Method for network traffic mirroring with data privacy
View Patent ↗Systems and methods are provided for preserving the privacy of data contained in mirrored network traffic. The mirrored network traffic may comprise data that may be considered confidential, privileged, private, or otherwise sensitive data. For example, the data payload of a frame of mirrored network traffic may include private Voice over IP (VoIP) communications between users on one or more networks. The present invention provides various techniques for securing the privacy of data contained in the mirrored network traffic. Using the techniques of the present invention, network traffic comprising confidential, privileged, private, or otherwise sensitive data may be mirrored in such a manner as to provide for the privacy of such data over at least a portion if not all of the mirrored communications between the mirror source point and the mirror destination point.
1. A method for providing data privacy of mirrored network traffic during mirroring between a mirror source point and a mirror destination point, the method comprising the steps of:
receiving a unit of network traffic from a data source point at a mirror source point of a packet forwarding device on a network for mirroring to a mirror destination point, the data source point and the mirror source point being remotely located from each other;
altering, by the mirror source point of the packet forwarding device, the unit to provide privacy for at least a portion of selected data of the unit during at least a portion of mirroring communications to the mirror destination point; and
communicating, by the mirror source point of the packet forwarding device, the altered unit toward the mirror destination point unbeknownst to the data source point and a data destination point.
2. The method of claim 1 , wherein the altering step comprises encrypting the unit and encapsulating the encrypted unit in a tunneling protocol communicated from the mirror source point.
3. The method of claim 2 , wherein the tunneling protocol comprises one of the following: Point-To-Point Tunneling protocol, Layer 2 Tunneling Protocol, Generic Routing Encapsulation, Internet Protocol Security, MAC-in-MAC tunneling, and Multi-Protocol Label Switching.
4. The method of claim 1 , wherein the altering step comprises encrypting at least a portion of the selected data of the unit and encapsulating the partially encrypted unit in a non-tunneling protocol communicated from the mirror source point.
5. The method of claim 4 , wherein the non-tunneling protocol comprises one of the following protocols: Secure Sockets Layer, and HyperText Transfer Protocol Secured.
6. The method of claim 4 , wherein the step of encrypting comprises encrypting at least a value of one of the following: a field of the unit associated with a network protocol layer of the unit, a field of the unit associated with an application protocol layer of the unit, and a field of a protocol layer of the unit above the transport protocol layer.
7. The method of claim 1 , wherein the altering step comprises replacing at least a portion of the selected data of the unit with at least one of a random binary pattern or a predefined binary pattern.
8. The method of claim 1 , wherein the altering step comprises replacing at least a portion of the selected data of the unit with the portion of the selected data scrambled via a mathematical operation.
9. The method of claim 1 , wherein the altering step comprises at least one of blanking or scrambling the portion of selected data of the unit located beyond an offset determined by the mirror source point from a protocol type identified by the unit.
10. The method of claim 1 , wherein the altering step comprises deleting the portion of selected data from the unit and modifying the unit to comprise a valid length unit for communications from the mirror source point.
11. The method of claim 1 , wherein the portion of selected data of the unit comprises at least one of secret, classified, confidential, private, or privileged data.
12. The method of claim 1 , wherein the mirror destination point is associated with a network device accessible over the network via one or more of the following: a network relay device, a network entry device, a network segment, a transmission medium, and a public network.
13. The method of claim 1 , wherein the packet forwarding device comprises the mirror destination point.
14. The method of claim 1 , wherein the portion of selected data of the unit comprises a communication of one or more users of the network.
15. A packet forwarding device for providing data privacy of mirrored network traffic during mirroring between a mirror source point and a mirror destination point, the packet forwarding device comprising:
a mirror source point associated with a port on a network for receiving a unit of network traffic from a data source point for mirroring toward a mirror destination point, the data source point and the mirror source point being remotely located from each other;
a privacy mechanism for altering the unit to provide privacy for at least a portion of selected data of the unit during at least a portion of mirroring communications to the mirror destination point; and
a network interface for communicating the altered unit to at least one of the mirror destination point or a mirror receiving device unbeknownst to the data source point and a data destination point.
16. The packet forwarding device of claim 15 , wherein the mirror source point is connected to at least one of a port of a second packet forwarding device configured to mirror network traffic or a network tapping device.
17. The packet forwarding device of claim 15 , wherein the network interface communicates the altered unit via at least one of a second port of the packet forwarding device or the port of the mirror source point.
18. The packet forwarding device of claim 15 , wherein the privacy mechanism encrypts the unit and encapsulates the encrypted unit in a tunneling protocol communicated via the network interface.
19. The packet forwarding device of claim 18 , wherein the tunneling protocol comprises one of the following: Point-To-Point Tunneling protocol, Layer 2 Tunneling Protocol, Generic Routing Encapsulation, Internet Protocol Security, MAC-in-MAC tunneling, and Multi-Protocol Label Switching.
20. The packet forwarding device of claim 15 , wherein the privacy mechanism encrypts at least a portion of the selected data of the unit and encapsulates the partially encrypted unit in a non-tunneling protocol communicated via the network interface.
21. The packet forwarding device of claim 20 , wherein the non-tunneling protocol comprises one of the following protocols: Secure Sockets Layer, and HyperText Transfer Protocol Secured.
22. The packet forwarding device of claim 20 , wherein the privacy mechanism encrypts a value of a field of the unit associated with at least one of a network protocol layer of the unit, application protocol layer of the unit or a protocol layer of the unit above the transport protocol layer.
23. The packet forwarding device of claim 15 , wherein the privacy mechanism replaces at least a portion of the selected data of the unit with at least one of a random binary pattern or a predefined binary pattern.
24. The packet forwarding device of claim 15 , wherein the privacy mechanism replaces at least a portion of the selected data of the unit with the portion of the selected data scrambled via a mathematical operation.
25. The packet forwarding device of claim 15 , wherein the privacy mechanism provides for at least one of blanking or scrambling the portion of selected data of the unit located beyond an offset determined by the mirror source point from a protocol type identified by the unit.
26. The packet forwarding device of claim 15 , wherein the privacy mechanism deletes the portion of selected data from the unit and modifies the unit to comprise a valid length unit for communications via the network interface.
27. The packet forwarding device of claim 15 , wherein the portion of selected data of the unit comprises at least one of secret, classified, confidential, private, or privileged data.
28. The packet forwarding device of claim 15 , wherein the mirror destination point is associated with a network device accessible over the network via one or more of the following: a network relay device, a network entry device, a network segment, a transmission medium, and a public network.
29. The packet forwarding device of claim 15 , wherein the packet forwarding device comprises the mirror destination point.
30. The packet forwarding device of claim 15 , wherein the portion of selected data of the unit comprises a communication of one or more users of the network.