Network Address Mutation for Server Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network address mutation techniques expose server addresses to internal attackers and suffer from address collision and synchronization issues, failing to effectively increase the cost of reconnaissance for attackers and ensure secure communication.
Innovation Solution
A method and system for network address mutation that involves generating pseudonymous IP addresses and port numbers using a preset function, mapping these to a Media Access Control (MAC) address, and continuously modifying external addresses based on a preset rule, while maintaining secure communication through hidden interface configuration and session key authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network address mutation is performed using NAT by network equipment, then address modification is achieved, but the actual server address is exposed to inside attackers in the same subnetwork
Solution Approach 1:
The patent extracts the address mutation function from traditional NAT equipment and implements it directly within the server apparatus. This removes the vulnerability where NAT equipment would expose the server's actual address, as the mutation now occurs internally without external equipment having access to the real address information.
Solution Approach 2:
The patent introduces a pseudonymous address as an intermediary between the server's internal hidden address and external communication. This intermediary address changes according to mutation rules, preventing direct exposure of the actual server address while maintaining communication functionality.
2Reliability
If cryptographic algorithms are used for address generation, then address security is improved, but address collision and synchronization problems occur
Solution Approach 1:
The patent implements dynamic address mutation where the server address changes over time according to preset rules. This dynamic approach prevents address collision by ensuring addresses are not static, and the synchronization mechanism allows legitimate clients to track the changing address while attackers cannot predict it.
Solution Approach 2:
The patent employs a synchronization mechanism that provides feedback to legitimate clients about the current pseudonymous address. This feedback loop allows clients to update their address information without revealing the actual server address, resolving the collision problem by ensuring all legitimate parties have the current address information.
3Adaptability or versatility
If multiple IP addresses are applied for communication, then communication flexibility is increased, but address modification rules may be exposed leading to attack risks
Solution Approach 1:
The patent applies different properties to different address components: the hidden internal address remains constant and secret, while the external pseudonymous address changes according to mutation rules. This local differentiation allows communication flexibility through address changes while protecting the core server identity from exposure.
Data Source
AI summary
Disclosed herein are a server apparatus, a client apparatus, and a method for communication based on network address mutation. The method for communication based on network address mutation, performed by the server apparatus and the client apparatus, includes setting the external address of a network interface for receiving a packet from the client apparatus; setting the internal address of a hidden interface in order to forward the packet received through the network interface to the hidden interface; modifying the external address based on a preset network address mutation rule; and communicating with the client apparatus by forwarding the packet, received from the client apparatus based on the modified external address, to the hidden interface.