Network Packet Source Identification via Signature Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network address translation obscures the original source address information of network packets, making it difficult to identify the source computer responsible for network exception events, as the information is not visible after translation.
Innovation Solution
An agent device stores original packet information before translation and a diagnostic device calculates packet signatures to determine the original source address by comparing this information with translated packet information, using a database join operation to identify the source computer.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network address translation is performed to protect original source address information, then security and privacy are improved, but the ability to identify the source computer for network exception events deteriorates
Solution Approach 1:
The patent applies preliminary action by capturing and storing the original source address information in a logging application before network address translation occurs. This pre-capture ensures that the original source identity is preserved in a database, allowing later correlation with translated packets through packet signatures without exposing the original addresses during normal translation operations.
Solution Approach 2:
The patent uses packet signatures as an intermediary mechanism to bridge the gap between translated packets and original source information. The signature, generated from the packet payload, serves as a mediator that links the translated packet in the network to the corresponding original source address stored in the logging application, enabling source identification without direct exposure of original addresses.
2Difficulty of detecting and measuring
If original packet information is stored before translation to enable source identification, then source detection capability is improved, but information security deteriorates
Solution Approach 1:
The patent extracts only the necessary identifying information (packet payload used for signature generation) while leaving the sensitive original source address information stored separately in the logging application. This extraction approach allows correlation capability without exposing the sensitive address information, as the signature alone cannot reveal the original source address without access to the logging database.
Solution Approach 2:
The patent creates a copy of the packet payload to generate a signature, rather than storing or transmitting the original packet or its headers. This copying mechanism preserves the ability to identify and correlate packets while minimizing the exposure of sensitive information, as only a hash or signature of the payload is retained for matching purposes.
3Measurement precision
If packet signatures are calculated and compared to determine original source address, then source identification accuracy is improved, but processing complexity increases
Solution Approach 1:
The patent transforms the packet identification problem from comparing entire packets or headers to comparing compact packet signatures. By changing the parameter from full packet comparison to signature-based matching, the system achieves high identification accuracy while reducing processing complexity, as signatures are much smaller and faster to compute and compare than complete packet data.
Data Source
AI summary
A system is configured to perform operations that include determining an exception event corresponding to a transmission of a plurality of network packets over an electronic network. The electronic network may cause network address translation to be performed on the plurality of network packets. The operations may also include identifying, based on a log of the plurality of network packets, a first network packet associated with the exception event and calculating, based on a payload portion of the first network packet, a packet signature corresponding to the first network packet. The operations may further include determining, based on a comparison between a first data structure and a second data structure using the packet signature, original source address information that corresponds to the first network packet prior to the network address translation being performed on the first network packet.