Network Topology Obfuscation via Virtual Nodes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network topology obfuscation solutions are inadequate in concealing network topology from adversaries, as they fail to equalize tracing flow distributions, are deterministic, and do not maintain utility for debugging, leading to vulnerabilities in defending against Link Flooding Attacks (LFAs).
Innovation Solution
A method and system that introduces virtual nodes and links to equalize tracing flow distributions, using a non-deterministic algorithm to select IP addresses randomly within subnets, continuously monitoring and dynamically re-obfuscating to maintain security and utility, while preserving the functionality of path tracing tools.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If existing path-tracing tools are used to reveal network topology, then topology information becomes available for debugging, but adversaries can use this information to perform more efficient Link Flooding Attacks
Solution Approach 1:
The patent creates virtual nodes and virtual links that replicate the structure of real network elements. These virtual components are used to generate tracing responses that mimic real topology information, allowing adversaries to observe virtual paths while the actual topology remains concealed. The virtual topology serves as a copy that provides useful tracing data without exposing the real network structure to attackers.
Solution Approach 2:
The patent introduces virtual nodes as intermediary elements between real network nodes and tracing requests. When a tracing request passes through a real node, the virtual node intercepts and modifies the request, generating a response that appears to come from the virtual topology rather than revealing the actual path. This intermediary layer filters out sensitive topology information while maintaining the utility of tracing for debugging purposes.
2Object-affected harmful factors
If virtual topologies are generated to conceal bottleneck links, then security against LFAs improves, but the utility of path tracing information for network debugging decreases
Solution Approach 1:
The patent applies different levels of obfuscation to different parts of the network topology. Critical bottleneck links are concealed through virtual topologies, while non-critical paths maintain their tracing utility. The virtual nodes are strategically placed only where needed to protect against LFAs, allowing path tracing to remain effective for debugging in other areas of the network. This localized approach preserves debugging utility while providing security where most needed.
3Stability of the object's composition
If deterministic virtual topology generation is used, then reproducibility is improved, but adversaries can infer real topology structure more easily
Solution Approach 1:
The patent introduces asymmetry into the virtual topology generation process by randomly selecting which real nodes become virtual nodes and randomly assigning virtual node identifiers. This asymmetric randomization ensures that the same real topology can produce different virtual topologies on different executions, making it difficult for adversaries to infer the real structure from observed virtual paths. The asymmetry breaks any predictable patterns that could be exploited for topology inference.
4Object-affected harmful factors
If all real nodes are made virtual to maximize obfuscation, then security against topology inference improves, but network complexity and overhead increase
Solution Approach 1:
The patent applies partial obfuscation by making only a subset of real nodes virtual rather than all nodes. The virtual nodes are selectively created based on their importance and the level of protection needed. This partial action approach provides sufficient security against topology inference attacks while minimizing the overhead and complexity introduced by virtual nodes. The system achieves adequate protection without the full cost of virtualizing every network element.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method and system of network topology obfuscation comprising: - a topology analyser (110) which obtains an adversary's view of the network topology and the tracing flow distribution, from an input (100) consisting of a physical topology provided by a network operator (10), a forwarding behaviour of the network topology and tracing flows of the adversary; - a topology obfuscator (120) which generates a virtual topology to equalize the tracing flow distribution creating virtual nodes based on the topology leakage; - a topology deployer (130) configured to deploy the generated virtual topology, into real nodes and links of the network using software-defined networking, SDN, and to continuously monitor all tracing flows incoming in the network, wherein, to keep the current topology leakage equal or below a threshold value input by the network operator (10), the virtual topology is re-adjusted to reduce the current leakage if exceeding the threshold value is detected.