Method and device for detecting and identifying cryptographic algorithms in a communications network.

Abstract

The invention relates to a method for detecting a particular cryptographic algorithm used in a computer system, comprising steps of capturing data packets exchanged with a target machine to obtain initial measurements of time and data volume, calculating response times by measuring the time elapsed between sending and receiving the captured data packets, determining a first time signature indicative of a cryptographic algorithm used to generate the captured packets from the calculated response times and the data volumes exchanged, determining a level of correspondence between the first determined time signature and at least one second time signature determined beforehand for a particular cryptographic algorithm,and transmission of an alert comprising at least one identifier of a device at the origin and / or of a device receiving said network flow when the level of correspondence is greater than a threshold. Figure for the abstract: figure 2,

Description

Title of the invention: Method and device for detecting and identifying cryptographic algorithms in a communications network. Technical field

[0001] The invention belongs to the field of network and system security, and more specifically relates to a method for carrying out an inventory of cryptographic algorithms used in computer systems. State of the prior art

[0002] The progress made in the field of quantum computing is now posing a concrete challenge to the security devices of communication networks. Indeed, while quantum algorithms, such as Shor's, Grover's and Simon's algorithms, have until now made it possible to conceptually resolve certain computational problems on which widely deployed security mechanisms are based, the emergence of computers adapted to implement these algorithms makes this threat very concrete.

[0003] Indeed, while the best classical algorithms for solving these problems have exponential complexity in general, quantum algorithms can produce an answer in polynomial time.

[0004] Although a sufficiently large and reliable quantum computer is not yet available to potential hackers, encrypted streams captured today by an attacker could be decrypted by quantum algorithms later and reveal secrets that could still have value in the future. It is therefore imperative to implement so-called post-quantum security mechanisms today, which maintain a high level of security against a quantum computer.

[0005] Cryptographic techniques vulnerable to attacks based on quantum computers are widely deployed in networks and infrastructures in service today. It is therefore imperative to identify and update services that are likely to be affected today.

[0006] However, the extent of certain communication networks and the diversity of the services they support do not allow for a simple list of services likely to be affected to be established. This difficulty in establishing an exhaustive map of vulnerable services deployed in a network is all the more exacerbated when users are offered the possibility of installing applications themselves on their workstations and when these applications are subject to frequent updates. Thus, the security mechanisms used to protect services are likely to vary over time.

[0007] Thus, comprehensively identifying services vulnerable to quantum attacks is a difficult and time-consuming task, often time-consuming and error-prone, especially in complex environments with many interconnected systems.

[0008] There is therefore a need for a method for quickly and accurately identifying the cryptographic algorithms in use within digital infrastructures, in order to determine which ones are likely to be compromised by quantum attacks. Summary of the invention

[0009] For this purpose, a method is proposed for detecting by a probe a particular cryptographic algorithm used in a computer system. The method is remarkable in that it comprises the following steps: - Capture data packets exchanged with a target machine to obtain initial measurements of time and data volume, - Calculate response times by measuring the time elapsed between sending and receiving captured data packets, - Determine a first time signature indicative of a cryptographic algorithm used to generate the captured packets from the calculated response times and the volumes of data exchanged, - Determination of a level of correspondence between the first determined time signature and at least one second time signature determined beforehand for a particular cryptographic algorithm, and - Transmit an alert including at least one identifier of a device at the origin and / or a device receiving said network flow when the correspondence level is higher than a threshold.

[0010] In this way, the method makes it possible to distinguish different types of cryptographic algorithms at low cost, without it being necessary to decode the data streams, and to trigger an alert when the use of a particular cryptographic algorithm is detected in a communication with a target machine. Such a cryptographic algorithm is for example implemented to encrypt data, to exchange a key, to carry out authentication or even to guarantee the integrity of a data packet.

[0011] Here, the term "target machine" means any equipment suitable for receiving and / or sending data over a communications network. This may be a physical machine, such as a server, a personal computer, a mobile communications terminal, etc., or a virtual machine running in an environment virtualized.

