Private IP Address Research Articles

Development of a secure video chat based on the WebRTC standard for video conferencing

The article describes the process of developing a secure video chat based on the WebRTC standard for establishing a connection and exchanging information between end users during a video conference. The analysis of a variety of technologies when creating a video chat was performed, theoretical information on the WebRTC standard was studied. As a result of the analytical review, the shortcomings of the WebRTC technology were revealed - disclosure of the private IP address of the system user. Therefore, an application architecture was proposed that solves this problem. Conventionally, the architecture consists of a number of entities - sending a message to the signal and STUN servers to obtain the necessary information for making a video call and a loop that, using an open socket connection, listens, transmits and reproduces audio and media streams between system participants. A software product was also written as part of this work, which allows you to use video chat without the risk of revealing a private IP address. This product was also compared with existing analogues and a number of features were identified. The developed product can be used for online conferences. To organize a broadcast, you only need to create a room and share a link with its participants. The advantage of this development is security because data transmission occurs only over HTTPS, media streams are encrypted (DTLS and SRTP), the technology does not require the installation of plug-ins. In addition, there is no need to install additional software, the service is cross-platform, supported by most browsers.

A Malware Distribution Simulator for the Verification of Network Threat Prevention Tools.

With the expansion of the Internet of Things (IoT), security incidents about exploiting vulnerabilities in IoT devices have become prominent. However, due to the characteristics of IoT devices such as low power and low performance, it is difficult to apply existing security solutions to IoT devices. As a result, IoT devices have easily become targets for cyber attackers, and malware attacks on IoT devices are increasing every year. The most representative is the Mirai malware that caused distributed denial of service (DDoS) attacks by creating a massive IoT botnet. Moreover, Mirai malware has been released on the Internet, resulting in increasing variants and new malicious codes. One of the ways to mitigate distributed denial of service attacks is to render the creation of massive IoT botnets difficult by preventing the spread of malicious code. For IoT infrastructure security, security solutions are being studied to analyze network packets going in and out of IoT infrastructure to detect threats, and to prevent the spread of threats within IoT infrastructure by dynamically controlling network access to maliciously used IoT devices, network equipment, and IoT services. However, there is a great risk to apply unverified security solutions to real-world environments. In this paper, we propose a malware simulation tool that scans vulnerable IoT devices assigned a private IP address, and spreads malicious code within IoT infrastructure by injecting malicious code download command into vulnerable devices. The malware simulation tool proposed in this paper can be used to verify the functionality of network threat detection and prevention solutions.

A Secure Internet of Things Smart Home Network: Design and Configuration

Many home IoT devices are joining IoT networks by gaining access to some home gateway that configures smart, multimedia, and home networks. To enable secure IoT-based home networking services, (1) an IoT network should be effectively designed and configured with a IoT server, (2) a messaging protocol is required to exchange information between the IoT server and IoT devices, and (3) the home gateway should monitor all safety aspects in both inbound and outbound traffic of the home network. However, not all home network users put in consideration the need for an adequate security posture. Instead, many users still rely on the minimum home network security by setting an easiest-to-guess password to restrict unauthorized access to their home gateway. In this paper, we propose a network design and configuration that enables secure IoT services with MQTT messaging protocol for home networks. With the proposed network design, a home network is interconnected to external networks through a home gateway. To separate the IoT-subnet from other parts of home network, the home gateway subdivides a home network into an inside-subnet and an IoT-subnet with a private IP address using subnet masking. The IoT server, located in the IoT-subnet can be implemented with either a general HTTP server or a security server that acts as an MQTT broker. The secure communications among network entities are governed by a home gateway operating a well-configured extended access control. The effectiveness of the proposed design and configuration is verified through a simulation by showing that it does not impose any significant performance degradation for reinforced security. We expect the proposed configuration to help facilitate interconnection among heterogeneous network entities.

Probe Delay Based Adaptive Port Scanning for IoT Devices with Private IP Address Behind NAT

Recently, the explosive increase in the number of IoT devices makes the IoT becomes extremely large-scaled, and the security of such a large scale IoT emerges as a big challenge. As a classic security technique, the port scan is widely used around the world. However, as IP resources are limited, a large number of devices are located in the LAN or WLAN behind the NAT which cannot be directly accessed by the port scanner. Furthermore, port scanning generated a tremendous number of probe and response packets which may cause heavy traffic load and frequent congestion. To conquer those problems, in this article, we first propose a reverse proxy based NAT penetration system for scanning ports behind NAT. Based on the NAT penetration system, we proposed a probe delay based adaptive scanning algorithm referred to as ProDASA, which adaptively changes port scanning frequency and scanning methods to balance the network performance and security requirements of the IoT. The experiment in a real environment demonstrates the feasibility of the proposed NAT penetration system and the computational simulation with multiple virtual devices shows the advantage of our proposed ProDASA in terms of both network performance and security by comparing with a conventional method.

