Message Mutation for Protocol Vulnerability Testing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for analyzing the security of communication protocols require complete re-implementation of endpoints, which is time-consuming and inefficient, especially when testing for vulnerabilities in protocol implementations by sending improper messages.
Innovation Solution
A system comprising a source endpoint, a destination endpoint, and a message generator that intercepts and modifies messages to send improper replacement messages to the destination endpoint, utilizing a structure recognition system and a mutation system to analyze the protocol implementation without re-implementing the endpoint.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the endpoint is completely re-implemented to send improper messages for security analysis, then the ability to test protocol vulnerabilities is improved, but the time required for prototyping and testing increases significantly
Solution Approach 1:
The patent creates a copy of the original endpoint's message transmission capability through a message generator that uses structure recognition to understand the protocol format. Instead of re-implementing the entire endpoint, the system generates copies of legitimate messages with modified structures to test vulnerability, thereby avoiding the time-consuming complete re-implementation while maintaining testing effectiveness
Solution Approach 2:
The patent introduces a message generator as an intermediary component between the original endpoint and the device under analysis. This intermediary intercepts legitimate messages, modifies their structure according to protocol definitions, and generates improper test messages without requiring complete endpoint re-implementation, thus resolving the contradiction between testing capability and development time
2Device complexity
If a passive intrusion detection system is used to detect attacks, then the system complexity is reduced, but the ability to proactively identify vulnerabilities before deployment is lost
Solution Approach 1:
The patent implements preliminary action by generating and sending improper test messages before the device under analysis is deployed to customers. The message generator proactively creates malformed messages based on protocol structure definitions and sends them to identify vulnerabilities in advance, enabling security issues to be discovered and fixed before real-world deployment rather than waiting for actual attacks
Data Source
AI summary
A system is used to analyze the implementation of a protocol by a device-under-analysis (DUA). The system includes a source endpoint, a destination endpoint (the DUA), and a message generator. The source endpoint generates an original message and attempts to send it to the DUA. The original message is intercepted by the message generator, which generates a replacement message. The replacement message is then sent to the DUA instead of the original message. The replacement message is deliberately improper so as to analyze the DUA's implementation of the protocol. The message generator includes a structure recognition system and a mutation system. The structure recognition system determines the underlying structure and/or semantics of a message. After the structure recognition system has determined the structure, it creates a description of the structure (a structure description). The mutation system modifies the message based on the structure description to generate a replacement message.