Self-shielding dynamic network architecture
View Patent ↗A shielding is provided to prevent attacks on network architecture or reduce the impact thereof. The system reconfigures the network differently for each user, operating system, and host and the configuration changes as time passes. The system can use dynamic redirection to create a reconfigurable network, and include intermediary nodes to dynamically reconfigure the network infrastructure for all traffic.
1. A method for self-shielding a dynamic network architecture system for preventing or reducing the impact of attacks thereon including the steps of:
modifying the manner in which network requests are performed using a process that makes re-routing invisible to a host machine, including assigning a customer non routable Internet Protocol for each user, at each session on each operating dynamic network architecture system;
automatically conveying identify across the dynamic network architecture system to determine an appropriate policy;
uniquely identifying a user and limiting an amount of network information the user is entitled to see;
enforcing devise and user specific policy based on ports, protocols, and destinations;
automatically encapsulating and de-encapsulating traffic as needed to support communication with non-protected systems and/or protocols not native to the dynamic network architecture system; and
automatically translating traffic as needed to support communication with non-protected systems and/or protocols not native to the dynamic network architecture system.
2. The method for self-shielding the dynamic network architecture system as set forth in claim 1 , further including the step of using virtual addresses as exposed targets.
3. The method for self-shielding the dynamic network architecture system as set forth in claim 2 , including the step of converting the virtual addresses to real Internet Protocol addresses with processing nodes.
4. The method for self-shielding the dynamic network architecture system as set forth in claim 3 , wherein the processing nodes cannot be logged into or accessed by attackers and are transparent for real users.
5. The method for self-shielding the dynamic network architecture system as set forth in claim 4 , including the step of controlling the processing nodes through a secure protocol in a control center of the dynamic network architecture system.
6. The method for self-shielding the dynamic network architecture system as set forth in claim 5 , wherein packets sent by an attacker which do not correctly follow network dynamics stand out as unauthorized and allow intermediate blocking or alert generation.
7. The method for self-shielding the dynamic network architecture system as set forth in claim 6 , wherein the dynamic network architecture system uses the ports and internet protocols in a redirection process guided by a hypervisor in the processing nodes.
8. The method for self-shielding the dynamic network architecture system as set forth in claim 7 , wherein the dynamic network architecture system uses cryptographically imbedded states for network redirection inside larger Internet Protocol addresses.
9. A self-shielding dynamic network architecture system enclave for preventing or reducing the impact of attacks thereon including:
a dynamic network architecture system, and a host machine, the dynamic network architecture system configured to modify the manner in which network requests are performed using a process that makes re-routing invisible to the host machine, including assigning a custom non routable Internet Protocol for each user, at each session on each operating dynamic network architecture system, the dynamic network architecture system further configured to automatically convey identity to determine an appropriate policy and uniquely identifies a user and limits an amount of network information the user is entitled to see, and enforce device and user specific policy based on ports, protocols, and destinations; and
the dynamic network architecture system further configured to automatically encapsulate and de-encapsulate traffic as needed to support communication with non-protected systems and/or protocols not native to the dynamic network architecture system.
10. The self-shielding dynamic network architecture system enclave for preventing or reducing the impact of attacks thereon as set forth in claim 9 wherein, the dynamic network architecture system uses virtual addresses as exposed targets.
11. The self-shielding dynamic network architecture system enclave for preventing or reducing the impact of attacks thereon as set forth in claim 10 wherein, the dynamic network architecture system converts the virtual addresses to real Internet Protocol addresses using processing nodes.
12. The self-shielding dynamic network architecture system enclave for preventing or reducing the impact of attacks thereon as set forth in claim 11 wherein, the processing nodes cannot be logged into or accessed by attackers and are transparent for real users.
13. The self-shielding dynamic network architecture system enclave for preventing or reducing the impact of attacks thereon as set forth in claim 12 including, a control center of the dynamic network architecture system, the control center controlling the processing nodes through a secure protocol.
14. The self-shielding dynamic network architecture system enclave for preventing or reducing the impact of attacks thereon as set forth in claim 13 wherein, packets sent by an attacker which do not correctly follow network dynamics stand out as unauthorized and allow intermediate blocking or alert generation.
15. The self-shielding dynamic network architecture system enclave for preventing or reducing the impact of attacks thereon as set forth in claim 14 wherein, the dynamic network architecture system uses the ports and internet protocols in a redirection process guided by a hypervisor in the processing nodes.
16. The self-shielding dynamic network architecture system enclave for preventing or reducing the impact of attacks thereon as set forth in claim 15 wherein, the dynamic network architecture system uses cryptographically imbedded states for network redirection inside larger Internet Protocol addresses.
17. A self-shielding dynamic network architecture system enclave for preventing or reducing the impact of attacks thereon including:
a dynamic network architecture system, and a host machine, the dynamic network architecture system configured to modify the manner in which a network requests are performed using a process that makes re-routing invisible to the host machine, including assigning a custom non routable Internet Protocol for each user, at each session on each operating dynamic network architecture system, the dynamic network architecture system further configured to automatically convey identity to determine an appropriate policy and uniquely identifies a user and limits an amount of network information the user is entitled to see, and enforce device and user specific policy based on ports, protocols, and destinations; and
the dynamic network architecture system further configured to automatically translate traffic as needed to support communication with non-protected systems and/or protocols not native to the dynamic network architecture system.