Private Network Address Obfuscation for DoS Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data centers face challenges in protecting their private network addresses from detection by external entities, making them vulnerable to denial of service (DoS) attacks and network scans, especially when using stateless border devices that do not track active connections.
Innovation Solution
Implementing private network address obfuscation and verification methods in border devices, where IPv4 addresses are embedded in the lower portion of IPv6 addresses and obfuscated using hash functions and invertible obfuscation algorithms, making it difficult for attackers to detect the private network addresses on public networks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If private network addresses are directly exposed on public networks for routing purposes, then network connectivity and routing functionality are improved, but network security deteriorates due to vulnerability to DoS attacks and network scans
Solution Approach 1:
The patent introduces an intermediary obfuscation layer between the private IPv4 address space and the public IPv6 network. Border devices perform address obfuscation by embedding IPv4 addresses within IPv6 address fields and applying cryptographic hashing, creating a mediating representation that enables routing while protecting the original address space from direct exposure to external threats.
Solution Approach 2:
The patent transforms the network address parameter from its original IPv4 format to an obfuscated IPv6 representation. This parameter change involves embedding the IPv4 address within an IPv6 address structure and applying hash functions, fundamentally altering how addresses are represented and processed while maintaining routing capability.
2Object-affected harmful factors
If border devices implement stateful connection tracking to enhance security, then network security is improved, but device complexity and processing overhead increase
Solution Approach 1:
The patent extracts the security verification function from stateful connection tracking and implements it through stateless hash verification. By removing the need to maintain connection state information and instead using cryptographic hash functions embedded in packet headers, the system achieves security without the complexity of stateful tracking mechanisms.
Solution Approach 2:
The obfuscated address fields themselves carry the verification information needed for security checks. The hash of the obfuscated address is embedded within the packet header, allowing border devices to verify packet legitimacy through simple hash comparison without needing to track connection states or maintain complex security policies.
3Object-affected harmful factors
If private network addresses are obfuscated to enhance security, then network security is improved, but address verification and packet routing difficulty increase
Solution Approach 1:
The patent performs preliminary obfuscation and hash computation at the source border device before packets enter the public network. The obfuscated address and its hash are pre-computed and embedded in the packet header, so that verification at the destination border device becomes a simple hash comparison operation rather than requiring complex reverse-engineering of the obfuscation.
Data Source
AI summary
Private network address obfuscation and verification methods and apparatus that may obfuscate private network source addresses embedded in packet header addresses when sending packets from private networks onto or over external, public networks, and that verify incoming packets to the private networks using the obfuscated private network addresses embedded in the incoming packet header destination addresses. Obfuscating the private network addresses embedded in outgoing packets and verifying incoming packets according to the obfuscated content embedded in the destination addresses may help keep the private network addresses of endpoints on the private network hidden in the packet header content on public networks and difficult to detect by entities on the public networks, which may, for example, make malicious activities such as denial of service (DoS) attacks on the private network impractical.