call, - A step of executing said set of instructions in the kernel space of the operating system of the host environment when a data transfer system call triggered from the at least one container reaches the execution point, the execution of said set of instructions comprising at least copying the contents of a memory area of ​​the kernel space modified by the system call to a memory area of ​​the user space.

[0009] Program instructions are thus injected into the host operating system kernel in order to be executed in kernel space when a system call is executed. Thus, when an application running in a particular container makes a call to the host operating system to receive or transmit data, the injected program instructions are executed when the particular execution point with which they are associated is reached. Because the code instructions are executed in the kernel, it is possible to access the buffer memory used by the operating system for receiving or transmitting network data, without having to act on the recipient or originating containers of these communications. It is no longer necessary to install probes in the containers to observe the encrypted traffic.

[0010] In this way, an analysis module running on the host machine can access messages intended for applications running in containers, without having to modify them.

[0011] According to a particular embodiment, the method comprises a prior step of determining that a communications decryption function is performed by the kernel, the execution of the set of code instructions being conditioned on the result of said determination step, the modified kernel space memory area comprising data decrypted by the kernel.

[0012] In this way, the instrumentation of the system call is only performed if necessary, for example when the kernel implements the encryption and decryption functions. For example, a Linux kernel can be configured to implement the TLS protocol in order to limit memory copies and improve performance. When such a configuration is determined, the system calls relating to the reception of encrypted data can be instrumented by code instructions adapted to access the decrypted data from the kernel.

[0013] According to a particular embodiment, the method further comprises a step of detecting an attack from the intercepted data.

[0014] In a particular embodiment, the method is such that the configuration step comprises associating a first set of code instructions with a first point of execution in the kernel space of the operating system and a second set of code instructions with a second point of execution in the kernel space of the operating system, the first point of execution being an entry point of the system call and the second point of execution being an exit point of said system call, the first set of code instructions being configured to obtain an address of a buffer in the kernel space and store this address in a data structure stored in the kernel space, the second set of instructions being configured to obtain the stored address and copy data from a location pointed to by said address to a buffer accessible from the user space.

[0015] According to another aspect, the invention relates to a device for intercepting a communication flow intended for an application executed in a container on a host environment comprising an operating system, the device comprising a processor coupled to a memory in which computer program instructions are recorded, configured to implement the following steps: - A configuration step during which a set of code instructions is associated with a particular execution point of a data transfer system call, - A step of executing said set of instructions in the kernel space of the operating system of the host environment when a data transfer system call triggered from the at least one container reaches the execution point, the execution of said set of instructions comprising at least less copying the contents of a kernel space memory area modified by the system call to a user space memory area.

[0016] The invention also relates to a server comprising an interception device as described above.

[0017] In a particular embodiment, the different steps of the interception method are determined by computer program instructions.

[0018] Consequently, the invention also relates to a computer program comprising instructions adapted to the implementation of the steps of an interception method as described above, when the program is executed by a processor.

[0019] This program may use any programming language, and be in the form of source code, object code, or code intermediate between source code and object code, such as in a partially compiled form, or in any other desirable form.

[0020] The invention also relates to a computer-readable information medium on which is recorded a computer program comprising instructions for executing the steps of an interception method as described above.

[0021] The information carrier may be any entity or device capable of storing the program. For example, the carrier may include a storage means, such as a ROM, for example a CD ROM or a microelectronic circuit ROM, a flash memory, or a magnetic recording means, such as a hard disk.

[0022] On the other hand, the information medium may be a transmissible medium such as an electrical or optical signal, which may be conveyed via an electrical or optical cable, by radio or by other means. The program according to the invention may in particular be downloaded from a network such as the Internet.

[0023] Alternatively, the information carrier may be an integrated circuit in which the program is incorporated, the circuit being adapted to execute or to be used in the execution of the method in question.

[0024] The various embodiments or features mentioned above may be added independently or in combination with each other, to the steps of the interception method.

