Method and apparatus for providing adaptive self-synchronized dynamic address translation as an intrusion detection sensor
View Patent ↗A translator is provided for translating predetermined portions of packet header information including an address of a data packet according to a cipher algorithm keyed by a cipher key derived by a key exchanger. A mapping device is also provided for mapping the address to a host table stored in memory. If the address does not match an entry in the host table, a security device is triggered.
1. A system, comprising:
a memory configured to store a host table;
a translator configured to restore predetermined portions of packet header information of a data packet, the packet header information including a network portion of a destination address routable over a wide area network and an encrypted host portion of the address identifying a destination host, the restoration including to:
extract, from the packet header information, predetermined portions of packet header data including the encrypted host portion of the address,
decrypt the extracted packet header data to determine a restored host portion of the restored address, and
place the restored host portion of the address back into the packet header information of the data packet, preserving the network portion of the destination address of the packet header;
a mapping device configured to map the restored address to the host table;
a host resolution device configured to issue a request to the network to resolve the restored address when the restored address does not match an entry in the host table and to supplement the host table with the restored address upon receipt of a reply to the request that indicates that the restored address is valid; and
an actuator configured to trigger a security device when the restored address does not match an entry in the host table.
2. The system of claim 1 , wherein the security device is a logging device configured to log the data packet.
3. The system of claim 1 , wherein the security device is configured to signal an alarm when triggered.
4. The system of claim 1 , wherein the host resolution device is configured to derive the host table using an address resolution protocol.
5. The system of claim 1 , further comprising a network device configured to place the data packet onto a network when the restored address maps to the host table.
6. A method, comprising:
restoring predetermined portions of packet header information of a data packet, the packet header information including a network portion of a destination address routable over a wide area network and an encrypted host portion of the address identifying a destination host, the restoring including:
extracting, from the packet header information, predetermined portions of packet header data including the encrypted host portion of the address,
decrypting the extracted packet header data to determine a restored host portion of the restored address, and
placing the host portion of the restored address back into the packet header information of the data packet, preserving the network portion of the destination address of the packet header;
issuing a request to the network to resolve the restored address when the restored address does not match an entry in a host table and supplementing the host table with the restored address upon receipt of a reply to the request that indicates that the restored address is valid; and
triggering a security device when the restored address does not match an entry in the host table.
7. The method of claim 6 , further comprising logging the data packet when the address does not match an entry in the host table.
8. The method of claim 6 , further comprising signaling an alarm when the security device is triggered.
9. The method of claim 6 , further comprising deriving the host table using an address resolution protocol.
10. The method of claim 6 , further comprising placing the data packet onto a network when the restored address maps to the host table.
11. The system of claim 1 , wherein the network address is an internet protocol address, the network portion of the destination address of the packet header is an upper bits portion of the internet protocol address, and the host portion of the restored address is a lower bits portion of the internet protocol address.
12. The method of claim 6 , wherein the network address is an internet protocol address, the network portion of the destination address of the packet header is an upper bits portion of the internet protocol address, and the host portion of the restored address is a lower bits portion of the internet protocol address.