Secure and scalable tunneling infrastructure for delivering high-interaction OS-based deception as a service to large-scale IT/OT/IoT mixed networks

1 . A computer-implemented method in a cloud-based deception tunnel interface of a deception as a service (DaaS) center, for managing a plurality of secure data tunnels projecting a plurality of cloud-managed decoys from a plurality of local enterprise networks to interact locally with malicious actors, the method comprising:

establishing a plurality of secure data tunnels with a plurality of edge points on a plurality of local enterprise networks, wherein a first decoy device is sent over a first secure data tunnel to a first edge point for projection from the DaaS onto a first local enterprise network;

receiving in real-time request packets over the first secure tunnel from a first edge point that has encapsulated the request packets, wherein the encapsulated request packets have a source address of the malicious attacker and a destination address of the first projected decoy and have been encapsulated by the first edge point to have a source address of a first edge point;

decapsulating the request packets to expose the destination address of the first projected decoy and routing the request packets based on the destination address of the first projected decoy and the source address of the first edge point;

encapsulating response packets generated from high-fidelity processing of the request packets by the first decoy device and routing to the first secure data tunnel, wherein the response packets have a destination address of the malicious attacker and a source address of the first projected decoy and have been encapsulated to have a destination address of the first edge point; and

transmitting the response packets over the first secure tunnel to the first edge point for decapsulating and forwarding to the malicious actor based on the destination address as exposed.

2 . The method of claim 1 , further comprising:

periodically sending a heartbeat data packet over the first secure data tunnel to maintain the connection when there is no malicious traffic being sent.

3 . The method of claim 1 , wherein the physical device on the first remote network comprises an operational technology (OT) device.

4 . The method of claim 1 , wherein the physical device on the first remote network comprises an Internet of Things (IoT) device.

5 . The method of claim 1 , wherein the physical device on the first remote network comprises an information technology (IT) device.

6 . The method of claim 1 , wherein the first decoy network is configured by a network administrator remotely connected to the DaaS center through an interface.

7 . The method of claim 1 , wherein the first secure tunnel and the DaaS center are transparent to the malicious actor.

8 . The method of claim 1 , wherein the processing of real-time malicious traffic of request packets received from the malicious actor over the first secure data tunnel using the first decoy network comprises high-fidelity operating system interactions.

9 . The method of claim 1 , wherein the processing of real-time malicious traffic of request packets received from the malicious actor over the first secure data tunnel using the first decoy network comprises routing the malicious traffic request packets from the first secure data tunnel to the first decoy network, and routing the response packets from the first decoy network to the first secure data tunnel.

10 . A non-transitory computer-readable medium in a cloud-based deception tunnel interface of a deception as a service (DaaS) center, storing code that when executed, performing a method for managing a plurality of secure data tunnels projecting a plurality of cloud-managed decoys to a plurality of local enterprise networks to interact locally with malicious actors, the method comprising:

establishing a plurality of secure data tunnels with a plurality of edge points on a plurality of local enterprise networks, wherein a first decoy device is sent over a first secure data tunnel to a first edge point for projection from the DaaS onto a first local enterprise network;

receiving in real-time request packets over the first secure tunnel from a first edge point that has encapsulated the request packets, wherein the encapsulated request packets have a source address of the malicious attacker and a destination address of the first projected decoy and have been encapsulated by the first edge point to have a source address of a first edge point;

decapsulating the request packets to expose the destination address of the first projected decoy and routing the request packets based on the destination address of the first projected decoy and the source address of the first edge point;

encapsulating response packets generated from high-fidelity processing of the request packets by the first decoy device and routing to the first secure data tunnel, wherein the response packets have a destination address of the malicious attacker and a source address of the first projected decoy and have been encapsulated to have a destination address of the first edge point; and

transmitting the response packets over the first secure tunnel to the first edge point for decapsulating and forwarding to the malicious actor based on the destination address as exposed.

11 . A cloud-based deception tunnel interface of a deception as a service (DaaS) center, for managing a plurality of secure data tunnels projecting a plurality of cloud-managed decoys to a plurality of local enterprise networks to interact locally with malicious actors, the deception tunnel interface comprising:

a processor;

a network interface communicatively coupled to the processor and to a data communication network; and

a memory, communicatively coupled to the processor and storing:

a tunnel manager to establish a plurality of secure data tunnels with a plurality of edge points on a plurality of local enterprise networks, wherein a first decoy device is sent over a first secure data tunnel to a first edge point for projection from the DaaS onto a first local enterprise network;

a tunnel queue to receive in real-time request packets over the first secure tunnel from a first edge point that has encapsulated the request packets, wherein the encapsulated request packets have a source address of the malicious attacker and a destination address of the first projected decoy and have been encapsulated by the first edge point to have a source address of a first edge point;

an incoming packet processor to decapsulate the request packets to expose the destination address of the first projected decoy and routing the request packets based on the destination address of the first projected decoy and the source address of the first edge point; and

an outgoing packet processor to encapsulate response packets generated from high-fidelity processing of the request packets by the first decoy device and routing to the first secure data tunnel, wherein the response packets have a destination address of the malicious attacker and a source address of the first projected decoy and have been encapsulated to have a destination address of the first edge point,

wherein the network interface transmits the response packets over the first secure tunnel to the first edge point for decapsulating and forwarding to the malicious actor based on the destination address as exposed.