[0012] The invention exploits a relationship between a cryptographic method used to process a data block of a certain size, and the processing time required by a particular machine to process such a data block according to this method. More generally, the method identifies a particular cryptographic algorithm by exploiting technical characteristics of algorithms such as symmetric or asymmetric encryption algorithms, MAC, signature, key exchange, etc. Indeed, a particular cryptographic system has a complexity of its own, so that the observation of the inputs / outputs of the system by time and data volume measurements form a particular time signature of the cryptographic system.This time signature can be compared to a set of signatures previously determined for a variety of cryptographic systems and target machines to identify the system in operation on the target machine.

[0013] It is thus possible to detect the implementation of algorithms likely to present a particular vulnerability, for example a vulnerability to attacks perpetrated by quantum computers, and trigger an alert if necessary.

[0014] By deploying one or more probes in a communication network, it is thus possible to draw up a dynamic inventory of the cryptographic systems at work in a communication network in order to improve its security.

[0015] According to a particular embodiment, the method further comprises a step of analyzing the volume measurements to determine whether the captured packets comprise data encrypted in a block or stream mode, based on the conformity of the total size of the data to multiples of standard block sizes, the calculation time being estimated using the determined encryption mode, the time measurements and the quantity of application data exchanged.

[0016] Such an arrangement makes it possible to determine a subset of algorithms that can be used. In this way, the number of candidate algorithms is limited and detection performance is improved.

[0017] According to a particular embodiment, the method is such that it comprises a step of applying a sequential distinguisher type algorithm to identify recurring patterns which correspond to a specific cryptographic algorithm for which such patterns are previously identified.

[0018] In other words, the method comprises a step of applying a statistical method which takes into account a plurality of time measurements and data volumes and during which recurring patterns are identified which correspond to a specific cryptographic algorithm for which such patterns are previously identified.

[0019] Such recurring patterns correspond to values ​​(execution time, pa- meters) which are representative of a cryptographic algorithm.

[0020] One way to identify a cryptographic algorithm (and distinguish it from other cryptographic algorithms) is to use a time reference (e.g., execution time of the algorithm in question) and compare it to the measurement made at the time of analysis. However, it is possible that the measurement made at the time of analysis is noisy due to other events (operations performed in parallel, network latency, etc.). Using a sequential distinguisher allows us to take into account the fact that the measurement may be noisy. The principle consists of making several time measurements. The comparison made does not concern a (discrete) reference value but an interval (set of continuous values). At the time of analysis, the time measurement made makes it possible to distinguish the algorithm executed depending on whether this measurement is greater than the upper limit of the interval or less than the lower limit of the interval.If the measurement belongs to the reference interval, the result is undecidable (i.e.: too noisy).

[0021] In some embodiments, the method comprises a step of applying a Kullback-Leibler divergence to compare a distribution of measured times with distributions determined beforehand for a plurality of reference algorithms.

[0022] In this way, the method allows the identification of a particular cryptographic system in an operational environment, where the measurements may be affected by disturbance factors such as network latency or concurrent processes on the target machine. The application of such statistical processing makes it possible to compensate for these disturbances and provide reliable results despite the unforeseen events inherent in any computer system in operation.

[0023] According to a particular embodiment, the method is such that the determination of a level of correspondence between the first and the second signature comprises the application of a learning model, previously trained from measurements of time and volume of data produced under conditions similar to those of the target machine, to determine a particular cryptographic algorithm from the measurements of time and volume of data exchanged by the target machine.

[0024] It is thus proposed to train a learning algorithm such as an artificial neural network, a decision tree, or a regression algorithm from measurements carried out beforehand with processing times measured for different known cryptographic systems on reference machines whose performances are also known. The times of reception and / or transmission of data packets (or times corresponding to system calls for reception and / or transmission of data on the machine cycle) and the associated data volumes (or data characteristic of this information, such as a time signature) are labeled with an identifier of the cryptographic system in operation and used to train the learning model so as to enable the identification of a cryptographic system from such measurements.

