A Recursive Session Token Protocol For Use in Computer Forensics and TCP Traceback Brian Carrier Clay Shields Center for Education and Research in Department of Computer Science Information Assurance and Security (CERIAS) Georgetown University Purdue University Washington, D.C., 20007 West Lafayette, IN 47907
[email protected] [email protected] C C 0 1 C n−1 We present the Session TOken Protocol (STOP) [5], which H H H H H 0 1 2 n−1 n is based on the ident protocol, and helps forensic investiga- tion of stepping-stone chains while protecting the privacy of H H Fig. 1. Connection chain example between 0 and n users. STOP saves application-level data about the process and user that opened the socket, and can also send requests to pre- vious hosts to identify other hosts in the chain. At each stage, Abstract— We introduce a new protocol designed to assist in the forensic a hashed token is returned; at no point in the protocol does the investigation of malicious network-based activity, specifically ad- requester ever directly learn user or process data. Instead, they dressing the stepping-stone scenario in which an attacker uses a must redeem the token to the system administrator who can de- chain of connections through many hosts to hide his or her iden- termine the merit of releasing user information. Random ses- tity. Our protocol, the Session TOken Protocol (STOP), enhances sion IDs in the requests allow cycle detection. Additionally, the Identification Protocol (ident) infrastructure by sending re- cursive requests to previous hosts on the connection chain.