Gateway Destination Address Rewriting for Network Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security measures are inadequate in blocking peer-to-peer (P2P) applications and other malicious communications that bypass name resolution lookups, leading to unauthorized data exfiltration and malware infiltration, as they often cache results for long periods, making it difficult to distinguish between legitimate and unauthorized applications.
Innovation Solution
Implementing a gateway system that rewrites destination and source addresses of network traffic, using a mapping between internal and external addresses, and enforcing DNS lookups within the protected network to prevent unauthorized communications without requiring deep packet inspection or man-in-the-middle solutions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If firewalls are used to block unauthorized communications, then network security is improved, but P2P and malicious applications can still bypass them by masking traffic and changing addresses
Solution Approach 1:
The patent introduces a gateway as an intermediary device between the protected network and external networks. This gateway performs destination address rewriting on outbound packets and source address rewriting on inbound packets, acting as a mediator that prevents P2P and malicious applications from directly communicating while maintaining legitimate network operations. The gateway sits in the communication path and rewrites addresses to block unauthorized communications without interfering with authorized traffic.
2Reliability
If deep packet inspection or man-in-the-middle solutions are implemented, then unauthorized communications can be blocked, but device complexity and operational difficulty increase
Solution Approach 1:
The patent changes the address parameters in network packets rather than inspecting packet contents. By rewriting destination addresses in outbound packets and source addresses in inbound packets, the gateway blocks unauthorized communications at the network layer without requiring deep packet inspection. This parameter-based approach simplifies the gateway's functionality compared to content-based inspection methods.
3Object-affected harmful factors
If address rewriting is performed on all traffic, then unauthorized P2P communications are blocked, but legitimate traffic may be interfered with if not properly managed
Solution Approach 1:
The patent implements a mapping table that tracks the relationship between original addresses and rewritten addresses. The gateway uses this mapping table to ensure that rewritten addresses in outbound packets correspond to valid internal destinations, and that inbound packets with rewritten source addresses are properly routed to the correct internal devices. This feedback mechanism through address mapping ensures that legitimate traffic flows correctly while blocking unauthorized communications.
Data Source
AI summary
Systems and methods for protecting a network including preventing data traffic from exiting the network unless a domain name request has been performed by a device attempting to transmit the data traffic. In an embodiment, a device within the protected network attempting to send data outside the protected network requests an address for a destination outside the protected network from a domain name server (DNS). In response, the DNS provides an address of the destination to the device and a gateway. In response to receiving the address, the gateway temporarily allows access to the address. In an embodiment, a DNS is coupled to a protected network and the gateway, the DNS provides an external address to a device in response to a request; and a mapping to the gateway; the gateway, coupled to a protected network and an external network, allows traffic according to the mapping.