Decentralized Distribution of PCP Mappings Over Blockchain for End-to-End Secure Direct Communications

Network Address Translation (NAT) is a method that enables devices with private IP addresses to connect to the Internet by sharing a public IP address. Traversing the NAT device remains a challenge for a wide range of applications such as Voice over IP (VoIP) and Internet of Things (IoT). The Port Control Protocol (PCP) is a relatively new protocol standardized by the Internet Engineering Task Force (IETF) to solve the NAT traversal issues. It allows a NATed device to request and manage a mapping between its private IP address and transport-layer port to a public IP address and port. As PCP requires an application-dependent method for distributing the mappings to remote hosts, several attacks can target the distributing server and render the communication channel vulnerable. In this paper, we propose and implement a decentralized Blockchain-based approach for distributing PCP-mappings, enabling secure end-to-end (e2e) direct communications without any trusted third party server. NATed devices register their PCP mappings and public keys into the Blockchain, and other peers can then learn about these mappings to establish end-to-end secure direct communications. The implementation verifies that the system is feasible in terms of transactions fees, can simplify and secure end-to-end direct communications, and can interwork with conventional security methods.

A method for forensic artefact collection, analysis and incident response in environments running session initiation protocol and session description protocol

In this paper, we perform an analysis of SIP, a popular voice over IP (VoIP) protocol and propose a framework for capturing and analysing volatile VoIP data in order to determine forensic readiness requirements for effectively identifying an attacker. The analysis was performed on real attack data and the findings were encouraging. It seems that if appropriate forensic readiness processes and controls are in place, a wealth of evidence can be obtained. The type of the end user equipment of the internal users, the private IP, the software that is used can help build a reliable baseline information database. On the other hand the private IP addresses of the potential attacker even during the presence of NAT services, as well as and the attack tools employed by the malicious parties are logged for further analysis.

A conflict-insensitive NATed roaming framework using NAToD for proxy mobile IPv4 in WLANs

Providing efficient mobility management in the current Internet is increasingly important due to the quick growth of wireless mobile users. The emerging Proxy Mobile IPv4 (PMIPv4) technique brings a possible solution for that purpose. Since NAT function is widely adopted in IPv4 environment nowadays because of lacking IPv4 addresses, the PMIPv4 interoperating with NAT must be considered. Unfortunately, owing to the possible conflict of private IP address, we encounter a problem in broadcasted point-to-multipoint wireless networks such as IEEE 802.11 networks. To address this issue, we proposed a novel Network Address Translation on Demand (NAToD) scheme, which can well interoperate with the PMIPv4 solution. With our scheme, single public IPv4 addresses can be shared by multiple mobile nodes in both home and foreign networks, low-latency handoff can be achieved, deployment cost can be reduced, and software upgrade can be avoided for mobile nodes in wireless LANs. Our work allows mobile users in WLAN to access Internet based on the advantages of both PMIPv4 and NAT.

Using Mussel-Inspired Self-Organization and Account Proxies to Obfuscate Workload Ownership and Placement in Clouds

Recent research has provided evidence indicating how a malicious user could perform coresidence profiling and public-to-private IP mapping to target and exploit customers which share physical resources. The attacks rely on two steps: resource placement on the target's physical machine and extraction. Our proposed solution, in part inspired by mussel self-organization, relies on user account and workload clustering to mitigate coresidence profiling. Users with similar preferences and workload characteristics are mapped to the same cluster. To obfuscate the public-to-private IP map, each cluster is managed and accessed by an account proxy. Each proxy uses one public IP address, which is shared by all clustered users when accessing their instances, and maintains the mapping to private IP addresses. We describe a set of capabilities and attack paths an attacker needs to execute for targeted coresidence, and present arguments to show how our approach disrupts the critical steps in the attack path for most cases. We then perform a risk assessment to determine the likelihood an individual user will be victimized, given that a successful nondirected exploit has occurred. Our results suggest that while possible, this event is highly unlikely.

