Network abstraction and isolation layer for masquerading machine identity of a computer

• US 20050108407A1
• Filed: 09/24/2004
• Published: 05/19/2005
• Est. Priority Date: 09/26/2003
• Status: Active Grant

• Current Assignee: Quest Software, Inc.
• Original Assignee: Surgient, Inc. (Quest Software, Inc.)
• Inventors: McCrory, Dave D., Johnson, Scott C.
• Granted Patent: US 7,769,004 B2
• Time in Patent Office: Days
• US Class Current: 709/228
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/16 Implementing security features at a particular protocol layer

Abstract

A network abstraction and isolation layer (NAIL) for masquerading the machine identity of a computer in a network to enable the computer to communicate in the network with a different machine identity including an isolated network interface for communicating with the computer, an abstraction network interface for communicating with a network device coupled to the network, and control logic. The control logic is coupled to the isolated and abstraction network interfaces and performs machine identity translation to masquerade machine identity of the computer relative to the network. Machine identity masquerading includes selectively translating any one or more of an IP address, a MAC address, a machine name, a system identifier, and a DNS Name in the header or payload of communication packets.

Claims

1. A network abstraction and isolation layer (NAIL) for masquerading the machine identity of a computer in a network to enable the computer to communicate in the network with a different machine identity, comprising:

an isolated network interface for communicating with the computer;

an abstraction network interface for communicating with a network device coupled to the network; and

control logic, coupled to said isolated and abstraction network interfaces, that performs machine identity translation to masquerade machine identity of the computer relative to the network.

2. The NAIL of claim 1, wherein said control logic translates an IP address and a Media Access Control (MAC) address in a packet header of a communication packet between said isolated and abstraction network interfaces.

3. The NAIL of claim 2, wherein said control logic further translates at least one of an IP address, a machine name, a system identifier, and a Domain Name Service (DNS) Name in a packet payload of said communication packet.

4. The NAIL of claim 1, wherein said control logic translates an IP address in a packet header and a packet payload of a communication packet between said isolated and abstraction network interfaces.

5. The NAIL of claim 4, wherein said control logic further translates at least one of a machine name, a system identifier, and a Domain Name Service (DNS) Name in said packet payload of said communication packet.

6. The NAIL of claim 1, wherein said control logic employs a configurable list of translations.

7. The NAIL of claim 1, wherein said control logic selectively translates communication packets based on communication protocol.

8. A network, comprising:

a local network device;

a first computer having a first machine identity; and

a network abstraction and isolation layer (NAIL), interfaced between said local network device and said first computer, wherein said NAIL masquerades said first machine identity to isolate and abstract said first computer into a first isolated network layer.

9. The network of claim 8, wherein said first computer comprises a logical server.

10. The network of claim 8, wherein said NAIL comprises a logical device with virtual interfaces.

11. The network of claim 8, wherein said NAIL comprises:

an isolated network interface for communicating with said first computer;

control logic, interfaced with said isolated network interface, which performs machine identity translation; and

an abstraction network interface for enabling communication between said control logic and said local network device.

12. The network of claim 11, wherein said isolated network interface comprises a virtual interface that directly interfaces said control logic with said first computer.

13. The network of claim 11, wherein at least one of said isolated and abstraction network interfaces comprises a network interface controller (NIC).

14. The network of claim 13, wherein at least one NIC comprises a virtual NIC.

15. The network of claim 11, wherein said control logic translates an IP address and a Media Access Control (MAC) address in a packet header of a communication packet between the isolated and abstraction network interfaces.

16. The network of claim 15, wherein said control logic further translates at least one of an IP address, a machine name, a system identifier, and a Domain Name Service (DNS) Name in a packet payload of said communication packet.

17. The network of claim 11, wherein said control logic translates an IP address in a packet header and a packet payload of a communication packet between the isolated and abstraction network interfaces.

18. The network of claim 17, wherein said control logic further translates at least one of a machine name, a system identifier, and a Domain Name Service (DNS) Name in said packet payload of said communication packet.

19. The network of claim 11, wherein said control logic selectively translates communication packets between said first computer and said local network device based on communication protocol.

20. The network of claim 8, further comprising:

a second computer having a second machine identity; and

said NAIL comprising a multi-channel NAIL for masquerading said first and second machine identities to isolate and abstract said first and second computers into first and second isolated network layers, respectively.

21. The network of claim 20, wherein said multi-channel NAIL comprises:

a first isolated network interface for communicating with said first computer;

a second isolated network interface for communicating with said second computer;

control logic, coupled to said first and second isolated network interfaces, that performs machine identity translation for said first and second machine identities; and

a common abstraction network interface for enabling communication between said control logic and said local network device.

22. The network of claim 21, wherein said first and second machine identities are the same.

23. A method of isolating and abstracting a computer in a network, comprising:

interfacing the computer to the network via isolated and abstracted communication interfaces;

monitoring communication packets between the computer and the network; and

selectively translating the communication packets to masquerade the machine identity of the computer.

24. The method of claim 23, wherein said selectively translating comprises determining communication protocol and selectively translating based on communication protocol.

25. The method of claim 23, wherein said selectively translating comprises:

changing an IP address in a packet header of a communication packet to a different IP address; and

changing a Media Access Control (MAC) address in the packet header to a different MAC address.

26. The method of claim 25, further comprising changing at least one of an IP address, a machine name, a system identifier, and a Domain Name Service (DNS) Name in a packet payload of the communication packet to a different IP address, machine name, system identifier, and DNS Name, respectively.

27. The method of claim 23, wherein said translating comprises changing an IP address in a packet header and a packet payload of a communication packet to a different IP address.

28. The method of claim 27, further comprising changing at least one of a machine name, a system identifier, and a Domain Name Service (DNS) Name in the packet payload of the communication packet to a different machine name, system identifier, and DNS Name, respectively.