Fabric-based anonymity management, systems and methods
Network fabric devices capable of participating in an anonymity protocol can be configured to operate as virtual circuit end-points where the node routes packets between a virtual circuit associated with a hidden service address and a port-level channel. Through management of the virtual circuit end-points, the network fabric devices participate as a hop in a virtual circuit, host hidden services, or operate as an interface to hidden services while reducing latency and truly hiding hidden services.
1. A network fabric device comprising:
a plurality of network ports, each port capable of supporting a port-level channel;
a memory configured to:
store a hidden service address table capable of storing virtual circuit endpoints that include a hidden service address and a port-level channel; and
store a port-forwarding table; and
a router configured to route network traffic among the plurality of network ports according to the port-forwarding table, and configured to;
map a virtual circuit related to a hidden service to the port-level channel of a first port of the plurality of network ports according to the hidden service address table and based on the hidden service's address; and
route data associated with the hidden service between the virtual circuit and the port-level channel.
2. The device of claim 1 , wherein the port-level channel comprises an encrypted channel.
3. The device of claim 2 , wherein the encrypted channel comprises a port-to-port encrypted session.
4. The device of claim 1 , wherein the hidden service address comprises a network address and public key pair.
5. The device of claim 1 , wherein the network ports comprise at least one optic fiber port.
6. The device of claim 5 , wherein the virtual circuit maps to the port-level channel at a specified wavelength on the at least one optic fiber port.
7. The device of claim 6 , wherein the at least one optic fiber port comprises one of the following: a HiGIG port, a HiGIG+port, and a HiGIG2 port.
8. The device of claim 1 , wherein the plurality of network ports comprise at least one Ethernet port.
9. The device of claim 8 , wherein the virtual circuit maps to the port-level channel at a MAC address of the at least one Ethernet port.
10. The device of claim 8 , wherein the at least one Ethernet port comprises one of the following:
a 10 Mbps port, a 100 Mbps port, a 1000 Mbps port, and a 10 Gbps port.
11. The device of claim 1 , further comprising a hidden service manager module configured to update the hidden service address table.
12. The device of claim 11 , wherein the hidden service manager module is configured to update the hidden service address table upon migration of the hidden service.
13. The device of claim 11 , wherein the hidden service manager module is configured to host the hidden service.
14. The device of claim 13 , wherein the hidden service is hosted on the port-level channel.
15. The device of claim 1 , wherein the port-level channel composes a distributed network interface of the hidden service.
16. The device of claim 1 , wherein the hidden service address table comprises a distributed hash table.
17. The device of claim 1 , further comprising a cryptographic module configured to secure the data between the virtual circuit and the port-level channel.
18. The device of claim 17 , wherein the cryptographic module is configured to perform at least one of decrypting data flowing from the port-level channel to the virtual circuit and encrypting data flowing from the virtual circuit to the port-level channel.
19. The device of claim 1 , wherein the routing module is further configured to package the data into fixed size cells before routing the data over the port-level channel.
20. The device of claim 1 , wherein the virtual circuit comprises at least one of an onion routing path and a telescoping circuit.
21. A method for operating a network fabric device comprising a plurality of network ports, each port capable of supporting a port-level channel, the method comprising:
mapping a virtual circuit related to a hidden service to a port-level channel of a first port according to a hidden service address table comprising virtual circuit endpoints, each endpoint including a hidden service address and a port-level channel; and
routing network traffic among a plurality of network ports according to a port-forwarding table, wherein data associated with the hidden service is routed between the virtual circuit and the port-level channel.
22. The method recited in claim 21 , wherein each virtual circuit employs an anonymity protocol comprising at least one of an onion routing algorithm and a telescoping path algorithm.
23. The method recited in claim 21 , wherein the port-level channel connects to a distributed network interface of an external hidden service.
24. The method recited in claim 21 , wherein routing employs a cut-through routing path operating at a port channel level.
25. The method recited in claim 21 , wherein the network fabric device is one of a plurality of devices in an instantiated network fabric configured to operate as an intermediary node of a virtual circuit.
26. The method recited in claim 21 , wherein a single virtual circuit comprises multiple network paths.
27. The method recited in claim 21 , further comprising migrating protocol functionality from the network fabric device to at least one other network fabric device.
28. The method recited in claim 21 , wherein routing comprises obtaining next-hop information for a packet from another network fabric device.
29. The method recited in claim 21 , further comprising monitoring latency on each virtual circuit, and upon determining that latency occurs outside a predetermined range, adjusting associated paths through a network fabric by updating port forwarding tables in nodes of the network fabric.