公开(公告)号：US06687833B1

公开(公告)日：2004-02-03

申请号：US09405652

申请日：1999-09-24

申请人： Anthony Charles Osborne ,  Bruce Robert Leidl ,  Gerhard Eschelbeck ,  Andrea Emilio Villa

发明人： Anthony Charles Osborne ,  Bruce Robert Leidl ,  Gerhard Eschelbeck ,  Andrea Emilio Villa

IPC分类号： H04L900

CPC分类号： H04L63/10 ,  H04L63/1416 ,  H04L63/1491

摘要： A system and method for providing a network host decoy on a virtual host using a pseudo implementation of a network protocol stack are described. A hierarchical network protocol stack is functionally defined and includes a plurality of communicatively interfaced protocol layers. A request frame originating from a remote host is received. The request frame includes a plurality of recursively encapsulated data segments which each correspond to a successive protocol layer in the network protocol stack. At each protocol layer, processing a header associated with the encapsulated data segment demultiplexs each encapsulated data segment in the request frame. Any requested network service is performed and any recursively encapsulated portion is forwarded to the next successive protocol layer. A plurality of pseudo data segments corresponding to each of the protocol layers in the network protocol stack is formed. Each pseudo data segment includes a header and data portion. The header includes network protocol stack characteristics for a pseudo host different than the network protocol stack characteristics for the virtual host. Each of the pseudo data segments within a response frame is recursively encapsulated. A network address for the pseudo host different than the network address for the virtual host is inserted into the response frame. The response frame is sent to the remote host.

摘要翻译： 描述了使用网络协议栈的伪实现在虚拟主机上提供网络主机诱饵的系统和方法。 分层网络协议栈在功能上被定义并且包括多个通信接口的协议层。 收到源自远程主机的请求帧。 请求帧包括多个递归封装的数据段，每个数据段对应于网络协议栈中的连续协议层。 在每个协议层，处理与封装的数据段相关联的报头对请求帧中的每个封装的数据段进行解复用。 执行任何请求的网络服务，并将任何递归封装的部分转发到下一个连续的协议层。 形成与网​​络协议栈中的每个协议层对应的多个伪数据段。 每个伪数据段包括报头和数据部分。 该报头包括与虚拟主机的网络协议栈特性不同的伪主机的网络协议栈特性。 响应帧内的每个伪数据段被递归地封装。 与虚拟主机的网络地址不同的伪主机的网络地址插入到响应帧中。 响应帧发送到远程主机。