Methods and systems for network security using a cryptographic firewall

Patent metadata

Field	Value
Publication number	US-11265167-B2
Application number	US-202017076022-A
Country	US
Kind code	B2
Filing date	Oct 21, 2020
Priority date	Jan 27, 2016
Publication date	Mar 1, 2022
Grant date	Mar 1, 2022

Abstract

A method is performed at a security device. The method includes establishing a network connection with a client system. After establishing the network connection, the security device receives a first packet from the client system. The first packet includes an identifier, a first counter value, and a first one-time password hash generated by the client system. Based on the identifier received, the security device retrieves from a trusted data store the seed and a second counter value. If the first counter value is larger than the second counter value, the security device generates a second one-time password hash based on the identifier, the first counter value, and the seed. In accordance with a determination that the first and second one-time password hashes match, the security device grants, to the client system, access to one or more network resources protected by the security device via the network connection.

First claim

What is claimed is:

1. A method, comprising:
at a security device having one or more processors and memory storing one or more programs for execution by the one or more processors:
establishing a network connection with a client system;
after establishing the network connection, receiving from the client system a first packet, the first packet including:
an identifier,
a first counter value, wherein the first counter value is one of a plurality of incremental counts generated by a system counter, and
a first one-time password hash generated by the client system based on the identifier, the first counter value, and a seed;

based on the identifier received from the client system, retrieving from a trusted data store the seed and a second counter value;
based on the first counter value being larger than the second counter value:
generating a second one-time password hash based on the identifier, the first counter value, and the seed;
determining whether the first one-time password hash and the second one-time password hash match; and
in accordance with a determination that the first one-time password hash and the second one-time password hash match, granting, to the client system, access to one or more network resources protected by the security device via the network connection,

wherein receiving the first packet comprises receiving the first packet in a TLS Client Hello message, wherein the first packet is placed within a random field of the TLS Client Hello message.

2. The method of claim 1 , wherein the identifier and the seed are provided to the client system by the trusted data store based on a request for an identifier and seed pair, and prior to the security device establishing the network connection with the client system.

3. The method of claim 1 , wherein the system counter is updated each time the system counter receives a packet from the client system.

4. The method of claim 1 , wherein the trusted data store includes the system counter, and wherein the system counter monotonically increases for each request received from the client system.

5. The method of claim 1 , wherein the system counter is updated in accordance with a determination that the first one-time password hash and the second one-time password hash match.

6. The method of claim 1 , further comprising terminating the network connection with the client system, based on the first counter value being less than or equal to the second counter value.

7. The method of claim 1 , further comprising terminating the network connection with the client system in accordance with a determination that the first one-time password hash and the second one-time password hash do not match.

8. The method of claim 7 , wherein terminating the network connection with the client system comprises sending a reset packet to the client system.

9. The method of claim 7 , wherein terminating the network connection with the client system comprises forgoing acknowledgment of packets received from the client system.

10. The method of claim 7 , wherein terminating the network connection with the client system further comprises clearing table entries associated with a connection request.

11. The method of claim 1 , wherein receiving the first packet comprises receiving the first packet embedded in a body of an HTTP POST.

12. The method of claim 1 , wherein receiving the first packet comprises receiving the first packet embedded within an HTTP GET URL.

13. The method of claim 1 , wherein establishing the network connection with the client system comprises:
prior to receiving the first packet from the client system, receiving a SYN packet from the client system;
based on receiving the SYN packet, sending a SYN-ACK packet to the client system; and
after sending the SYN-ACK packet, receiving, from the client system, an ACK packet, thereby establishing the network connection and permitting receipt of the first packet from the client system.

14. The method of claim 1 , wherein the identifier and the seed are provided to the client system by the trusted data store system in response to authenticating the client system.

15. A device, comprising:
one or more processors; and
memory storing one or more programs for execution by the one or more processors, the one or more programs including instructions to:
establish a network connection with a client system;
after establishment of the network connection, receive from the client system a first packet, the first packet including:
an identifier,
a first counter value, wherein the first counter value is one of a plurality of incremental counts generated by a system counter, and
a first one-time password hash generated by the client system based on the identifier, the first counter value, and a seed;

based on the identifier received from the client system, retrieve from a trusted data store the seed and a second counter value;
based on the first counter value being larger than the second counter value:
generate a second one-time password hash based on the identifier, the first counter value, and the seed;
determine whether the first one-time password hash and the second one-time password hash match; and
in accordance with a determination that the first one-time password hash and the second one-time password hash match, grant, to the client system, access to one or more network resources protected by the device via the network connection,

wherein the first packet is included in a TLS Client Hello message, and wherein the first packet is placed within a random field of the TLS Client Hello message.

16. The device of claim 15 , wherein the identifier and the seed are provided to the client system by the trusted data store in response to a request for an identifier and seed pair, and prior to the device establishing the network connection with the client system.

17. The device of claim 15 , wherein the system counter is updated in accordance with a determination that the first one-time password hash and the second one-time password hash match.

18. The device of claim 15 , further including instructions to:
terminate the network connection with the client system, based on at least one of
the first counter value being less than or equal to the second counter value, or
the first one-time password hash and the second one-time password hash do not match.

19. The device of claim 18 , wherein terminating the network connection with the client system comprises at least one of:
sending a reset packet to the client system;
forgoing acknowledgment of packets received from the client system; or
clearing table entries associated with a connection request.

20. The device of claim 15 , wherein establishing the network connection with the client system comprises:
prior to receiving the first packet from the client system, receiving a SYN packet from the client system;
based on receiving the SYN packet, sending a SYN-ACK packet to the client system; and
after sending the SYN-ACK packet, receiving, from the client system, an ACK packet, thereby establishing the network connection and permitting receipt of the first packet from the client system.

Assignees

• Verizon Patent & Licensing Inc

Inventors

• Schroeder Ted
• Lengyel Gabor

Classifications

• H04L63/0838

  using one-time-passwords · CPC title

• H04L9/0863

  involving passwords or one-time passwords (network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067) · CPC title

• H04L9/3228 Primary

  One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L9/0869

  involving random numbers or seeds · CPC title