[0025] According to another aspect, the invention relates to a device for detecting a particular cryptographic algorithm comprising a processor coupled with a communication interface and a memory in which instructions configured to implement the following steps are recorded: - Capture data packets exchanged with a target machine to obtain initial measurements of time and data volume, - Calculate response times by measuring the time elapsed between sending and receiving captured data packets, - Determine a first time signature indicative of a cryptographic algorithm used to generate the captured packets from the calculated response times and the volumes of data exchanged, - Determination of a level of correspondence between the first determined time signature and at least one second time signature determined beforehand for a particular cryptographic algorithm, and - Transmit an alert including at least one identifier of a device at the origin and / or a device receiving said network flow when the correspondence level is higher than a threshold.

[0026] The invention also relates to a network probe comprising such a detection device, as well as a communication system comprising at least one target machine and such a probe.

[0027] In some embodiments of the communication system, the probe is placed at the last bounce before the target machine or at a hypervisor in the case of a software-defined network (SDN).

[0028] In a particular embodiment, the different steps of the detection method are determined by computer program instructions.

[0029] Consequently, the invention also relates to a computer program comprising instructions adapted to the implementation of the steps of a detection method as described above, when the program is executed by a processor.

[0030] This program may use any programming language, and be in the form of source code, object code, or code intermediate between source code and object code, such as in a partially compiled form, or in any other desirable form.

[0031] The invention also relates to a recording medium readable by a computer on which is recorded a computer program comprising instructions for executing the steps of a detection method as described above.

[0032] The information medium may be any entity or device capable of storing the program. For example, the medium may comprise a storage means, such as a ROM, for example a CD ROM or a microelectronic circuit ROM, a flash memory, or a magnetic recording means, such as a hard disk.

[0033] Furthermore, the information medium may be a transmissible medium such as an electrical or optical signal, which may be conveyed via an electrical or optical cable, by radio or by other means. The program according to the invention may in particular be downloaded from an Internet-type network.

[0034] Alternatively, the information carrier may be an integrated circuit in which the program is incorporated, the circuit being adapted to execute or to be used in the execution of the detection method.

[0035] The various embodiments or features mentioned above can be added independently or in combination with each other, to the steps of the detection method.

[0036] The systems, devices, probes and programs have advantages similar to those of the detection method. Brief description of the figures

[0037] Other characteristics and advantages will appear on reading a preferred embodiment described with reference to the appended drawings among which: - [Fig.l] represents an example of a communication network, - [Fig.2] is a flowchart illustrating the main steps of a detection method according to a particular embodiment, - [Fig.3] shows a timeline of messages received and sent by a target machine in a communications network, and - [Fig.4] is a block diagram illustrating the architecture of a device suitable for implementing a detection method according to a particular embodiment. Detailed description

[0038] [Fig. 1] represents in a simplified manner a communication network RI comprising equipment E1 to E4. The network RI is for example a local area network (LAN) comprising servers and / or user workstations E1 to E4. Of course, the invention which will be described can be applied to any type of network and the example of [Fig. 1] is given only for illustrative purposes. For example, the network RI can comprise other equipment not shown, such as routers or gateways. The network RI can be a physical network or a virtual network without limiting the invention.

[0039] The RI network also comprises a probe S adapted to monitor and / or capture the traffic circulating on the network, and in particular the messages sent and / or received by the different devices. Although this is not shown in [Fig.l] to simplify the description which follows, the RI network may comprise a plurality of probes S in order to monitor different branches of the network.

[0040] Thus, when a message is for example sent by the equipment E1 to the equipment E4, the probe S can detect and capture a data packet in which the message is transmitted and obtain a copy thereof. The probe S can be adapted to thus capture data flows at different levels, for example on the physical layer, the data link layer, the transport layer or even at the application level.

[0041] The probe S is for example a computing device such as a server comprising a processor, a memory and a network interface (for example an Ethernet or WiFi® interface). The memory of the device comprises program instructions configured to control the network interface in order to capture and decode the data packets.

[0042] The probe S is adapted to implement a detection method according to a particular embodiment.

[0043] The probe S is preferably deployed at a location close to the target machine, for example on the last router before the target machine or directly on the host, for example as a monitoring process, or at a hypervisor in the case of a software-defined network (SDN).

[0044] The probe S is thus configured to capture application data packets exchanged with the target machine, without requiring access to the encrypted content of the packets.

