Public-to-Private Network Identifier Mapping via Server Log Beacons
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity solutions fail to directly associate vulnerabilities with specific entities within a network using public IP addresses, leaving systems vulnerable.
Innovation Solution
A system and method for mapping public network identifiers to private network identifiers by generating and matching beacons in server logs, allowing direct association of vulnerabilities with private identifiers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If public IP addresses are used to identify systems in cybersecurity solutions, then network tracking and vulnerability detection are enabled, but direct association with specific entities (servers or applications) is not achieved, leaving systems vulnerable
Solution Approach 1:
The patent introduces a beacon as an intermediary element that bridges the gap between public IP addresses and private entities. The beacon is injected into server logs and serves as a unique identifier that can be matched between external vulnerability detection tools and internal server identities, enabling precise vulnerability association while maintaining security boundaries
Solution Approach 2:
The patent segments the identification system into two parts: public identification (IP address + beacon) and private identification (internal server identity). This segmentation allows external tools to track and associate vulnerabilities using the public beacon while the private identity remains protected, resolving the contradiction between trackability and security
2Loss of information
If beacon matching is implemented to map public to private identifiers, then direct entity association is achieved, but system complexity increases due to additional mapping infrastructure
Solution Approach 1:
The server itself generates and stores the beacon in its own logs, and the mapping system queries the server to obtain the beacon-response pairs. This self-service approach eliminates the need for complex external mapping infrastructure, as the server participates actively in its own identification process
Solution Approach 2:
The beacon serves multiple functions: it acts as a unique identifier in vulnerability tracking, a query key for obtaining private identifiers, and a matching element between public and private systems. This multi-functionality reduces the need for separate systems for each purpose, simplifying the overall architecture
Data Source
AI summary
A method and system for mapping vulnerabilities to a private network identifier are provided. The method includes generating a request addressed to a public network identifier of a server, wherein the request includes a first beacon; transmitting the generated request to the server, wherein upon receiving the request by the server, the request causes a registry of a log file of the server, wherein the log includes at least the first beacon; in response to a query, receiving a response from the server, wherein the response includes a second beacon, and a private network identifier of the server; associating the public network identifier with the private network identifier, when the first beacon matches the second beacon; and mapping vulnerabilities identified with the public network identifier to associate the identified vulnerabilities with the associated public network identifier and the private network identifier.