[0025] The devices, servers, programs and information media have advantages similar to those of the method to which they correspond. Brief description of the figures

[0026] Other characteristics and advantages will appear on reading a preferred embodiment described with reference to the appended drawings among which: - [Fig.l] is a diagram representing an architecture in which cryptographic functions are implemented in the user space of a host system, - [Fig.2] is a diagram representing an architecture in which cryptographic functions are implemented in the kernel space of a host system, - [Fig.3] is a flowchart showing the main steps of an interception method according to a particular embodiment, and - [Fig.4] illustrates an architecture of a device suitable for implementing an interception method according to a particular embodiment. Detailed description

[0027] TLS is a widely used communication protocol for securing digital communications. For example, TLS is used to secure connections to an HTTP server or encrypt video-on-demand content, but also for encrypting network signaling data, for example to secure control traffic between entities implementing the different functions of a 5G network.

[0028] Conventionally, the TLS protocol can be implemented in an application in the form of a library. Open-source libraries are known for this, for example openssl. In such a case, an application running in a container of a host environment uses the services of a library to encrypt and decrypt traffic in the user space.

[0029] In the following description, user space refers to a memory address space used to store and execute user programs. This memory address space is separate from kernel space, which is used to store operating system code and data. User space provides an isolated environment that protects the system from malicious programs. Thus, memory access possibilities are limited in user space, as are the instructions allowed.

[0030] [Fig.l] illustrates an implementation of a communications encryption system using a library. An application 100 runs in a container 101 of a host environment 102. The application 100 uses the services of a TLS library 103 in the user space to establish the TLS connection, perform authentication and encrypt / decrypt the data. Thus, to transmit encrypted data to a recipient, the application 100 encrypts a data packet using the TLS library 103 and makes a system call 104 to instruct the kernel to send the encrypted data. The kernel uses a protocol stack 105 to transmit the data.

[0031] In such a configuration, data passing between user space and kernel space via system calls is encrypted.

[0032] [Fig. 2] illustrates a second mode of implementation of the TLS protocol. In this second mode, the implementation of the TLS protocol is shared between, on the one hand, the application 100 which uses a TLS library 103 only for establishing communication and, on the other hand, the kernel which uses a KTLS module 106 dedicated to the encryption / decryption of communications as well as authentication.

[0033] In this second configuration, the data that passes between user space and kernel space via system calls is not encrypted.

[0034] [Fig. 3] is a flowchart illustrating the main steps of an interception method implemented, according to a particular embodiment, by an analysis module in a host execution environment on which at least one application is running in a container.

[0035] The method comprises a first optional step 300 during which the environment is tested in order to determine whether cryptographic functions necessary for establishing secure communications are implemented in the kernel of the host operating system or whether these functions are implemented in the user space. For this, according to a particular embodiment, the analysis module instruments a system call intended to configure the network functions used by the applications running in one or more containers in order to identify the applications which request the use of cryptographic functions in the kernel. More precisely, the analysis module associates a sequence of particular instructions with a particular execution point of a system call intended to configure access to the network communications layers of the operating system of the host environment.This sequence of instructions is configured to store in a kernel data structure process identifiers, identifiers of access points to network transport services and the configuration requested by the application, in particular the configuration relating to the use or not of cryptographic functions provided by the kernel. For example, on a Posix-type host system, step 300 can instrument the “setsockopt” system call so that the sequence of instructions is executed each time an application running in a container configures network access. The instructions of the sequence associated with the system call notably include a test for determining whether the application seeks to configure the use of cryptographic functions in the kernel, for example by determining whether the TLS_RX option is requested by the application.If so, the instructions are configured to store the process identifier (pid in POSIX) in association with the socket identifier. This association is stored in a data structure in the kernel.

[0036] Instrumentation of system calls can be achieved in a number of ways. For For example, it is possible to use a BPF (for Berkley Packet Filter) or eBPF (for Extended BPF) virtual machine.

[0037] eBPF is a Linux kernel technology that allows programs to be executed in kernel space without having to modify the kernel source code or add additional modules. It is a virtual machine with a limited number of instructions, on which developers can run a program using specific kernel resources.

