This answer is based on my personal experience building and participating in a number of darknets. I haven't interacted with them in a security perspective, but I have been involved heavily in one (Anonet) and helped found another (Underlink, which is now mostly defunct).
The most important thing to know about a darknet is the definition. My definition of a darknet is a private network with internet-like routing between peers, often on the infrastructure of the actual internet. This is not an all-encompassing definition, this is just the one I am most familiar with.
In practice, what you need to start a darknet are direct connections between machines. These machines will be peers. You can plug an ethernet cable from one computer to another (but usually the machines are hundreds of miles away), or you can setup point-to-point virtual tunnels (I have used quicktun
, sigmavpn
, and openvpn
in the past).
Now that you have two machines directly connected, they need to do some kind of routing. The clients on your darknet are going to want to send packets to arbitrary IP addresses and expect them to get them. This is where your routing comes in. The darknets I have participated in typically use BGP routing. Each server interested in participating in routing typically gets its own ASN (e.g. AS3090). When two machines peer, there is now a connection between the two machines, and the BGP routing daemons you run will be configured to advertise it.
A sample network map will look like this (this is an old visual map of the actual BGP setup on Anonet6):
Each bubble represents a machine doing routing on Anonet. Typically each machine here would get a /24 (the above map is of ano6, but I'll use IPv4 terminology because it's the same idea), and be free to assign addresses inside that however it wanted; that machine would handle final routing for them.
So let's say that AS3090 (lex
, in the middle) is a dedicated machine in some datacenter. All of my computers, though, connect to that server using some standard VPN software (OpenVPN, in this case), and are given addresses on AS3090's /24. If one of my machines connected to AS3090 wants to send a packet to a machine in AS31416 (far right of the map), it has a few simple options:
AS3090 (lex) -> AS1112 (UFO) -> AS31416 (JCS)
AS3090 (lex) -> AS404 (chris) -> AS31415 (JCS) -> AS31416 (JCS)
AS3090 (lex) -> AS404 (chris) -> AS405 (chris) -> AS31416 (JCS)
AS3090 (lex) -> AS2323 (achedaz) -> AS1112 (UFO) -> AS31416 (JCS)
(this is just a subset of possible paths)
This is all part of the BGP routing framework (fwiw, I used bird
and bird6
to handle BGP routing advertisements, but there are many other programs that will do this; it's not necessary that peers use the same software, either).
The first path in my list is the shortest (in number of hops, not necessarily in terms of latency, since each hop could be, and often is, located on a different continent), so the packets will take that path there. The response packets may well take a different path back, but that's not important; as long as they get to the origin server, they can still talk.
The beauty of this setup is that it functions just like the real internet (in fact, core parts of the internet use BGP routing just like this). If AS3090 (lex) loses its connection with AS1112 (UFO), then the packets will automatically choose a different path to AS31416. It's redundant in this way.
This also makes darknets very good for anonymity. If I am AS12345 (dBZ, top middle), the only person on the entire network who knows my true IP (in the case of virtual tunnels over the internet; otherwise, this applies with direct connections or so) is my only peer, AS1 (r101). The rest only see my internal IP inside AS12345's subnet. For authorities, or anybody else, to find out AS12345's location/IP, they have to follow the chain of peers and break each one to find out who they're connecting with. This can be extremely expensive on large darknets, since peers often cross borders (in Anonet, we actually planned out to cross borders for additional anonymity).
This stuff is pretty easy once you understand it. The hard part in growing a network like this is that it's decentralized. Anonet split in half multiple times during its life. The peering between AS3090 (lex) and AS757 (Vutral) could break at any minute, and those two halves of Anonet would completely cease to be connected. But the people in each half would still be able to talk to eachother. You can cut the darknet in half and it still survives.
But typing in a friend's IP address to access their services (websites, file sharing, whatever) isn't fun. You want DNS, right? Well, that requires some central authority to make sure nobody is infringing on eachothers' claims. On Anonet, the way we "solved" that was with something called "resdb": a git
repo containing a set of claims. Anybody could make claims and commit changes. The key was to get others to accept your changes into their copy of the git repo. This meant that different people had different versions of the repo, so for some people a domain doesn't exist, for others it does, and for others it might exist but point somewhere completely different. (resdb contained a set of files and scripts to generate zone files for BIND and similar so that anyone could run their own DNS server for the ano.
TLD).
But you don't just need DNS reservations to be unique. IP allocations should be unique, too. Wouldn't we all like to be 172.160.0.0/24
? If multiple people are using that, we get conflicts, which means that those go in resdb as well and you need to convince people to accept your claims. You also need to handle AS number reservations and a dozen other things that ICANN handles on the internet. It turns into a big mess and it's very hard to scale since there is no central authority which has the final say on reservations.
I hope this gave you a bit of an idea of what a darknet is. Again, this is not a full definition, it's just based on my experiences, and a lot of it isn't really relevant to your goal. I know, for example, that some people have attempted to create darknets by using consumer routers flashed with DD-WRT (to connect geographically close peers together) rather than using the existing infrastructure on the internet.
If you have any questions, please feel free to ask for clarification. I'm no expert, but I have played around with this stuff quite a bit just out of pure interest.
You can read more about Anonet here (some of the information is outdated, though).