Ephemeral Overlay Address Translation for Source IP Privacy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network architectures fail to adequately protect the privacy of Internet Protocol (IP) addresses, as they can be correlated to a device or user, exposing Personally Identifiable Information (PII) and facilitating fraudulent activities.
Innovation Solution
Implementing a mechanism that dynamically allocates ephemeral overlay addresses per IP flow, which are visible but cannot be correlated to the source device identity, using a binding database to manage these addresses and intercepting packets to translate stable overlay addresses to ephemeral ones, ensuring privacy without requiring client device participation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If standard IP addressing is used for network communication, then network connectivity and routing are enabled, but source IP addresses can be correlated to specific devices and users, exposing PII and enabling fraudulent activities
Solution Approach 1:
The patent introduces an intermediary system consisting of a binding database and translation mechanism that sits between the client device and the network. The binding database stores mappings between stable overlay addresses (identifying devices) and ephemeral addresses (used for communication). When packets traverse the network, the translation mechanism automatically substitutes ephemeral addresses for stable ones, preventing correlation while maintaining seamless connectivity. This intermediary layer protects privacy without requiring changes to client devices or complex user actions.
2Object-affected harmful factors
If ephemeral overlay addresses are dynamically allocated per IP flow, then source IP privacy is protected by preventing correlation to device identity, but system complexity increases due to address translation mechanisms
Solution Approach 1:
The patent extracts the complexity of address management and translation from the client devices and places it entirely in the network infrastructure. The binding database and translation mechanisms are implemented solely in the network core, while client devices continue to use standard IP addressing without any modifications. This extraction concentrates the complexity in a centralized, manageable location while keeping end systems simple.
Solution Approach 2:
The system creates ephemeral overlay addresses as functional copies of stable overlay addresses. These ephemeral addresses replicate the routing and identification functions needed for network communication but are designed to be non-correlatable to specific devices. The binding database maintains the correspondence between original and copied addresses, enabling automatic translation without complex logic at the network edge.
3Speed
If IP addresses are kept visible for routing purposes, then network routing and delivery function correctly, but malicious observers can correlate IP flows to specific persons and devices
Solution Approach 1:
The patent applies different quality characteristics to different parts of the addressing system. Stable overlay addresses maintain permanent, consistent quality for routing efficiency and device identification. Ephemeral overlay addresses have transient, changing quality for privacy protection. The binding database manages the local characteristics of each address type, allowing packets to be routed efficiently using stable addresses while observers only see ephemeral addresses that provide no correlation information.
Data Source
AI summary
Techniques for protecting source IPs in a network fabric are described. A binding database may receive an indication of an overlay address-to-underlay address binding for a client device connected to the network fabric. The indication is received in a secure message from a fabric edge node through which the client device is connected. The overlay address-to-underlay address binding indicates a first overlay address and an underlay address associated with the fabric edge node. One or more additional overlay addresses are allocated and associated with the overlay address-to-underlay address binding. Each of the one or more additional overlay addresses is mapped to the first overlay address, A second overlay address is assigned, from the one or more additional overlay addresses, to the client device for an IP flow. The fabric edge node intercepts packet of the IP flow and translates a source IP from the first to the second overlay address.