Network Scanner Obfuscation with Tarpitting and Authorized Port Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malicious actors can exploit vulnerabilities in private networks by performing reconnaissance scans to identify access points, and existing security systems are ineffective in thwarting such scans while allowing authorized scans to function.
Innovation Solution
Implement a network defense mechanism using tarpitting, port spoofing, and port shrouding to obfuscate scan results for malicious actors while enabling authorized scan engines to access designated ports for vulnerability assessment using a software agent and elliptic curve asymmetric encryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the asset provides accurate port information to scanners, then authorized scan engines can efficiently identify vulnerabilities, but malicious actors can easily obtain network vulnerability information for attacks
Solution Approach 1:
The system applies different quality characteristics to different scanning scenarios: for authorized scan engines, the asset provides accurate port information and full cooperation; for unauthorized malicious scanners, the asset provides obfuscated fake port information. This local differentiation resolves the contradiction by tailoring the information quality to the identity and authorization status of the scanner.
Solution Approach 2:
The system introduces an intermediary authentication mechanism that verifies the identity of scanners before determining what port information to provide. This intermediary layer enables the asset to distinguish between authorized and unauthorized scanners, allowing it to provide accurate information to legitimate scan engines while misleading malicious actors.
2Loss of time
If the asset delays responses to scanner requests, then malicious scans are significantly slowed down, but legitimate scan operations may also be impacted
Solution Approach 1:
The system applies different response timing characteristics to different scanners: authorized scan engines receive immediate responses and full cooperation, while unauthorized malicious scanners experience deliberate delays and obfuscated information. This local differentiation ensures that productivity loss only affects legitimate operations minimally while maximizing time loss for malicious activities.
Solution Approach 2:
The system prepares authentication verification in advance to quickly identify authorized scanners before processing their requests. This preliminary anti-action ensures that legitimate scan operations are not delayed, while unauthorized scanners face the full brunt of response delays and obfuscation.
3Object-affected harmful factors
If the asset provides obfuscated fake port information, then malicious actors cannot determine real vulnerabilities, but authorized scan engines need accurate information to function
Solution Approach 1:
The system provides different information quality to different scanners: authorized scan engines receive accurate port information and full cooperation, while unauthorized malicious scanners receive obfuscated fake information. This local quality differentiation resolves the contradiction by making information accuracy contingent on scanner authorization status.
Solution Approach 2:
Instead of providing accurate information to all scanners and filtering later, the system inverts the approach by providing obfuscated information to all scanners and then selectively correcting or enabling full access only for authorized scan engines through authentication. This inversion efficiently protects against malicious actors while maintaining productivity for legitimate operations.
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
The mechanism significantly delays and misleads malicious scans while allowing legitimate scan engines to efficiently identify network vulnerabilities, thereby enhancing network security.
Implementation Method 1
creating a trusted secure channel with the scan engine using elliptic curve asymmetric encryption (ECDSA) and advanced encryption standard (AES)
Implementation Method 2
creating a trusted secure channel with the scan engine using elliptic curve asymmetric encryption (ECDSA) and advanced encryption standard (AES)
Data Source
AI summary
As an example, an asset receives a request from a scanner performing a reconnaissance of a network that includes the asset. The asset sends a response acknowledging receiving the request, indicating that the asset is alive. The asset receives port scan requests associated with ports of the asset. The asset creates fake fingerprints that include incorrect information about ports of the asset. The asset sends the fake fingerprints to the scanner in response to the port scan requests. The asset determines that a scan engine is requesting access to the asset via a particular port of the asset. The asset grants the scan engine access to the asset via the particular port to enable the scan engine to gather asset data associated with the asset for analysis.