Network topology-preserving internet protocol address anonymization

Patent metadata

Field	Value
Publication number	US-10594564-B2
Application number	US-201615339172-A
Country	US
Kind code	B2
Filing date	Oct 31, 2016
Priority date	Oct 31, 2016
Publication date	Mar 17, 2020
Grant date	Mar 17, 2020

Abstract

Anonymization of IP addresses of a network while preserving a topology of the network is provided. Information is received regarding a network topology. The information is analyzed to generate a first model of the network topology. The first model is converted into a second model preserving the network topology and obfuscating a mapping of the IP addresses. The second model is utilized to simulate processing of network packets consistent with actual processing of the network packets in the network topology.

First claim

What is claimed is:

1. A computer-implemented method for anonymization of IP addresses of a network while preserving a topology of the network, the computer-implemented method comprising:
receiving, by a computer, information regarding a network topology;
analyzing, by the computer, the information to generate a first model of the network topology;
converting, by the computer, the first model into a second model preserving the network topology and obfuscating a mapping of the IP addresses; and
utilizing, by the computer, the second model to simulate processing of network packets consistent with actual processing of the network packets in the network topology.

2. The computer-implemented method of claim 1 wherein preserving the network topology comprises preserving the network topology in the second model when converting the first model into the second model, and further comprising:
performing, by the computer, an analysis of input data corresponding to the network topology; and
identifying, by the computer, a set of IP addresses within a source IP address domain of the network topology based on the analysis of the input data corresponding to the network topology.

3. The computer-implemented method of claim 2 further comprising:
selecting, by the computer, an IP address from the set of IP addresses within the source IP address domain of the network topology;
determining, by the computer, a network address prefix portion of the selected IP address selected from the set of IP addresses within the source IP address domain of the network topology; and
searching, by the computer, a network database of network addresses corresponding to the network topology for the network address prefix portion of the selected IP address.

4. The computer-implemented method of claim 3 further comprising:
determining, by the computer, whether the network address prefix portion of the selected IP address is in the network database; and
responsive to the computer determining that the network address prefix portion of the selected IP address is not in the network database, generating, by the computer, an entry in the network database for the network address prefix portion of the selected IP address.

5. The computer-implemented method of claim 4 further comprising:
responsive to the computer determining that the network address prefix portion of the selected IP address is in the network database, applying, by the computer, the network address prefix portion to the selected IP address.

6. The computer-implemented method of claim 3 further comprising:
determining, by the computer, a nodal address portion of the selected IP address; and
searching, by the computer, a node database of network node addresses corresponding to the network topology for the nodal address portion of the selected IP address.

7. The computer-implemented method of claim 6 further comprising:
determining, by the computer, whether the nodal address portion of the selected IP address was found in the node database; and
responsive to the computer determining that the nodal address portion of the selected IP address is not in the node database, determining, by the computer, that the nodal address portion of the selected IP address is not a reference to a node in the network topology.

8. The computer-implemented method of claim 7 further comprising:
responsive to the computer determining that the nodal address portion of the selected IP address is in the node database, anonymizing, by the computer, the selected IP address by allocating out of an open IP address range spanning a set of viable anonymized replacement IP addresses from octet to octet while preserving the network topology.

9. The computer-implemented method of claim 8 further comprising:
generating, by the computer, a target anonymized IP address domain model for the network topology based on anonymized IP addresses allocated out of the open IP address range spanning the set of viable anonymized replacement IP addresses.

10. The computer-implemented method of claim 1 , wherein the second model retains consistency of source Classless Inter-Domain Routing, retains source IP addressing aggregation, preserves points of network address translation, and preserves non-routed OSI model layer 3 address translation in the mapping of the IP addresses.

11. A computer system for anonymization of IP addresses of a network while preserving a topology of the network, the computer system comprising: a bus system; a storage device connected to the bus system, wherein the storage device stores program instructions; and a processor connected to the bus system, wherein the processor executes the program instructions to:
receive information regarding a network topology;
analyze the information to generate a first model of the network topology;
convert the first model into a second model while preserving the network topology and obfuscating a mapping of the IP addresses; and
utilize the second model to simulate processing of network packets consistent with actual processing of the network packets in the network topology.

12. The computer system of claim 11 , wherein preserving the network topology comprises preserving the network topology in the second model when converting the first model into the second model, and wherein the processor further executes the program instructions to:
perform an analysis of input data corresponding to the network topology; and
identify a set of IP addresses within a source IP address domain of the network topology based on the analysis of the input data corresponding to the network topology.

13. The computer system of claim 12 , wherein the processor further executes the program instructions to:
select an IP address from the set of IP addresses within the source IP address domain of the network topology;
determine a network address prefix portion of the selected IP address selected from the set of IP addresses within the source IP address domain of the network topology; and
search a network database of network addresses corresponding to the network topology for the network address prefix portion of the selected IP address.

14. The computer system of claim 13 , wherein the processor further executes the program instructions to:
determine whether the network address prefix portion of the selected IP address is in the network database; and
generate an entry in the network database for the network address prefix portion of the selected IP address in response to determining that the network address prefix portion of the selected IP address is not in the network database.

15. The computer system of claim 14 , wherein the processor further executes the program instructions to:
apply the network address prefix portion to the selected IP address in response to determining that the network address prefix portion of the selected IP address is in the network database.

16. A computer program product for anonymization of IP addresses of a network while preserving a topology of the network, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method comprising:
receiving, by the computer, information regarding a network topology;
analyzing, by the computer, the information to generate a first model of the network topology;
converting, by the computer, the first model into a second model while preserving the network topology and obfuscating a mapping of the IP addresses; and
utilizing, by the compu

Assignees

• IBM

Inventors

• Tackabury Wayne

Classifications

• H04L63/0407

  wherein the identity of one or more communicating identities is hidden (cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00) · CPC title

• H04L61/2514

  between local and global IP addresses · CPC title

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• H04L61/2539

  Hiding addresses; Keeping addresses anonymous · CPC title

• H04L41/12 Primary

  Discovery or management of network topologies · CPC title