Secure data routing and randomization
A networked device creates a plurality of concurrent communication channels within a VPN tunnel between two networks, each channel being identifiable only by a set of IP addresses that are anonymized from the actual IP address of the communication endpoints. Traffic sent from the first network to the second may take any of a plurality of channels, with a randomized channel assignment on a per packet basis. By these means, the endpoints of communication are obfuscated. Further, transmitted data is spread apart or scattered across multiple channels, therefore, an eavesdropper would not have access to the entirety of a data communication.
1 . An apparatus operatively coupled to a private network and one or more public networks, the apparatus comprising:
one or more network communication interfaces,
at least one non-transitory memory, and
at least one processor configured to execute instructions stored in the at least one non-transitory memory to perform steps comprising:
(a) establishing, for each of the one or more network communication interfaces, a plurality of logical communication channels to a remote private network, each logical communication channel corresponding to a unique transmission route between the private network and the remote private network via the one or more public networks;
(b) receiving a plurality of data packets;
(c) randomly assigning, for each data packet of the plurality of data packets, a value unique to a logical communication channel of the plurality of logical communication channels; and
(d) transmitting each of the plurality of data packets to a destination via their respective randomly assigned logical communication channel.
2 . The apparatus of claim 1 , wherein the private network is associated with a first IP address, and
wherein each of the plurality of logical communication channels is associated with an IP address different than the first IP address.
3 . The apparatus of claim 1 , wherein each of the plurality of data packets is encrypted within a virtual private network prior to transmission.
4 . The apparatus of claim 1 , wherein the assigned value is set in a header of the data packet.
5 . The apparatus of claim 1 , wherein the processor is further configured to perform steps comprising:
(a) removing, based on occurrence of an event, a first channel of the plurality of logical communication channels, the first channel having a first IP address, and
(b) establishing a second logical communication channel that is not part of the plurality of logical communication channels, the second logical communication channel having a different IP address than the first IP address.
6 . The apparatus of claim 5 , wherein the event is one of: a security event, an administrative event, or a data transmission event.
7 . A method comprising:
(a) establishing, by a device coupled to a first network, within a virtual private network (VPN) tunnel, a plurality of logical communication channels between the device coupled to the first network and a device coupled to a second network remote from the first network, each logical communication channel corresponding to a unique data transmission route between the first network and the second network;
(b) receiving, by the device coupled to the first network, a plurality of data packets;
(c) randomly assigning, by the device coupled to the first network, for each data packet of the plurality of data packets, a value unique to a logical communication channel of the plurality of logical communication channels; and
(d) transmitting, by the device coupled to the first network, each of the plurality of data packets to the device coupled to the second network, via the packet's respective randomly assigned logical communication channel.
8 . The method of claim 7 , wherein the first network is associated with a first IP address, and
wherein each of the plurality of logical communication channels is associated with an IP address different than the first IP address.
9 . The method of claim 7 , wherein the assigned value is a number generated by a random number generator.
10 . The method of claim 7 , further comprising:
assigning, by the device coupled to the first network, for each data packet of the plurality of data packets, a transmission order number, wherein the transmission order number is randomly generated, and
wherein the transmitting is performed in accordance with the transmission order number.
11 . The method of claim 7 , further comprising:
(a) removing, by the device coupled to the first network, based on occurrence of an event, a first channel of the plurality of logical communication channels, the first channel having a first IP address, and
(b) establishing, by the device coupled to the first network, a second logical communication channel that is not part of the plurality of logical communication channels, the second logical communication channel having a different IP address than the first IP address.
12 . The method of claim 7 , wherein packet data is transmitted concurrently over each of the plurality of logical communication channels.