Fabric-based anonymity management, systems and methods
Based on a hidden service address table stored in a memory, a virtual circuit related to a hidden service is mapped to a corresponding port-level channel based on the hidden service's address. Data associated with the hidden service is routed between the virtual circuit and the port-level channel. This enables binding of high level anonymity protocols to low level communication services of a network fabric and ensures that other nodes in the network fabric can leverage fabric-hosted hidden services without requiring updates to an existing anonymity protocol.
1. An apparatus comprising:
a router including a processor and a non-transitory computer readable memory, the memory storing software instructions that when executed cause the processor to perform operations comprising:
route network traffic among a plurality of network ports according to a port-forwarding plan, each of the plurality of network ports being capable of supporting a corresponding port-level channel;
map a virtual circuit related to a hidden service to a first port-level channel of a first port of the plurality of network ports according to a hidden service address; and
route data associated with the hidden service between the virtual circuit and the first port-level channel.
2. The apparatus of claim 1 , wherein the first port-level channel comprises an encrypted channel.
3. The apparatus of claim 2 , wherein the encrypted channel comprises a port-to-port encrypted session.
4. The apparatus of claim 1 , wherein the hidden service address comprises a network address and public key pair.
5. The apparatus of claim 1 , wherein the plurality of network ports comprises at least one optic fiber port.
6. The apparatus of claim 5 , wherein the virtual circuit maps to the first port-level channel at a specified wavelength on the at least one optic fiber port.
7. The apparatus of claim 5 , wherein the at least one optic fiber port comprises at least one of a HiGIG port, a HiGIG+port, or a HiGIG2 port.
8. The apparatus of claim 1 , wherein the plurality of network ports comprises at least one Ethernet port.
9. The apparatus of claim 8 , wherein the virtual circuit maps to a second port-level channel at a media access control address of the at least one Ethernet port.
10. The apparatus of claim 9 , wherein the at least one Ethernet port comprises at least one of a 10 Mbps port, a 100 Mbps port, a 1000 Mbps port, or a 10 Gbps port.
11. The apparatus of claim 1 , further comprising a hidden service manager module configured to at least update a hidden service address table.
12. The apparatus of claim 11 , wherein the hidden service manager module is configured to at least update the hidden service address table upon a migration of the hidden service.
13. The apparatus of claim 11 , wherein the hidden service manager module is configured to at least host the hidden service.
14. The apparatus of claim 13 , wherein the hidden service is hosted on the first port-level channel.
15. The apparatus of claim 1 , wherein the first port-level channel comprises a distributed network interface of the hidden service.
16. The apparatus of claim 11 , wherein the hidden service address table comprises a distributed hash table.
17. The apparatus of claim 1 , further comprising a cryptographic module configured to at least secure the data between the virtual circuit and the first port-level channel.
18. The apparatus of claim 17 , wherein the cryptographic module is configured to perform at least one of decrypting data flowing from the first port-level channel to the virtual circuit or encrypting data flowing from the virtual circuit to the first port-level channel.
19. The apparatus of claim 1 , wherein the router is further configured to at least package the data into fixed size cells before routing the data over the first port-level channel.
20. The apparatus of claim 1 , wherein the virtual circuit comprises an onion routing path.
21. The apparatus of claim 1 , wherein the virtual circuit comprises a telescoping circuit.
22. The apparatus of claim 1 comprising, or comprised in, a network fabric device.
23. The apparatus of claim 1 further comprising a memory including a hidden service address table capable of storing virtual circuit endpoints that include the hidden service address and the first port-level channel, the memory further including the port-forwarding plan.
24. A method comprising:
routing network traffic among a plurality of network ports according to a port-forwarding plan, each of the plurality of network ports being capable of supporting a corresponding port-level channel;
mapping a virtual circuit related to a hidden service to a first port-level channel of a first port of the plurality of network ports according to a hidden service address; and
routing data associated with the hidden service between the virtual circuit and the first port-level channel.
25. The method of claim 24 , wherein the first port-level channel comprises an encrypted channel.
26. The method of claim 25 , wherein the encrypted channel comprises a port-to-port encrypted session.
27. The method of claim 24 , wherein the hidden service address comprises a network address and public key pair.
28. The method of claim 24 , wherein the plurality of network ports comprises at least one optic fiber port.
29. The method of claim 28 , wherein the virtual circuit maps to the first port-level channel at a specified wavelength on the at least one optic fiber port.
30. The method of claim 28 , wherein the at least one optic fiber port comprises at least one of a HiGIG port, a HiGIG+port, or a HiGIG2 port.
31. The method of claim 24 , wherein the plurality of network ports comprises at least one Ethernet port.
32. The method of claim 31 , wherein the virtual circuit maps to a second port-level channel at a media access control address of the at least one Ethernet port.
33. The method of claim 32 , wherein the at least one Ethernet port comprises at least one of a 10 Mbps port, a 100 Mbps port, a 1000 Mbps port, or a 10 Gbps port.
34. The method of claim 24 , further comprising:
configuring a hidden service manager module to at least update a hidden service address table.
35. The method of claim 34 , wherein the hidden service manager module is configured to at least update the hidden service address table upon a migration of the hidden service.
36. The method of claim 34 , wherein the hidden service manager module is configured to at least host the hidden service.
37. The method of claim 36 , wherein the hidden service is hosted on the first port-level channel.
38. The method of claim 24 , wherein the first port-level channel comprises a distributed network interface of the hidden service.
39. The method of claim 24 , wherein the hidden service address table comprises a distributed hash table.
40. The method of claim 24 , further comprising:
configuring a cryptographic module to at least secure the data between the virtual circuit and the first port-level channel.
41. The method of claim 40 , wherein the cryptographic module is configured to perform at least one of decrypting data flowing from the first port-level channel to the virtual circuit or encrypting data flowing from the virtual circuit to the first port-level channel.
42. The method of claim 24 , wherein the router is further configured to at least package the data into fixed size cells before routing the data over the first port-level channel.
43. The method of claim 24 , wherein the virtual circuit comprises an onion routing path.
44. The method of claim 24 , wherein the virtual circuit comprises a telescoping circuit.
45. The method of claim 24 comprising, or comprised in, a network fabric device.
46. The method of claim 24 , further comprising:
storing virtual circuit endpoints, in a memory including a hidden service address table, that include the hidden service address and the first port-level channel, the memory further including the port-forwarding plan.
47. A computer-readable non-transitory storage medium carrying one or more sequences of one or more instructions which, when executed by one or more processors, cause an apparatus to at least:
route network traffic among a plurality of network ports according to a port-forwarding plan, each of the plurality of network ports being capable of supporting a corresponding port-level channel;
map a virtual circuit related to a hidden service to a first port-level channel of a first port of the plurality of network ports according to a hidden service address; and
route data associated with the hidden service between the virtual circuit and the first port-level channel.