DNS-LISP Address Obfuscation for Hidden Server Routing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network communication technologies fail to adequately protect server-side addresses from being exposed and exploited by malicious entities, leading to vulnerabilities such as DDOS attacks and privacy breaches.
Innovation Solution
Implementing Locator ID Separation Protocol (LISP) in conjunction with DNS to obfuscate server-side addresses by mapping endpoint identifiers (EIDs) to routing locators (RLOCs), ensuring that client devices communicate using EIDs instead of actual IP addresses, and encapsulating packets with RLOCs for routing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If destination IP addresses are used for routing decisions, then data packets can reach correct destinations, but server addresses become visible to malicious entities enabling attacks
Solution Approach 1:
The patent segments the IP address structure into two distinct components: Endpoint Identifiers (EIDs) for identifying the server and Routing Locators (RLOCs) for routing. This segmentation allows the server address (EID) to be hidden from external entities while the routing information (RLOC) remains visible and functional for packet delivery.
Solution Approach 2:
The patent introduces a Locator/ID Separation Protocol (LISP) endpoint as an intermediary that performs address translation. This intermediary receives packets with EIDs, translates them to corresponding RLOCs, and forwards them to the appropriate server, thereby hiding the server's real address while maintaining routing functionality.
2Ease of operation
If client devices use actual IP addresses to communicate with servers, then direct communication is established, but privacy of client devices is compromised when malicious entities are close to the client device
Solution Approach 1:
The LISP endpoint acts as an intermediary that client devices interact with using EIDs instead of real IP addresses. This intermediary layer protects client device privacy by preventing direct correlation between client devices and servers, while still enabling straightforward communication through the EID-based addressing system.
3Productivity
If destination addresses are made visible for routing decisions, then network routing functions properly, but discrimination between legitimate traffic and attacks becomes difficult
Solution Approach 1:
By segmenting addresses into EIDs and RLOCs, the patent enables network infrastructure to route packets efficiently using RLOCs while security systems can analyze and discriminate traffic based on EIDs. This segmentation allows legitimate traffic and attacks to be distinguished since malicious entities cannot easily spoof EIDs without proper LISP endpoint authorization.
Data Source
AI summary
Techniques for using Locator ID Separation Protocol (LISP), Mobile Internet Protocol (MIP), and/or other techniques in conjunction with Domain Name System (DNS) to obfuscate server-side addresses in data communications. Rather than having DNS provide a client device with an IP address of an endpoint device, such as a server, the DNS instead returns an endpoint identifiers (EID) that is mapped to the client device and at least one routing locator (RLOC) of the endpoint device. In this way, IP addresses of servers are obfuscated by a network mapping of EIDs and RLOCs. The client device may then communicate data packets to the server using the EIDs as the destination address, and a virtual network service that works in conjunction with DNS can encapsulate the data packet with the RLOC using LISP and forward the data packet onto the server.