Self-shielding dynamic network architecture

• US 10,447,710 B1
• Filed: 06/03/2015
• Issued: 10/15/2019
• Est. Priority Date: 06/03/2014
• Status: Active Grant

• Current Assignee: Bluehalo Labs LLC
• Original Assignee: Cryptonite, LLC
• Inventors: Li, Jason, Yackoski, Justin, Kambach, Brian, Levy, Renato, Evancich, Nicholas
• Primary Examiner(s): Traore, Fatoumata
• Application Number:
  US14/729,521
• Time in Patent Office: 1,595 Days
• CPC Class Codes: H04L 2101/604 Address structures or formats
• CPC Class Codes: H04L 2101/659 Internet protocol version 6 [IPv6] addresses
• CPC Class Codes: H04L 2101/668 Internet protocol [IP] address subnets
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A shielding is provided to prevent attacks on network architecture or reduce the impact thereof. The system reconfigures the network differently for each user, operating system, and host and the configuration changes as time passes. The system can use dynamic redirection to create a reconfigurable network, and include intermediary nodes to dynamically reconfigure the network infrastructure for all traffic.

Claims

1. A method for self-shielding a dynamic network architecture system for preventing or reducing the impact of attacks thereon including the steps of:

modifying the manner in which network requests are performed using a process that makes re-routing invisible to a host machine, including assigning a customer non routable Internet Protocol for each user, at each session on each operating dynamic network architecture system;

automatically conveying identify across the dynamic network architecture system to determine an appropriate policy;

uniquely identifying a user and limiting an amount of network information the user is entitled to see;

enforcing devise and user specific policy based on ports, protocols, and destinations;

automatically encapsulating and de-encapsulating traffic as needed to support communication with non-protected systems and/or protocols not native to the dynamic network architecture system; and

automatically translating traffic as needed to support communication with non-protected systems and/or protocols not native to the dynamic network architecture system.

2. The method for self-shielding the dynamic network architecture system as set forth in claim 1, further including the step of using virtual addresses as exposed targets.

3. The method for self-shielding the dynamic network architecture system as set forth in claim 2, including the step of converting the virtual addresses to real Internet Protocol addresses with processing nodes.

4. The method for self-shielding the dynamic network architecture system as set forth in claim 3, wherein the processing nodes cannot be logged into or accessed by attackers and are transparent for real users.

5. The method for self-shielding the dynamic network architecture system as set forth in claim 4, including the step of controlling the processing nodes through a secure protocol in a control center of the dynamic network architecture system.

6. The method for self-shielding the dynamic network architecture system as set forth in claim 5, wherein packets sent by an attacker which do not correctly follow network dynamics stand out as unauthorized and allow intermediate blocking or alert generation.

7. The method for self-shielding the dynamic network architecture system as set forth in claim 6, wherein the dynamic network architecture system uses the ports and internet protocols in a redirection process guided by a hypervisor in the processing nodes.

8. The method for self-shielding the dynamic network architecture system as set forth in claim 7, wherein the dynamic network architecture system uses cryptographically imbedded states for network redirection inside larger Internet Protocol addresses.

9. A self-shielding dynamic network architecture system enclave for preventing or reducing the impact of attacks thereon including:

a dynamic network architecture system, and a host machine, the dynamic network architecture system configured to modify the manner in which network requests are performed using a process that makes re-routing invisible to the host machine, including assigning a custom non routable Internet Protocol for each user, at each session on each operating dynamic network architecture system, the dynamic network architecture system further configured to automatically convey identity to determine an appropriate policy and uniquely identifies a user and limits an amount of network information the user is entitled to see, and enforce device and user specific policy based on ports, protocols, and destinations; and

the dynamic network architecture system further configured to automatically encapsulate and de-encapsulate traffic as needed to support communication with non-protected systems and/or protocols not native to the dynamic network architecture system.

10. The self-shielding dynamic network architecture system enclave for preventing or reducing the impact of attacks thereon as set forth in claim 9 wherein, the dynamic network architecture system uses virtual addresses as exposed targets.

11. The self-shielding dynamic network architecture system enclave for preventing or reducing the impact of attacks thereon as set forth in claim 10 wherein, the dynamic network architecture system converts the virtual addresses to real Internet Protocol addresses using processing nodes.

12. The self-shielding dynamic network architecture system enclave for preventing or reducing the impact of attacks thereon as set forth in claim 11 wherein, the processing nodes cannot be logged into or accessed by attackers and are transparent for real users.

13. The self-shielding dynamic network architecture system enclave for preventing or reducing the impact of attacks thereon as set forth in claim 12 including, a control center of the dynamic network architecture system, the control center controlling the processing nodes through a secure protocol.

14. The self-shielding dynamic network architecture system enclave for preventing or reducing the impact of attacks thereon as set forth in claim 13 wherein, packets sent by an attacker which do not correctly follow network dynamics stand out as unauthorized and allow intermediate blocking or alert generation.

15. The self-shielding dynamic network architecture system enclave for preventing or reducing the impact of attacks thereon as set forth in claim 14 wherein, the dynamic network architecture system uses the ports and internet protocols in a redirection process guided by a hypervisor in the processing nodes.

16. The self-shielding dynamic network architecture system enclave for preventing or reducing the impact of attacks thereon as set forth in claim 15 wherein, the dynamic network architecture system uses cryptographically imbedded states for network redirection inside larger Internet Protocol addresses.

17. A self-shielding dynamic network architecture system enclave for preventing or reducing the impact of attacks thereon including:

a dynamic network architecture system, and a host machine, the dynamic network architecture system configured to modify the manner in which a network requests are performed using a process that makes re-routing invisible to the host machine, including assigning a custom non routable Internet Protocol for each user, at each session on each operating dynamic network architecture system, the dynamic network architecture system further configured to automatically convey identity to determine an appropriate policy and uniquely identifies a user and limits an amount of network information the user is entitled to see, and enforce device and user specific policy based on ports, protocols, and destinations; and

the dynamic network architecture system further configured to automatically translate traffic as needed to support communication with non-protected systems and/or protocols not native to the dynamic network architecture system.