[0038] When it is determined, at the end of step 300, that the cryptographic functions necessary for establishing secure communications are implemented in the kernel, the analysis module implements a step 301 during which at least one set of program instructions is associated with a system call execution point relating to a network data transfer. More precisely, particular instructions are injected into the kernel of the operating system, for example by means of an eBPF technology, and one or more system functions for receiving and / or sending data over a network are instrumented so that the injected instructions are executed when said system functions are called by an application running in user space.For example, on a Posix-like system, the sendmsg, sendto, recvmsg, and / or recvfrom functions can be instrumented in this way, so that each call to one of these functions by an application triggers the execution of a sequence of instructions injected into the kernel by the parsing module.

[0039] In step 302, a system call instrumented in step 301 is invoked by an application running in a container on the host machine. This is, for example, a system call intended to receive data transmitted by a device to the application, for example signaling data.

[0040] When the system call reaches a particular execution point with which a sequence of instructions has been associated during the configuration step 301, the interception method comprises a step 303 during which the sequence of instructions is executed in the kernel space.

[0041] When the system call invoked in step 302 concerns the reception of encrypted data, the execution step 303 comprises a sub-step 304 of accessing a memory area of ​​the kernel of the operating system in which the data that has been received by the network interface and decrypted by the cryptographic functions of the kernel are temporarily stored, and of copying the contents of this memory area to another memory area, for example a circular buffer memory allocated in the user space.

[0042] When the system call invoked concerns sending data to a device, step 304 is a step of accessing a memory area of ​​the system kernel operating system in which the data that the application in question wishes to send is temporarily stored, before it has been transformed by the cryptographic functions of the kernel, and copying the contents of this memory area to another memory area, for example a circular buffer memory allocated in user space.

[0043] In a particular embodiment, access to the kernel memory area containing the unencrypted data is performed in two stages. In such a case, a first sequence of instructions is injected into the kernel and associated with the input of a network reception or transmission system call, and a second sequence of instructions is associated with the output of the system call. In other words, a first “hook” is configured at an execution point located at the beginning of the instrumented system call, i.e. after the system call is invoked by the application but before it is actually executed.This first "hook" is associated with code instructions configured to obtain the address of the kernel memory area in which the unencrypted data, received or to be transmitted, is written, and to store this address of the memory area obtained in a kernel data structure, for example a table or a dictionary, in association with an identifier of the system call concerned by the system call, for example a socket identifier.

[0044] A second sequence of instructions is injected into the kernel and associated with the output of the system call. This second sequence comprises instructions configured to obtain the address of the buffer memory that was stored in the data structure during the execution of the instructions injected at the entry of the system call, and to copy the contents of this memory area into a memory allocated in the user space, for example a circular buffer memory. The intercepted unencrypted data is thus accessible by an analysis module executing in the user space of the host environment.

[0045] The method finally comprises a step 305 of analyzing the intercepted data. The analysis step comprises, for example, the application of a predictive model to the intercepted data. The predictive model may be an artificial neural network previously trained from messages characteristic of a cyber-attack, an intrusion or a failure of network equipment.

[0046] Although the description of the method is based on eBPF technology, other technologies may be used to implement the method. For example, the invention may be implemented by a dedicated module loaded into the kernel, or by instructions introduced into the kernel during its compilation.

[0047] [Fig.4] represents an architecture of a device 400 adapted to implement the interception method according to a particular embodiment of the invention.

[0048] The device 400 comprises a data processing module comprising a storage space 401, for example a memory (MEM), a processing unit 402, equipped for example with a microprocessor (PROC), and controlled by a computer program (PGR) 403 whose instructions are configured to implement the interception method as described previously in relation to [Fig.3].

[0049] At initialization, the code instructions of the computer program 403 are for example loaded into the memory 401 before being executed by the processor of the processing unit 402. The microprocessor of the processing unit 402 implements, according to the instructions of the computer program 403, the steps of the interception method described above with reference to [Fig. 3].

[0050] For this, the device 400 comprises communication means 404, for example a network card, allowing the device to connect to a communication network and exchange data with other devices.