IP2P: a peer-to-peer system for mobile devices

Peer-to-peer communications is a major trend in wireless Internet. In a P2P system, the calling peer must identify the network address of the called peer before establishing a P2P connection. This article proposes iP2P, a hybrid P2P system for mobile devices. iP2P utilizes the short message service as the control protocol to identify the address of the called peer. Our approach provides an efficient identification mechanism without the requirement for the maintenance of a centralized registrar server in a hybrid P2P system. We also show how iP2P can integrate effectively with the existing network address translation traversal mechanisms to solve the private IP address issue.

A novel strategy for building interoperable MPI environment in heterogeneous high performance systems

Breakthrough advances in microprocessor technology and efficient power management have altered the course of development of processors with the emergence of multi-core processor technology, in order to bring higher level of processing. The utilization of many-core technology has boosted computing power provided by cluster of workstations or SMPs, providing large computational power at an affordable cost using solely commodity components. Different implementations of message-passing libraries and system softwares (including Operating Systems) are installed in such cluster and multi-cluster computing systems. In order to guarantee correct execution of message-passing parallel applications in a computing environment other than that originally the parallel application was developed, review of the application code is needed. In this paper, a hybrid communication interfacing strategy is proposed, to execute a parallel application in a group of computing nodes belonging to different clusters or multi-clusters (computing systems may be running different operating systems and MPI implementations), interconnected with public or private IP addresses, and responding interchangeably to user execution requests. Experimental results demonstrate the feasibility of this proposed strategy and its effectiveness, through the execution of benchmarking parallel applications.

Meta-communications in component-based communication frameworks for grids

Applications are faced with several network-related problems on current grids: heterogeneous networks, firewalls, NAT, private IP addresses, non-routed networks, performance problems on WAN. Moreover, the requirements concerning communications are varied and the acceptable tradeoffs highly depends on the applications. A solution to reach the flexibility regarding communication on grids is the use of a component-based communication framework. The users then compose their own protocol stacks by assembling building blocks in the way they want. However, a truly flexible and dynamic component-based communication framework needs a meta-communication channel for its out-of-band communications required by dynamic component assembly in a consistent way on multiple nodes. The meta-communication channel is useful for some “brokered” communication methods, too, and in particular those designed to cross firewalls. The meta-communication channel has often been the “weakest link” of component-based communication frameworks: bottleneck for the performance, back-door from the security point of view, and limited connectivity. In this article, we present an architecture for a meta-communication channel that suffers from none of the aforementioned limitations. It exhibits good properties regarding connectivity, security and performance. Thus, the gain in flexibility brought by software components may be fully exploited without trading anything against flexibility.

Running Large-Scale Applications on Cluster Grids

Grid computing enables the enormous, but often poorly utilized, computing resources existing on the Internet to be harnessed in order to solve large-scale problems. However, if they want to solve the problems of configuration and performance optimization of their large-scale applications, programmers wishing to exploit such computing resources have to deal with highly variable communication delays, security threats, machine and network failures, and the distributed ownership of the computing resources. On the other hand, Parallel Virtual Machine (PVM) is still widely used to develop high performance parallel applications on high performance/cost ratio computing platforms, such as workstation clusters. However, workstations belonging to networked clusters cannot often be exploited since they are provided with private IP addresses, being hidden from the Internet by publicly addressable IP front-end machines. This paper presents an extension of PVM that enables such clustered machines hidden from the Internet to take part in a PVM computation as host machines. This way, programmers can exploit low-cost, networked computing resources, such as collections of clusters, widely available within departmental organizations, in a well-known programming environment, such as PVM, without having to tackle the problems affecting grid computing, which often ends up turning the development of parallel applications into a burdensome activity as well as penalizing application performance.

Private-to-private communications over the internet

The meet-in-the-middle network provides a simple way to restore end-to-end connectivity between distant hosts located behind network address translators, and does so without reconfiguring the NAT devices that lie on the path between the hosts. The article proposes an internetworking method as part of a broader research project involving remote access to various IP-ready sensors, computers, cameras, and microphones installed in the home environment to monitor the health and safety of bedridden quadriplegic patients. This system configures all its IP devices with private IP addresses.

A push mechanism for GPRS supporting private IP addresses

The General Packet Radio Service (GPRS) provides a packet switched data service for mobile users. However, the existing GPRS specification does not provide the push mechanism and it is difficult to support GPRS services such as call termination (incoming call) for wireless voice over IP (VoIP). Based on the short message service, this paper proposes a push mechanism for GPRS supporting private IP addresses. Our approach does not need to modify the existing GPRS structure.