[0045] During a first step 200, the probe monitors the traffic to and from the equipment E4. The probe S monitors the traffic using at least one network interface, physical or virtual, allowing the probe to obtain a copy of the packets exchanged by the equipment E4. The probe S captures in particular packets from encrypted communication flows. The probe identifies, for example, the encrypted flows to or from the equipment E4 from an address included in a header of a data packet. Symmetric algorithms are used to protect the application data. These are exchanged (in both directions of communication) in relatively large quantities. The probe uses this profusion of application data to obtain a sample of measurements.Most of the time, the same algorithm is used in both directions of a communication, so the probe can exploit measurements made on both incoming and outgoing traffic.

[0046] [Fig.3] represents messages M1 to M5 received or sent by the target machine E4. Thus, the probe S records at least the arrival time tl of a first application packet Ml and the transmission time t2 of a first packet M3 transmitted in response to the packet Ml. These measurements make it possible to determine a response time t_rcv = t2 - tl.

[0047] The probe also calculates the volume of data n_rcv received by the target machine E4 in the interval [tl -12[. Thus, with reference to [Fig.3], n_rcv = size(Ml) + size(M2).

[0048] In a particular embodiment, the probe S performs measurements of arrival time t_snd and data volume n_snd of the packets transmitted by the target machine. More precisely, the probe S determines a response time t_snd from the transmission time t2 of a packet M3 and the reception time t3 of a response message M5, as well as the data volume n_snd transmitted in the interval [t2-t3[.

[0049] In a particular embodiment, the probe S analyzes the total size of the data packets exchanged during a step 201, and compares this total size with multiple values ​​of standard block sizes (for example, 64, 128, 256 bits) in order to determine a block encryption mode if the size is actually a multiple of the standard block size, or a stream encryption mode if this is not the case. Indeed, block encryption algorithms use block sizes which are powers of 2, whereas in the case of a stream encryption mode, the size of the transmitted data can take any value.

[0050] In step 202, the probe estimates a processing time (t_cmp) for processing a certain amount of data. In some embodiments, the amount of data for which the probe estimates a processing time may depend on the block or stream encryption mode, so that the probe determines a processing time per bit or per block. The estimated processing time (encryption, decryption or integrity check) of a block of data of a particular size includes the processing time dedicated to the cryptographic algorithm used to encrypt or decrypt the data. Thus, the processing time t_cmp is a time signature of the cryptographic algorithm used, in the sense that in an identical operational context (network load, type of communication, type of machine, etc.), the use of a different cryptographic algorithm would have led to a different t_cmp estimate.

[0051] In step 203, the estimated processing time t_cmp is compared with a plurality of reference values ​​(t_refl, t_ref2,..., t_refn) obtained in the laboratory for different known algorithms (algl, alg2,..., algn) under conditions similar to those of the target machine. A correspondence between the estimated processing time for the target machine and a reference processing time obtained beforehand for a known algorithm makes it possible to identify the algorithm associated with the estimate t_cmp.

[0052] In the case of application data protected only in integrity, n_rcv, n_snd (including the size of the integrity tag), t_rcv, t_snd are used to determine the integrity algorithm implemented. These measures make it possible, for example, to differentiate a CMAC (Cipher-based Message Authentication Code) authentication mode, with a block cipher like AES, from an HMAC (Hash-based Message Authentication Code) function based on a hash function like SHA2. The duration of the calculation leading to the integrity tag depends on the size of the clear data to be protected. These measures also make it possible to differentiate between public key algorithms. However, in the case of public key algorithms, the amount of usable data obtained during a given execution of the communication protocol is less important. It may therefore be necessary to rely on a set of data collected during several executions of the communication protocol.Indeed, when implementing a secure communication protocol, asymmetric algorithms are used only during a preliminary phase (i.e.: before any sending of application data).

[0053] The comparison step makes it possible to obtain a level of correspondence between the time signature determined from the measurements made by the probe and a reference time signature, obtained beforehand by measurements made in the laboratory with a known algorithm. When the correspondence is significant, that is to say when the level of correspondence is greater than a particular threshold, the cryptographic algorithm used can be identified.

