1. A system, comprising:
a bastion host configured to:
determine, based on a destination address included in packet header information of a data packet, whether a remote bastion host is configured to perform adaptive self-synchronized dynamic address translation (ASD);
generate a cipher key by the bastion host when the remote bastion host is not configured to perform ASD;
generate the cipher key according to a handshake with the remote bastion host when the remote bastion host is configured to perform ASD; and
add an entry to an active connection table including the generated cipher key and at least a subset of the packet header information of the data packet.
2. The system of claim 1, wherein the bastion host is further configured to:
encrypt predetermined portions of the packet header information into translated packet header information according to a cipher algorithm keyed by the cipher key; and
replace the predetermined portions of the packet header information with the translated packet header information in the data packet.
3. The system of claim 2, wherein the bastion host is further configured to transmit the data packet from the bastion host to the remote bastion host after replacing the predetermined portions of the packet header information with the translated packet header information.
4. The system of claim 1, wherein the bastion host is further configured to query a host table for an address of the remote bastion host, and determine based on the query whether the destination address is associated with a remote bastion host configured to perform ASD.
5. The system of claim 1, wherein the bastion host is further configured to:
generate a second cipher key according to a second handshake with the remote bastion host when the remote bastion host is configured to perform ASD; and
update the entry in the active connection table to replace the cipher key with the second cipher key.
6. The system of claim 5, wherein the bastion host is further configured to initiate the generation of the second cipher key after expiration of a timeout value.
7. The system of claim 5, wherein the bastion host is further configured to:
encrypt predetermined portions of packet header information of a second data packet according to the cipher algorithm keyed by the second cipher key into second translated packet header information; and
replace the predetermined portions of the packet header information of the second data packet with the second translated packet header information.
8. The system of claim 1, wherein the bastion host is further configured to:
receive a second data packet from the remote bastion host;
perform a lookup in the active connection table for predetermined portions of packet header information of the second data packet; and
when a matching entry is found in the active connection table, restore predetermined portions of packet header information of the second data packet using a cipher key included in the matching entry of the active connection table.
9. A method, comprising:
receiving, at a bastion host, a packet including packet header information, the packet information including a destination address;
determining, by a bastion host, whether the destination address is associated with a remote bastion host configured to perform adaptive self-synchronized dynamic address translation (ASD);
generating a cipher key by the bastion host based on a determination that the remote bastion host is not configured to perform ASD;
generating the cipher key according to a handshake with the remote bastion host based on a determination that the remote bastion host is configured to perform ASD; and
adding an entry to an active connection table including the cipher key and destination address.
10. The method of claim 9, further comprising:
translating predetermined portions of the packet header information according to a cipher algorithm keyed by the cipher key into translated packet header information; and
replacing the predetermined portions of the packet header information with the translated packet header information in the data packet.
11. The method of claim 10, further comprising transmitting the packet from the bastion host to the remote bastion host after replacing the predetermined portions of the packet header information.
12. The method of claim 9, further comprising:
generating a second cipher key according to a second handshake with the remote bastion host;
translating predetermined portions of packet header information of a second packet according to the cipher algorithm keyed by the second cipher key into second translated packet header information; and
replacing the predetermined portions of the packet header information of the second packet with the second translated packet header information.
13. The method of claim 12, wherein generating a second cipher key according to a second handshake with the remote bastion host is performed after expiration of a handshake timeout.
14. The method of claim 9, further comprising:
receiving a second data packet from the remote bastion host;
performing a lookup in the active connection table for predetermined portions of packet header information of the second data packet; and
when a matching entry is found in the active connection table, restoring predetermined portions of packet header information of the second data packet using a cipher key included in the matching entry of the active connection table.
15. The system of claim 2, wherein the bastion host is further configured to at least one of:
replace at least predetermined portions of a source address and the destination address of the packet header information in the data packet with the translated packet header information when the remote bastion host is configured to perform ASD; and
replace at least predetermined portions of the source address but not the destination address of the packet header information in the data packet with the translated packet header information when the remote bastion host is not configured to perform ASD.
16. The system of claim 8, wherein the bastion host is further configured to, when the matching entry is not found in the active connection table, at least one of: (i) drop the second data packet, and (ii) return an obfuscated reply disguising that the second data packet is identified by the bastion host as not being found in the active connection table.
17. The system of claim 8, wherein the second data packet is a reply to the data packet, and the bastion host is further configured to restore the predetermined portions of the packet header information of the second data packet based on the at least a subset of the packet header information of the data packet included in the matching entry of the active connection table.
