Back to results
US 10,834,134 B2Granted
System, method, and recording medium for moving target defense
AssigneeInternational Business Machines Corporation
InventorsVenkat Raghavan, Mudhakar Srivatsa, Dinesh C. Verma
Life of this patent
Estimating the term…
Abstract
A network management method, system, and non-transitory computer readable medium, include a data center gateway including a set of rules for moving target defense and communicates with a service provider and a cloud gateway including the set of rules to communicate with the data center gateway by satisfying the moving target defense such that a client receives a service from the service provider when the cloud gateway requests the service from the data center gateway.
Claims11
A network management system, comprising:
- a processor;
- and
- a memory, the memory storing instructions to cause the processor to execute:
- a data center gateway acting as a front-end to an original device including a set of rules for a moving target defense and which communicates with a service provider;
- and
- a cloud gateway including the set of rules to communicate with the data center gateway by satisfying the moving target defense such that a client receives a service from the service provider when the cloud gateway requests the service from the data center gateway, the cloud gateway being implemented as a service running in a cloud computing node,
- wherein the data center gateway is implemented in front of an original service on the original device such that the original service remains unchanged at a default configuration,
- wherein the moving target defense is restricted to a security service separate from the original service,
- wherein the set of rules includes, at predetermined intervals, changing a port number at which the data center gateway operates,
- providing multiple implementations of a same argument checking code at the data center gateway, and changing a preferred implementation at a random interval,
- wherein the cloud gateway includes a dynamically changing number of proxy servers,
- wherein the cloud gateway includes a plurality of proxy servers, a number of the plurality of proxy servers dynamically changing based on a load on the cloud gateway from the client,
- wherein the cloud gateway includes a rate control scheme limiting a total rate of requests to the data center gateway;
- wherein the cloud gateway includes a predetermined number of token buckets limiting a total number of requests to the data center gateway, and
- wherein the set of rules further includes, at a random interval, switching an operating system on which the data center gateway and/or the cloud gateway runs.
12 more elements
A network management method, comprising:
- creating a set of rules for moving target defense for a data center gateway acting as a front-end to an original device;
- distributing the set of rules to a cloud gateway, the cloud gateway being implemented as a service running in a cloud computing node;
- receiving, via the cloud gateway, a request from a client to access a service provided by a service provider;
- and
- accessing the service requested by the client by having the cloud gateway use the set of rules to communicate with the data center gateway to satisfy the moving target defense,
- wherein the data center gateway is implemented in front of an original service on the original device such that the original service remains unchanged at a default configuration,
- wherein the moving target defense is restricted to a security service separate from the original service,
- wherein the set of rules includes, at predetermined intervals, changing a port number at which the data center gateway operates,
- providing multiple implementations of a same argument checking code at the data center gateway, and changing a preferred implementation at a random interval,
- wherein the cloud gateway includes a dynamically changing number of proxy servers,
- wherein the cloud gateway includes a plurality of proxy servers, a number of the plurality of proxy servers dynamically changing based on a load on the cloud gateway from the client,
- wherein the cloud gateway includes a rate control scheme limiting a total rate of requests to the data center gateway,
- wherein the cloud gateway includes a predetermined number of token buckets limiting a total number of requests to the data center gateway, and
- wherein the set of rules further includes, at a random interval, switching an operating system on which the data center gateway and/or the cloud gateway runs.
11 more elements
A non-transitory computer-readable recording medium recording a network management program, the program causing a computer to perform:
- creating a set of rules for moving target defense for a data center gateway acting as a front-end to an original device;
- distributing the set of rules to a cloud gateway, the cloud gateway being implemented as a service running in a cloud computing node;
- receiving, via the cloud gateway, a request from a client to access a service provided by a service provider;
- and
- accessing the service requested by the client by having the cloud gateway use the set of rules to communicate with the data center gateway to satisfy the moving target defense,
- wherein the data center gateway is implemented in front of an original service on the original device such that the original service remains unchanged at a default configuration,
- wherein the moving target defense is restricted to a security service separate from the original service,
- wherein the set of rules includes, at predetermined intervals, changing a port number at which the data center gateway operates,
- providing multiple implementations of a same argument checking code at the data center gateway, and changing a preferred implementation at a random interval,
- wherein the cloud gateway includes a dynamically changing number of proxy servers,
- wherein the cloud gateway includes a plurality of proxy servers, a number of the plurality of proxy servers dynamically changing based on a load on the cloud gateway from the client,
- wherein the cloud includes a rate control scheme limiting a total rate of requests to the data center gateway,
- wherein the cloud gateway includes a predetermined number of token buckets limiting a total number of requests to the data center gateway, and
- wherein the set of rules further includes, at a random interval, switching an operating system on which the data center gateway and/or the cloud gateway runs.
11 more elements
Dependencies are inferred from the claim text.