Anonymizing server-side addresses
Techniques for using Network Address Translation (NAT), Mobile Internet Protocol (MIP), and/or other techniques in conjunction with Domain Name System (DNS) to anonymize server-side addresses in data communications. Rather than having DNS provide a client device with an IP address of an endpoint device, such as a server, the DNS instead returns a virtual IP (VIP) address that is mapped to the client device and the endpoint device. In this way, IP addresses of servers are obfuscated by a virtual network of VIP addresses. The client device may then communicate data packets to the server using the VIP address as the destination address, and a virtual network service that works in conjunction with DNS can convert the VIP address to the actual IP address of the server using NAT and forward the data packet onto the server.
1. A system that runs a virtual service that anonymizes Internet Protocol (IP) addresses of endpoints using a mobile IP version 6 (MIPv6) protocol, the system comprising:
one or more processors; and
one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
assigning a care-of address to an endpoint;
assigning a home address to the virtual service, wherein the virtual service acts as a home agent and maintains a mapping between the home address to the care-of address;
receiving a Domain Name System (DNS) request to resolve a domain name on behalf of a client device;
determining that the domain name corresponds to the endpoint that is associated with the care-of address; and
providing, based at least in part on the mapping, the home address in a response to the DNS request.
2. The system of claim 1 , the operations further comprising:
receiving, at the virtual service, a packet from the client device that has a destination of the home address;
determining, using the mapping, that the home address maps to the care-of address; and
forwarding the packet to the endpoint using the care-of address.
3. The system of claim 1 , the operations further comprising:
creating a tunnel between the virtual service and the endpoint such that:
first packets sent from the virtual service and to the endpoint have the home address of the virtual service as a source address; and
second packets sent from the endpoint to the virtual service have a destination address of the home address.
4. The system of claim 3 , the operations further comprising:
sending, from the endpoint, a response packet to the client device that has a source address of the home address of the virtual service.
5. The system of claim 1 , the operations further comprising:
using a home address option of the MIPv6 protocol, communicating packets between the endpoint and the home agent in the virtual service.
6. The system of claim 1 , wherein:
the virtual service running in the system includes a DNS service that receives DNS requests from client devices.
7. The system of claim 1 , the operations further comprising:
assigning a second care-of address to a second endpoint, wherein the second endpoint is associated with the domain name;
creating a second mapping between the home address and a second care-of address; and
load balancing traffic sent to the home address between the care-of address and the second care-of address.
8. A method for a virtual service to anonymize Internet Protocol (IP) addresses of endpoints using a mobile IP version 6 (MIPv6) protocol, the method comprising:
assigning a care-of address to an endpoint;
assigning a home address to the virtual service, wherein the virtual service acts as a home agent and maintains a mapping between the home address to the care-of address;
receiving a Domain Name System (DNS) request to resolve a domain name on behalf of a client device;
determining that the domain name corresponds to the endpoint that is associated with the care-of address; and
providing, based at least in part on the mapping, the home address in a response to the DNS request.
9. The method of claim 8 , further comprising:
receiving, at the virtual service, a packet from the client device that has a destination of the home address;
determining, using the mapping, that the home address maps to the care-of address; and
forwarding the packet to the endpoint using the care-of address.
10. The method of claim 8 , further comprising:
creating a tunnel between the virtual service and the endpoint such that:
first packets sent from the virtual service and to the endpoint have the home address of the virtual service as a source address; and
second packets sent from the endpoint to the virtual service have a destination address of the home address.
11. The method of claim 10 , further comprising:
sending, from the endpoint, a response packet to the client device that has a source address of the home address of the virtual service.
12. The method of claim 8 , further comprising:
using a home address option of the MIPv6 protocol, communicating packets between the endpoint and the home agent in the virtual service.
13. The method of claim 8 , wherein:
the virtual service includes a DNS service that receives DNS requests from client devices.
14. The method of claim 8 , further comprising:
assigning a second care-of address to a second endpoint, wherein the second endpoint is associated with the domain name;
creating a second mapping between the home address and a second care-of address; and
load balancing traffic sent to the home address between the care-of address and the second care-of address.
15. One or more non-transitory computer-readable media storing computer executable instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:
assigning, by a virtual service that anonymizes Internet Protocol (IP) addresses using a mobile IP version 6 (MIPv6) protocol, a care-of address to an endpoint;
assigning a home address to the virtual service, wherein the virtual service acts as a home agent and maintains a mapping between the home address to the care-of address;
receiving a Domain Name System (DNS) request to resolve a domain name on behalf of a client device;
determining that the domain name corresponds to the endpoint that is associated with the care-of address; and
providing, based at least in part on the mapping, the home address in a response to the DNS request.
16. The one or more non-transitory computer-readable media of claim 15 , the operations further comprising:
receiving, at the virtual service, a packet from the client device that has a destination of the home address;
determining, using the mapping, that the home address maps to the care-of address; and
forwarding the packet to the endpoint using the care-of address.
17. The one or more non-transitory computer-readable media of claim 15 , the operations further comprising:
creating a tunnel between the virtual service and the endpoint such that:
first packets sent from the virtual service and to the endpoint have the home address of the virtual service as a source address; and
second packets sent from the endpoint to the virtual service have a destination address of the home address.
18. The one or more non-transitory computer-readable media of claim 17 , the operations further comprising:
sending, from the endpoint, a response packet to the client device that has a source address of the home address of the virtual service.
19. The one or more non-transitory computer-readable media of claim 15 , the operations further comprising:
using a home address option of the MIPv6 protocol, communicating packets between the endpoint and the home agent in the virtual service.
20. The one or more non-transitory computer-readable media of claim 15 , the operations further comprising:
the virtual service includes a DNS service that receives DNS requests from client devices.