Tunneling for network deceptions

Abstract

Provided are systems, methods, and computer-program products for providing network deceptions using a network tunnel. In various implementations, a network device on a first network can be configured as a projection point. A projection point can be configured as one endpoint of a network tunnel. The other end of the network tunnel can terminate at a deception farm. The deception farm can host a second network, where the second network includes network devices configured as deception mechanisms. By assigning a deception mechanism a network address from the first network, the network address and the network tunnel enable the deception mechanism to appear as a node in the first network.

1 . (canceled) 
     
     
         2 . A computer-implemented method, comprising:
 determining, by a projection point configured on a network device on a first network, a network address, wherein:   the network address is determined from available network addresses in the first network; and   the first network is a cloud segment;   configuring a network tunnel to a second network, wherein the second network includes one or more deception mechanisms;   selecting a deception mechanism from among the one or more deception mechanisms; and   assigning the network address to the selected deception mechanism, wherein the network address and the network tunnel enable the selected deception mechanism to be on the first network.   
     
     
         3 . The computer-implemented method of  claim 2 , wherein, when selected, the selected deception mechanism does not have a network address in the first network. 
     
     
         4 . The computer-implemented method of  claim 2 , wherein the cloud segment is hosted by a cloud services provider. 
     
     
         5 . The computer-implemented method of  claim 4 , the computer-implemented method further comprising communicating with systems of the cloud services provider to determine a suitable deception mechanism. 
     
     
         6 . The computer-implemented method of  claim 2 , wherein the network tunnel is hidden from other devices on the first network. 
     
     
         7 . The computer-implemented method of  claim 2 , wherein the network device on the first network is an appliance of the first network. 
     
     
         8 . The computer-implemented method of  claim 2 , wherein:
 the first network includes a local segment;   the cloud segment has cloud network devices; and   the local segment has local network devices.   
     
     
         9 . A network device comprising:
 one or more processors; and   a non-transitory computer-readable medium including instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including:   determining a network address on a first network, wherein:   the network address is determined from available network addresses in the first network; and   the first network is a cloud segment;   configuring a network tunnel to a second network, wherein the second network includes one or more deception mechanisms;   selecting a deception mechanism from among the one or more deception mechanisms; and   assigning the network address to the selected deception mechanism, wherein the network address and the network tunnel enable the selected deception mechanism to be on the first network.   
     
     
         10 . The network device of  claim 9 , wherein, when selected, the selected deception mechanism does not have a network address in the first network. 
     
     
         11 . The network device of  claim 9 , wherein the cloud segment is hosted by a cloud services provider. 
     
     
         12 . The network device of  claim 11 , wherein the instructions, when executed, cause the one or more processors to communicate with systems of the cloud services provider to determine a suitable deception mechanism. 
     
     
         13 . The network device of  claim 9 , wherein the network tunnel is hidden from other devices on the first network. 
     
     
         14 . The network device of  claim 9 , wherein the cloud segment comprises virtual machines. 
     
     
         15 . The network device of  claim 9 , wherein:
 the first network includes a local segment;   the cloud segment has cloud network devices; and   the local segment has local network devices.   
     
     
         16 . A computer-program product tangibly embodied in a non-transitory machine-readable storage medium, including instructions that, when executed by one or more processors, cause the one or more processors to:
 determine, by a projection point configured on a network device on a first network, a network address, wherein:   the network address is determined from available network addresses in the first network; and   the first network is a cloud segment;   configure a network tunnel to a second network, wherein the second network includes one or more deception mechanisms;   select a deception mechanism from among the one or more deception mechanisms; and   assign the network address to the selected deception mechanism, wherein the network address and the network tunnel enable the selected deception mechanism to be on the first network.   
     
     
         17 . The computer-program product of  claim 16 , wherein, when selected, the selected deception mechanism does not have a network address in the first network. 
     
     
         18 . The computer-program product of  claim 16 , wherein the cloud segment of the first network is hosted by a cloud services provider, and the cloud services provider operates a data center where hardware and/or software resources can be dynamically allocated to different customers. 
     
     
         19 . The computer-program product of  claim 18 , wherein the instructions, when executed, cause the one or more processors to communicate with systems of the cloud services provider to determine a suitable deception mechanism. 
     
     
         20 . The computer-program product of  claim 16 , wherein the network tunnel is hidden from other devices on the first network. 
     
     
         21 . The computer-program product of  claim 16 , wherein:
 the first network includes a local segment;   the cloud segment has cloud network devices; and   the local segment has local network devices.