[0054] In certain particular embodiments, the comparison comprises the application of a predictive model to characteristics of the traffic to and / or from the target machine. Such a predictive model is for example trained from measurements of time and volume of data produced under conditions similar to those of the target machine, to which an identifier of the cryptographic algorithm in use is associated. It is possible to envisage the use of a “random forest” type algorithm, regression models, artificial neural networks, etc. Once trained, the probe can present measurements of time and volumes of data to obtain a probability that a particular algorithm is used by the target machine.

[0055] In a particular embodiment, statistical techniques are applied during a step 204 to take into account and / or mitigate the effect of variations and disturbances linked to the operational context on the time measurements.

[0056] Indeed, the measurement of the quantity and size of the application data (n_rcv, n_snd) can be done relatively precisely. On the other hand, the time measurements associated with the application data (t_rcv, t_snd) can be disturbed by phenomena internal to the target machine (concurrent processes) or external (network latency). Consequently, statistical techniques are implemented in order to correctly determine the symmetric algorithm. The statistical method(s) chosen are applied when comparing t_cmp and each of the reference values ​​t_refl, t_ref2, t_refn.

[0057] For example, the probe may use the sequential distinguisher method proposed by Junod (“On the Optimality of Linear, Differential and Sequential Distin-guishers.”, Advances in Cryptology EUROCRYPT'03, Warsaw, Poland, Lectures Notes in Computer Science 2656, pp. 17-32, Springer-Verlag, 2003) to sequence measurements and identify recurring patterns that correspond to a specific algorithm and / or, in case of perturbed time measurements, apply the Kullback-Leibler divergence to compare the distribution of measured times with the expected distributions for each reference algorithm. The method thus uses a plurality of time measurements and data volumes to identify recurring patterns. Such patterns are previously identified from the same statistical method for different predefined cryptographic algorithms executed on a reference machine for data blocks of predefined size.

[0058] The principle of the "sequential distinguisher" is to carry out a sampling of measurements sequentially. For each measurement collected, it is evaluated whether a decision can be made (e.g.: the executed algorithm corresponds to algorithm X or does not correspond to algorithm Y). If the number of measurements is sufficient to make a decision, the collection is stopped (and a decision is made). More precisely, considering a probability of success (for the identification of the cryptographic algorithm) fixed at a given value, the goal is to minimize the number of measurements necessary for the identification of the algorithm. This therefore makes it possible to collect (on average) only the necessary number of measurements in order to identify the algorithm. This sequential procedure ultimately results in a more economical method in terms of measurements to be carried out and collected.

[0059] In step 205, based on the comparison, the probe identifies the most likely cryptographic algorithm used by the target machine and when the identified algorithm corresponds to a particular algorithm, for example an algorithm presenting a vulnerability, it transmits an alert indicating that the target machine uses the algorithm in question. Such an alert makes it possible to constitute a dynamic inventory of the cryptographic techniques implemented in a computer system or a communication network.

[0060] The alert may be transmitted in a message and / or recorded in a database. Such an alert comprises at least one identifier of a source device and / or a recipient device of the message from which a particular cryptographic algorithm has been identified, for example an IP address, a UDP or TCP port, a machine name, etc. The alert may further comprise data making it possible to identify a protocol and / or a standard, or an application involved. in the transmission of the message or message flow that triggered the alert.

[0061] In a particular embodiment, the triggering of the alert causes a reconfiguration of a filtering device, for example upon detection of a data flow associated with a cryptographic function deemed vulnerable, the alert can cause the isolation of the target machine and / or the machine at the origin of the data flow by configuring rules of a firewall or a routing table.

[0062] [Fig.4] represents a simplified architecture of a device 400 adapted to implement the detection method according to a particular embodiment.

[0063] The device 400 comprises a data processing module comprising a storage space 401, for example a memory (MEM), a processing unit 402, equipped for example with a microprocessor (PROC), and controlled by a computer program (PGR) 403 whose instructions are configured to implement the detection method as described previously in relation to [Fig.2].

[0064] At initialization, the code instructions of the computer program 403 are for example loaded into the memory 401 before being executed by the processor of the processing unit 402. The microprocessor of the processing unit 402 implements, according to the instructions of the computer program 403, the steps of the detection method described above with reference to [Fig.2].