[0051] The communication means 404 are controlled by an operating system of the device offering in particular cryptographic functions making it possible to encrypt and decrypt communications in the kernel space for the benefit of applications running in a user space, for example in containers.

[0052] The device also comprises a configuration module 405 adapted to instrument at least one network function of the operating system by associating a set of instructions with a particular execution point of said function. For this, the configuration module can be implemented by computer program instructions and use eBPF functions to inject code instructions into the kernel and associate the execution of these instructions with the entry and / or exit of a particular system call.

[0053] The device 400 also comprises a network data interception module 406. The module is for example implemented by a sequence of code instructions injected into the kernel and associated with a particular execution point of a system call. The sequence of instructions in question is configured to access a memory area allocated in the kernel space intended to temporarily store data exchanged by a local application with one or more remote devices, in particular signaling messages exchanged between different network functions. The data contained in the memory area is data decrypted by cryptographic functions of the kernel of the operating system or data awaiting encryption by the cryptographic functions.In other words, the interception module is configured to access cleartext, i.e., unencrypted, data stored in a memory area of ​​the operating system that is not directly accessible by applications running in the user space of the operating system. The interception module further includes instructions configured to copy data from the allocated memory area into kernel space. to a memory area accessible from user space.

[0054] The device finally comprises a diagnostic module 407 adapted to read the data copied into the memory area accessible from the user space by the interception module 406 and analyze this data to determine whether or not it is characteristic of a cyber-attack or a failure. For this, the module 407 can implement a predictive analysis model such as an artificial neural network, a regression model, a classification model or even a decision tree. The analysis model can be trained beforehand from messages characteristic of cyber-attacks or failures and from messages characteristic of nominal operation.

[0055] According to a particular embodiment, the device 400 is integrated into a server of a communications network.

Claims

Claims

1. Method for intercepting, by an analysis module, a communication flow to an application executed in a container on a host environment comprising an operating system, the method comprising the following steps: - A configuration step during which a set of code instructions is associated with a particular execution point of a data transfer system call, - A step of executing said set of instructions in the kernel space of the operating system of the host environment when a data transfer system call is triggered from the at least one container reaches the execution point, the execution of said set of instructions comprising at least copying the contents of a memory area of the kernel space modified by the system call to a memory area of the user space.

2. Method according to claim 1 such that it further comprises a prior step of determining that a communications decryption function is performed by the kernel, the execution of the set of code instructions being conditioned on the result of said determining step, the modified kernel space memory area comprising data decrypted by the kernel.

3. Method according to any one of the preceding claims such that it further comprises a step of detecting an attack from the intercepted data.

4. A method according to any preceding claim wherein the configuring step comprises associating a first set of code instructions with a first point of execution in the kernel space of the operating system and a second set of code instructions with a second point of execution in the kernel space of the operating system, the first point of execution being an entry point of the system call and the second point of execution being an exit point of said system call, the first set of code instructions being configured to obtain an address of a buffer in the kernel space and store this address in a data structure stored in kernel space, the second set of instructions being configured to obtain the stored address and copy data from a location pointed to by said address to a buffer accessible from user space.

5. Device for intercepting a communication flow to an application executed in a container on a host environment comprising an operating system, the device comprising a processor coupled to a memory in which computer program instructions are recorded configured to implement the following steps: - A configuration step during which a set of code instructions is associated with a particular execution point of a data transfer system call, - A step of executing said set of instructions in the kernel space of the operating system of the host environment when a data transfer system call is triggered from the at least one container reaches the execution point,the execution of said set of instructions comprising at least the copying of the contents of a memory area of the kernel space modified by the system call to a memory area of the user space.,

6. Server comprising an interception device according to claim 5

7. J. Computer program comprising instructions adapted to implement the steps of a method according to any one of claims 1 to 4, when the program is executed by a processor.

8. A computer-readable information medium on which is recorded a computer program comprising instructions for carrying out the steps of an interception method according to any one of claims 1 to 4.

Images