US 8,819,818 B2 · Dynamic computer network with variable identity parameters

Abstract

Method for communicating data in a computer network involves dynamically modifying at a first location in the computer network a plurality of true values. The true values correctly represent the plurality of identify parameters. These true values are transformed to false values, which incorrectly represent the identity parameters. Subsequently, the identity parameters are modified at a second location to transform the false values back to the true values. The position of the first and/or second locations varies dynamically as part of this process. A bridge transforms identity parameter values when communicating outside the network. Dynamic modification of the identity parameters occurs in accordance with a mission plan that can be modified without interrupting communication of data in the network.

Drawings

Drawings are temporarily unavailable. Open the PDF at USPTO

Drawings

Claims25

Dependent claims

A method for communicating data in a computer network, comprising:

communicating a data packet on said computer network from a first computing device to a second computing device, said data packet comprising payload data and header data, said header data including a plurality of identity parameters that uniquely identify hardware and software of at least one of said first and second computing devices;
dynamically modifying at a first location in said computer network a plurality of true values of said header data, which correctly represent said plurality of identity parameters, to transform said true values to a plurality of false values that specify said plurality of identity parameters but do so using values that are not said true values;
dynamically modifying said plurality of identity parameters in said data packet at a second location different from the first location in said computer network to transform said plurality of false values back to said true values;
wherein said dynamically modifying at the first and second location are based on a mission plan, the mission plan specifing which identity parameters are transformed during specific time periods;
and
dynamically varying a position of at least one of said first and second locations within the computer network to at least a third location within the network which is different from said first and second locations.

3 more elements

A computer network, comprising:

a plurality of computing devices including a first computing device configured to communicate a data packet to at least a second computing device, said data packet comprising payload data and header data, said header data including a plurality of identity parameters that uniquely identify hardware and software of at least one of said first and second computing devices;
a plurality of modules distributed at a plurality of locations in said computer network for intercepting said data packet that is communicated, including
a first module disposed at a first location configured to dynamically modify at said first location a plurality of true values of said header data, which correctly represent said plurality of identity parameters, and to transform said true values to a plurality of false values that specify said plurality of identity parameters but do so using values that are not said true values;
a second module disposed at a second location different from said first location in said computer network configured to dynamically modify at said second location, said plurality of identity parameters in said data packet, to transform said plurality of false values back to said true values;
and
wherein said dynamically modifying at the first and second location are based on a mission plan, the mission plan specifing which identity parameters are transformed during specific time periods;
and
wherein each of said plurality of modules is configured to dynamically determine when it is to perform as one of said first module and said second module whereby a position of at least one of said first and second locations within the computer network is dynamically varied to at least a third location within the network which is different from said first and second locations.

5 more elements

A module for use at one of a plurality of locations in a computer network for intercepting a data packet that is communicated between at least a first computing device and a second computing device, the module comprising:

a non-transitory machine readable storage medium storing instructions which, when executed by a processing system, cause the module to perform a method, comprising
dynamically determining if said module is to perform
a first transformation which transforms a plurality of true values in header data of the data packet that correctly represent a plurality of identity parameters uniquely identifying hardware and software of at least one of the first and second computing devices, to a plurality of false values that specify said plurality of identity parameters but do so using values that are not said true values, or
a second transformation that transforms a plurality of said false values in header data of said data packet back to said true values, wherein said transformations are based on a mission plan, the mission plan specifing which identity parameters are transformed during specific time periods;
performing at least one of said first and second transformation;
and
performing said dynamically determining step in coordination with a plurality of other said modules in said computer network so that a location where at least one of said first transformation and said second transformation is performed is dynamically varied within said computer network among at least a first location, a second location and a third location, wherein said third location is different from said first and second location.

4 more elements

Dependencies are inferred from the claim text.

Description13,422 words

Summary693 words

#1. Statement of the Technical Field

#The inventive arrangements relate to computer network security, and more particularly to defending computer networks from malicious attacks.

#2. Description of the Related Art

Brief description of the drawings13 figures

#Embodiments will be described with reference to the following drawing figures, in which like numerals represent like items throughout the figures, and in which:

#FIG. 1 is an example of a computer network that is useful for understanding the present invention.

#FIG. 2 is an example of a module that can be used in the present invention for performing certain manipulations of identity parameters.

Detailed description12,383 words

#The invention is described with reference to the attached figures. The figures are not drawn to scale and they are provided merely to illustrate the instant invention. Several aspects of the invention are described below with reference to example applications for illustration. It should be understood that numerous specific details, relationships, and methods are set forth to provide a full understanding of the invention. One having ordinary skill in the relevant art, however, will readily recognize that the invention can be practiced without one or more of the specific details or with other methods. In other instances, well-known structures or operations are not shown in detail to avoid obscuring the invention. The invention is not limited by the illustrated ordering of acts or events, as some acts may occur in different orders and/or concurrently with other acts or events. Furthermore, not all illustrated acts or events are required to implement a methodology in accordance with the invention.

#It should also be appreciated that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used herein, the singular forms “a”, “an” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. Furthermore, to the extent that the terms “including”, “includes”, “having”, “has”, “with”, or variants thereof are used in either the detailed description and/or the claims, such terms are intended to be inclusive in a manner similar to the term “comprising.”

#Further, unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. It will be further understood that terms, such as those defined in commonly used dictionaries, should be interpreted as having a meaning that is consistent with their meaning in the context of the relevant art and will not be interpreted in an idealized or overly formal sense unless expressly so defined herein.

Facts

Application

13/369,424Filed 9 Feb 2012

Published

US 2013/0212675 A115 Aug 2013

Granted

26 Aug 2014

Term ends

9 Feb 2032

Estimated · how

20 years from earliest known nonprovisional domestic filing plus recorded patent term adjustment. Maintenance-fee lapses, terminal disclaimers and statutory extensions have not been checked. The continuity chain may be incomplete; this is not an enforceability determination.

Classification10 codes

H04L 63/1491
Countermeasures against malicious traffic: using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
G06F 21/606
Protecting data: by securing the transmission between two devices or processes
H04L 61/2539
Translation of Internet protocol [IP] addresses: hiding addresses; Keeping addresses anonymous
H04L 63/04
Network architectures or network communication protocols for network security: for providing a confidential data exchange among entities…

Dynamic computer network with variable identity parameters

Life of this patent

Dynamic computer network with variable identity parameters

Life of this patent

Life of this patent

Life of this patent

Abstract

Drawings

Drawings

Claims25

Description13,422 words

Drawings

Description13,422 words

Classification10 codes