[0065] For this, in addition to the memory and the processor, the device 400 comprises communication means 404, for example an Ethernet network interface, adapted to capture data packets coming from and going to a particular target machine and to determine transmission and / or reception times for the data packets, as well as associated data volumes, and to calculate response times from the time elapsed between the sending and reception of captured application data packets.

[0066] The device 400 further comprises a module 405 for determining a time signature characteristic of a cryptographic algorithm implemented by the target machine from an estimate of the processing time of one or more data packets. The module 405 is for example implemented by computer program instructions configured to estimate a response time between the reception of an encrypted data packet and the transmission of a response to this packet by the target machine and to determine a time signature from the estimated response time.

[0067] The device 400 also comprises a module 406 for comparing the time signature estimated by the module 405 with time signatures previously calculated in a controlled environment for a variety of cryptographic algorithms. The module 406 is for example implemented by program instructions configured to determine a level of correspondence between the estimated time signature and the predetermined time signatures, and compare this level to a predetermined threshold.

[0068] The device 400 also comprises an alert module 407, configured to transmit an alert when the correspondence level estimated by the module 406 is greater than a threshold. The alert module is for example implemented by program instructions configured to identify the target machine and / or a service sending and / or receiving a message from which the characteristic time signature has been determined.

[0069] In a particular embodiment, the device 400 is included in a network node, for example in a probe, a gateway or a server, or even in a hypervisor of a virtualized environment.

Claims

Claims

1. A method of detecting by a probe a particular cryptographic algorithm used in a computer system, the method comprising the following steps: - Capturing (200) data packets exchanged with a target machine to obtain initial measurements of time and data volume and calculating response times from the time elapsed between sending and receiving the captured data packets, - Determining (202) a first time signature indicative of a cryptographic algorithm used to generate the captured packets from the calculated response times and the data volumes exchanged, - Determining (203) a level of correspondence between the first determined time signature and at least one second time signature determined beforehand for a particular cryptographic algorithm,and - Transmit (205) an alert comprising at least one identifier of a device at the origin and / or of a device receiving said network flow when the level of correspondence is greater than a threshold.,

2. The method of claim 1, further comprising a step of analyzing the volume measurements to determine whether the data is generated with a symmetric algorithm in a block or stream mode or with a public key algorithm, based on the conformity of the total size of the data to multiples of standard block sizes, the computation time being estimated using the determined generation mode, the time measurements and the quantity of application data exchanged.

3. Method according to any one of the preceding claims such that it comprises a step of applying a sequential distinguisher type algorithm to identify recurring patterns which correspond to a specific cryptographic algorithm for which such patterns are previously identified.

4. A method according to any preceding claim as claimed in includes a step of applying a Kullback-Leibler divergence to compare a distribution of measured times with distributions determined beforehand for a plurality of reference algorithms.

5. A method according to any preceding claim wherein determining a level of correspondence between the first and second signatures comprises applying a learning model, previously trained from measurements of time and volume of data produced under conditions similar to those of the target machine, to determine a particular cryptographic algorithm from the measurements of time and volume of data exchanged by the target machine.

6. A device for detecting a particular cryptographic algorithm used in a computer system, the device comprising a processor coupled with a communication interface and a memory in which are stored instructions configured to implement the following steps: - Capturing data packets exchanged with a target machine to obtain initial measurements of time and data volume, - Calculating response times by measuring the time elapsed between sending and receiving the captured data packets, - Determining a first time signature indicative of a cryptographic algorithm used to generate the captured packets from the calculated response times and the data volumes exchanged,- Determining a level of correspondence between the first determined time signature and at least one second time signature determined beforehand for a particular cryptographic algorithm, and - Transmitting an alert comprising at least one identifier of a device at the origin and / or of a device receiving said network flow when the level of correspondence is greater than a threshold.,

7. A network probe comprising a detection device according to claim 6.

8. Communication system comprising at least one target machine and a probe according to claim 7.

9. A communication system according to claim 8 wherein the probe is placed at the last bounce before the target machine or at a hypervisor in the case of a software-defined network.

10. A computer program comprising instructions configured to implement the steps of a detection method according to any one of claims 1 to 5, when executed by a processor.

11. A processor-readable storage medium in which program instructions configured to implement the steps of a detection method according to any one of claims 1 to 5 are recorded.

Images