US 6,687,833 B1 · System and method for providing a network host decoy using a pseudo network protocol stack implementation

Abstract

A system and method for providing a network host decoy on a virtual host using a pseudo implementation of a network protocol stack are described. A hierarchical network protocol stack is functionally defined and includes a plurality of communicatively interfaced protocol layers. A request frame originating from a remote host is received. The request frame includes a plurality of recursively encapsulated data segments which each correspond to a successive protocol layer in the network protocol stack. At each protocol layer, processing a header associated with the encapsulated data segment demultiplexs each encapsulated data segment in the request frame. Any requested network service is performed and any recursively encapsulated portion is forwarded to the next successive protocol layer. A plurality of pseudo data segments corresponding to each of the protocol layers in the network protocol stack is formed. Each pseudo data segment includes a header and data portion. The header includes network protocol stack characteristics for a pseudo host different than the network protocol stack characteristics for the virtual host. Each of the pseudo data segments within a response frame is recursively encapsulated. A network address for the pseudo host different than the network address for the virtual host is inserted into the response frame. The response frame is sent to the remote host.

Claims33

Dependent claims

A system for providing a network host decoy on a virtual host using a pseudo implementation of a network protocol stack, wherein the network protocol stack comprises an Internet Protocol (IP) layer, comprising:

a hierarchical network protocol stack comprising a plurality of communicatively interfaced protocol layers, each protocol layer performing a set of defined functions on data segments exchanged therebetween;
an input buffer receiving a request frame originating from a remote host, the request frame comprising a plurality of recursively encapsulated data segments which each correspond to a successive protocol layer in the network protocol stack, further comprising:
the IP layer interpreting an IP datagram encapsulated as a data segment within the request frame;
and
a pseudo IP layer modifying a checksum field in a header of the IP datagram and including the modified checksum field in a reply IP datagram formed as a pseudo data segments;
and
a packet formatter, comprising:
each protocol layer demultiplexing each encapsulated data segment in the request frame by processing a header associated with the encapsulated data segment, performing any requested network service and forwarding any recursively encapsulated portion to the next successive protocol layer;
a plurality of pseudo protocol layers corresponding to each of the protocol layers in the network protocol stack, each pseudo protocol layer forming a pseudo data segment comprising a header and data portion with the header including network protocol stack characteristics for a pseudo host different than the network protocol stack characteristics for the virtual host and recursively encapsulating each of the pseudo data segments within a response frame and inserting into the response frame a network address for the pseudo host different than the network address for the virtual host;
and
an output buffer sending the response frame to the remote host.

8 more elements

A method for providing a network host decoy on a virtual host using a pseudo implementation of a network protocol stack, wherein the network protocol stack comprises an Internet Protocol (IP) layer, comprising:

functionally defining a hierarchical network protocol stack comprising a plurality of communicatively interfaced protocol layers;
receiving a request frame originating from a remote host the request frame comprising a plurality of recursively encapsulated data segments which each correspond to a successive protocol layer in the network protocol stack, further comprising:
interpreting an IP datagram encapsulated as a data segment within the request frame;
modifying a checksum field in a header of the IP datagram;
and
including the modified checksum field in a reply IP datagram formed as a pseudo data segment;
and
demultiplexing, at each protocol layer, each encapsulated data segment in the request frame by processing a header associated with the encapsulated data segment, performing any requested network service and forwarding any recursively encapsulated portion to the next successive protocol layer;
forming a plurality of pseudo data segments corresponding to each of the protocol layers in the network protocol stack, each pseudo data segment comprising a header and data portion with the header including network protocol stack characteristics for a pseudo host different than the network protocol stack characteristics for the virtual host;
recursively encapsulating each of the pseudo data segments within a response frame and inserting into the response frame a network address for the pseudo host different than the network address for the virtual host;
and
sending the response frame to the remote host.

9 more elements

A computer-readable storage medium holding code for providing a network host decoy on a virtual host using a pseudo implementation of a network protocol stack, wherein the network protocol stack comprises an Internet Protocol (IP) layer, comprising:

functionally defining a hierarchical network protocol stack comprising a plurality of communicatively interfaced protocol layers;
receiving a request frame originating from a remote host, the request frame comprising a plurality of recursively encapsulated data segments which each correspond to a successive protocol layer in the network protocol stack, further comprising:
interpreting an IP datagram encapsulated as a data segment within the request frame;
modifying a checksum field in a header of the IP datagram;
and
including the modified checksum field in a reply IP datagram formed as a pseudo data segment;
and
demultiplexing, at each protocol layer, each encapsulated data segment in the request frame by processing a header associated with the encapsulated data segment, performing any requested network service and forwarding any recursively encapsulated portion to the next successive protocol layer;
forming a plurality of pseudo data segments corresponding to each of the protocol layers in the network protocol stack, each pseudo data segment comprising a header and data portion with the header including network protocol stack characteristics for a pseudo host different than the network protocol stack characteristics for the virtual host;
recursively encapsulating each of the pseudo data segments within a response frame and inserting into the response frame a network address for the pseudo host different than the network address for the virtual host;
and
sending the response frame to the remote host.

9 more elements

Dependencies are inferred from the claim text.

System and method for providing a network host decoy using a pseudo network protocol stack implementation

Life of this patent

System and method for providing a network host decoy using a pseudo network protocol stack implementation

Life of this patent

Abstract

Claims33