Client Device Verification Through DNS-Mapped Virtual IP Addresses
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network communication technologies fail to adequately protect the privacy of server-side addresses and verify the authenticity of client devices, making servers vulnerable to attacks and compromising user privacy.
Innovation Solution
Implement a virtual network service that maps server IP addresses to virtual IP (VIP) addresses, using DNS and Network Address Translation (NAT) to obfuscate server IP addresses and authenticate client devices by verifying the legitimacy of VIP address usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If destination IP addresses are used for routing decisions, then data packets can reach correct destinations, but server IP addresses become visible to malicious entities enabling direct attacks
Solution Approach 1:
The patent introduces a Virtual IP (VIP) address as an intermediary between the client device and the server's real IP address. The VIP address is used in packet headers for routing decisions, while the real server IP remains hidden. A network address translation mechanism translates the VIP address to the real server IP at the destination, allowing routing to work correctly while protecting the server IP from exposure to malicious entities.
2Ease of operation
If source IP addresses are used for firewall decisions, then packets can be filtered correctly, but client device IP addresses become visible enabling correlation attacks
Solution Approach 1:
The patent introduces a Virtual Source IP (VSIP) address as an intermediary that replaces the client's real IP address in packet headers. The VSIP is assigned by a virtual network service and allows firewall decisions to be made based on the virtual address rather than the real client IP. This prevents malicious entities from correlating traffic patterns to the actual client device while maintaining firewall functionality.
3Productivity
If real IP addresses are used for communication, then direct communication is enabled, but privacy protection is compromised
Solution Approach 1:
The patent employs VIP and VSIP addresses as intermediaries that enable direct communication between client devices and servers while protecting privacy. The virtual addresses are assigned by a virtual network service that maintains mappings between virtual and real addresses. This allows efficient direct communication through the virtual address space while the real IP addresses remain hidden, preventing privacy loss.
4Reliability
If VIP address verification is implemented, then malicious devices can be identified, but additional verification steps increase processing time
Solution Approach 1:
The patent implements preliminary verification by having the virtual network service pre-assign VIP addresses to authorized client devices and maintain a verification data structure with these assignments. When packets arrive, the system performs a lookup in the pre-built verification data structure rather than performing complex verification calculations in real-time. This preliminary preparation significantly reduces the time required for verification while maintaining high security.
Data Source
AI summary
Techniques for using Network Address Translation (NAT), Mobile Internet Protocol (MIP), and/or other techniques in conjunction with Domain Name System (DNS) to anonymize server-side addresses in data communications and verify an authenticity of a client device attempting to use a virtual IP (VIP) address. Rather than having DNS provide a client device with an IP address of an endpoint device, such as a server, the DNS instead returns a VIP address that is mapped to the client device and the endpoint device. The client device may then communicate data packets to the server using the VIP address as the destination address, and a virtual network service that works in conjunction with DNS can verify an authenticity of the client device and convert the VIP address to the actual IP address of the server using NAT and forward the data packet onto the server.