Secure communications with internet-enabled devices

Patent metadata

Field	Value
Publication number	US-10135790-B2
Application number	US-201615040655-A
Country	US
Kind code	B2
Filing date	Feb 10, 2016
Priority date	Aug 25, 2015
Publication date	Nov 20, 2018
Grant date	Nov 20, 2018

Abstract

A network device allows inbound connections from external addresses to a computer on a local network while forbidding output connections from the computer to that external address unless preceded by an inbound connection therefrom. In some embodiments, the computer is allowed to accept inbound connections from external addresses but is not permitted to initiate outbound connections to other computers in the local network unless preceded by an inbound connection. In some embodiments, a request from an external address is processed by the network device by transmitting network information for the computer to the external address and temporarily changes network rules to allow connections from the external address. In some embodiments, if the computer attempts a disallowed connection, the connection attempt is routed through a proxy server by providing network data for the proxy server to the computer.

First claim

What is claimed is:

1. A system for networking comprising:
a local network including at least one networking device configured to transport data among computers within the local network;
a first device coupled to the local network comprising at least one processing device and means for performing networked communication, the first device being programmed to initiate outbound connections, at least one outbound connection including an external address that does not correspond to any device within the local network; and
a second device coupled to the local network and having at least one connection to an external network;
wherein the external network address of each outbound connection references an external device coupled to the external network, the second device being further programmed to:
(a) receive one or more inbound connections, each inbound connection being addressed to the first device and received from a source address of the each inbound connection that is in the external network and outside of the local network, record the source address of the each inbound connection as one of one or more stored source addresses for the one or more inbound connections; and
(b) for each outbound connection of one or more outbound connections received from the first device:
(i) compare the external address of the each outbound connection to the one or more stored source addresses for the one or more inbound connections, the external address of the each outbound connection being in the external network;
(ii) when the external address of the each outbound connection matches one of the one or more stored source addresses for the one or more inbound connections, permit transmission of the each outbound connection to the external address of the each outbound connection; and
(iii) when the external address of the each outbound connection does not match any of the stored source addresses for the one or more inbound connections, block transmission of the each outbound connection to the external address of the each outbound connection.

2. The system of claim 1 , wherein the second device is further programmed to, for each outbound connection of the one or more outbound connections:
if the external address of the each outbound connection is included in a white list, permit the each outbound connection to the external address of the each outbound connection; and
if the destination address of the each outbound connection is not included in the white list, blocking the each outbound connection; and
wherein the second device is further programmed to permit at least a portion of the one or more inbound connections having the source addresses thereof not included in the white list.

3. The system of claim 2 , wherein the whitelist stores one or more network identifiers each including at least one of a domain name, an internet protocol (IP) address and port.

4. The system of claim 1 , wherein the second device is programmed to permit those of the one or more outbound connections from the first device having a first external address preceded by an inbound connection of the one or more inbound connections having the source address thereof that is the first address and to block one or more subsequent outbound connections from the first device to addresses different from the first address, including addresses different from the first address that were in the source address of previously-received inbound connections of the one or more inbound connections.

5. The system of claim 1 , wherein the second device is further programmed to permit each outbound connections of the one or more outbound connections from the first device only if an inbound connection referencing from the external address of the each outbound connections uses a specific destination port from a set of ports specified in the second device.

6. The system of claim 1 , wherein the second device is further programmed to block each outbound connection of the one or more outbound connections from the first device and to allow the first device to accept inbound connections of the one or more inbound connections having the source address thereof in the external network.

7. The system of claim 1 , wherein the first device is programmed to execute both a hyper-text transfer protocol (HTTP) server and a HTTP client; and
wherein the second device is further programmed to block connection attempts from the HTTP client to remote devices in the external network, while allowing connections from the remote devices to reach the HTTP server.

8. The system of claim 1 , wherein the second device comprises at least one of a gateway, a router, a bridge, a switch and a firewall.

9. A system for networking comprising:
a local network including at least one networking device configured to transport data among computers within the local network;
a first device coupled to the local network comprising at least one processing device and means for performing networked communication, the first device being programmed to initiate outbound connections, at least one outbound connection corresponding to any of the computers within the local network; and
a second device coupled to the local network and being programmed to manage connections between computers within the local network, the second device being further programmed to:

(a) accept one or more inbound connections from external IP addresses outside of the local network;
(b) detect an outbound connection request from the first device to another device on the local network;
(c) allow the outbound connection when an inbound connection of the one or more inbound connections both referenced the first device and was previously received from one of the external IP addresses; and
(d) block the outbound connection when none of the one or more inbound connection connections both referenced the first device and was previously received from one of the external IP addresses.

10. The system of claim 9 , wherein the computers within the local network include a first group of devices and a second group of devices;
wherein the second device is further programmed to apply first rules to a first group of devices in the local network and second rules to a second group of devices on the local network, the first rules being different form the second rules such that the second device is programmed to block connections from the first group to the second group, but programmed to allow local connections from the second group to the first group.

11. The system of claim 9 , wherein the second device is one of a gateway, a router, a bridge, a switch, a proxy and a firewall.

12. The system of claim 9 , wherein the second device programmed to identify the computers on the local network by information obtained from at least one of Address Resolution Protocol (ARP), multicast Domain Name Service (mDNS), and Simple Service Discovery Protocol (SSDP).

13. The system of claim 9 , wherein the second devices is programmed to identify at least one computer from the computers on the local network by a name and description of the at least one computer.

14. The system of claim 9 , wherein the second device is further programmed to block one or more local connections by blocking at least one data packet from a computer of the computers on the local network that initiated the one or more local connections.

15. The system of claim 9 , wherein the second device is further programmed to block one or more local connections by blocking at least one data packet from a computer of the computers on the local network transmitted in response to the one or more local conn

Assignees

• Anchorfree Inc

Inventors

• Lapidous Eugene
• Arsitov Artem

Classifications

• H04L63/029

  Firewall traversal, e.g. tunnelling or, creating pinholes · CPC title

• H04L61/2575

  using address mapping retrieval, e.g. simple traversal of user datagram protocol through session traversal utilities for NAT [STUN] · CPC title

• H04L63/0272

  Virtual private networks · CPC title

• H04L63/0281 Primary

  Proxies · CPC title

• H04L65/1069

  Session establishment or de-establishment · CPC title