18. The method of claim 10, further comprising:
replacing at least predetermined portions of a source address and the destination address of the packet header information in the data packet with the translated packet header information when the remote bastion host is configured to perform ASD; and
replacing at least predetermined portions of the source address but not the destination address of the packet header information in the data packet with the translated packet header information when the remote bastion host is not configured to perform ASD.
19. The method of claim 14, further comprising, when the matching entry is not found in the active connection table, at least one of: (i) dropping the second data packet, and (ii) returning an obfuscated reply disguising that the second data packet is identified as not being found in the active connection table.
20. The method of claim 14, wherein the second data packet is a reply to the data packet, and further comprising restoring the predetermined portions of the packet header information of the second data packet based on the at least a subset of the packet header information of the data packet included in the matching entry of the active connection table.
The claims below are in addition to those above.
All refrences to claim(s) which appear below refer to the numbering after this setence.
1. A penetration-resistant article comprising:
a first layer of woven fabric;
a second layer of woven fabric adjacent the first layer of woven fabric;
the first and second layers of woven fabric each comprising a first series of fibers aligned in a first direction and a second series of fibers interwoven with the first series of fibers and aligned in a second direction perpendicular to the first direction;
the first and second layers of woven fabric loosely stacked together so as to permit relative slippage therebetween;
wherein the first and second directions of the fibers in the first layer of woven fabric are rotationally offset to the first and second directions in the second layer of woven fabric by an offset angle selected so as to inhibit mechanical interference between opposing adjacent surfaces of the first and second woven fabric layers during slippage therebetween,
wherein the first and second layers of woven fabric are combined in a bag or envelope that surrounds the first and second layers of woven fabric and maintains the relative rotational offset of the stacked fabric layers, and
wherein the penetration-resistant article is resistant to penetration by a sharpened object and meets or exceeds Level 1 National Institute of Justice (NIJ) standard 0115.00 for stab resistance of personal body armor.
2. The penetration-resistant article of claim 1, wherein the offset angle is about 45 degrees.
3. The penetration-resistant article of claim 1, wherein the offset angle is about between 5 and 45 degrees.
4. The penetration-resistant article of claim 1, wherein the offset angle is about between 30 and 45 degrees.
5. The penetration-resistant article of claim 1, wherein the offset angle is selected so as to improve the relative slippage between adjacent layers of woven fabric.
6. The penetration-resistant article of claim 1, further comprising a third layer of woven fabric loosely stacked on the second layer so as to permit relative slippage between the second layer and third layer.
7. The penetration-resistant article of claim 6, wherein the first and second directions of the fibers in the third layer are rotationally offset to the first and second directions of the fibers in the second layer of woven fabric by a second offset angle selected so as to inhibit mechanical interference between opposing adjacent surfaces of the second and third woven fabric layers during slippage therebetween.
8. The penetration-resistant article of claim 7, wherein the first and second offset angle are different.
9. The penetration-resistant article of claim 7, wherein the first and second offset angle are about the same.
10. The penetration-resistant article of claim 7, further comprising a fourth layer of woven fabric loosely stacked on the third layer so as to permit relative slippage between the third layer and fourth layer, and wherein the first and second directions of the fibers in the fourth layer are rotationally offset to the first and second directions of the fibers in the third layer of woven fabric by a third offset angle selected so as to inhibit mechanical interference between opposing adjacent surfaces of the third and fourth woven fabric layers during slippage therebetween.
11. The penetration-resistant article of claim 1, wherein the article comprises between 3 and 25 layers of woven fabric and at least some of the layers of woven fabric are loosely stacked and rotationally offset so as to inhibit mechanical interference between opposing adjacent surfaces of the woven fabric layers during slippage therebetween.
12. The penetration-resistant article of claim 1, wherein the woven fabric is a plain-woven fabric.
13. The penetration-resistant article of claim 1, wherein the fibers are aramid fibers.
14. The penetration-resistant article of claim 1, wherein the article meets or exceeds Level 2 andor Level 3, National Institute of Justice (NIJ) standard 0115.00 for stab resistance of personal body armor.
15. The penetration-resistant article of claim 1, wherein the first and second layers of woven fabric are combined by attaching the layers of woven fabric at one or more spots along the perimeter of the fabric.
16. The penetration-resistant article of claim 1, wherein the layers of woven fabric are not stitched together.
17. The penetration-resistant article of claim 1, wherein greater than 50% of the opposing surfaces of the first and second layers of woven fabric are not mechanically coupled.
18. The penetration-resistant article of claim 1, wherein greater than 90% of the opposing surfaces of the first and second layers of woven fabric are not mechanically coupled.