Authentication of remote host via closed ports

Patent metadata

Field	Value
Publication number	US-9374339-B2
Application number	US-201414451129-A
Country	US
Kind code	B2
Filing date	Aug 4, 2014
Priority date	Jan 21, 2005
Publication date	Jun 21, 2016
Grant date	Jun 21, 2016

Abstract

A method, system and apparatus for authenticating a communication request sent from a client computing device. The communication request is initially blocked by a firewall preventing delivery to a server. A first logging event corresponding to the communication request is created. The communication request and the logging event are stored in a firewall. The server is notified of the first logging event. The communication request corresponding to the first logging event is authenticated. A port in the firewall is enabled if the communication request is authenticated.

First claim

We claim:

1. A system for authenticating a communication request sent from a client computing device, the system comprising:
a firewall that initially blocks all incoming traffic regardless of port number, the firewall comprising:
a processing unit operating to perform functions including:
initially blocking the communication request;
creating a first logging event corresponding to the communication request; and

a storage unit, the storage unit storing the communication request and the first logging event; and

a server in data communication with the firewall, the server having a processing unit, the processing unit operating to perform functions including:
receiving notification of the first logging event created by the firewall;
responding to the notification by locating in the storage unit the communication request based upon the first logging event in the notification;
authenticating in the server the communication request corresponding to the first logging event using a multi-layer authentication process including a first layer authentication of the communication request and a second layer authentication of the communication request, the second layer authentication including the firewall receiving a public key from the client computing device, the public key corresponding to the server, creating a second logging event corresponding to the received public key, storing the second logging event and the received public key, and notifying the server of the second logging event, and the server receiving the notification of the second logging event, acquiring the public key from the firewall and testing the received public key; and
enabling by the server a port in the firewall if the communication request is authenticated by the first and second layer authentications.

2. The system according to claim 1 , wherein the communication request contains a plurality of clear addresses corresponding to the client computing device and a hash of the plurality of clear addresses generated by the client computing device using a predetermined hashing algorithm.

3. The system according to claim 2 , wherein the plurality of addresses corresponding to the client computing device include an Internet Protocol Address and a Media Access Control layer address.

4. A method for authenticating a communication request sent from a client computing device directed to a server, the method comprising:
initially blocking the communication request from delivery to the server by a firewall that initially blocks all incoming traffic regardless of port number;
creating by the firewall a first logging event corresponding to the communication request;
storing by the firewall the communication request and the first logging event in the firewall;
notifying by the firewall the server of the first logging event;
responding to the notification in the server by locating in the firewall the stored communication request based upon the first logging event in the notification, by authenticating in the server the communication request corresponding to the first logging event by the server using a multi-layer authentication process including a first layer authentication of the communication request and a second layer authentication of the communication request, the second layer authentication including receiving a public key from the client computing device, the public key corresponding to the server, creating a second logging event corresponding to the received public key, storing the second logging event and the received public key, notifying the server of the second logging event, and testing the received public key; and
enabling a port in the firewall only if the communication request is authenticated by the first and second layer authentication.

5. The method according to claim 4 , wherein the communication request contains a plurality of clear addresses corresponding to the client computing device and a first hashing of the plurality of clear addresses generated by the client computing device using a predetermined hashing algorithm.

6. The method according to claim 5 , wherein the plurality of addresses corresponding to the client computing device include an Internet Protocol Address and a Media Access Control layer address.

7. The method according to claim 5 , wherein the hash includes positional coordinates corresponding to the client computing device.

8. A non-transitory machine readable storage device having stored thereon a computer program for authenticating a communication request sent from a client computing device directed to a server, the computer program comprising a set of instructions which when executed by a machine causes the machine to perform a method including:
initially blocking the communication request from delivery to the server by a firewall that blocks all incoming traffic regardless of port number;
creating by the firewall a first logging event corresponding to the communication request;
storing by the firewall the communication request and the logging event in the firewall;
notifying by the firewall the server of the first logging event;
responding to the notification in the server by locating in the firewall the stored communication request based upon the first logging event in the notification, by authenticating in the server the communication request corresponding to the first logging event by the server using a multi-layer authentication process including a first layer authentication of the communication request and a second layer authentication of the communication request, the second layer authentication including receiving a public key from the client computing device, the public key corresponding to the server, creating a second logging event corresponding to the received public key, storing the second logging event and the received public key, notifying the server of the second logging event, and testing the received public key; and
enabling a port in the firewall only if the communication request is authenticated by the first and second layer authentication.

9. The machine readable storage device according to claim 8 , wherein the communication contains a plurality of clear addresses corresponding to the client computing device and a hash of the plurality of clear addresses generated by the client computing device using a predetermined hashing algorithm.

10. The machine readable storage device according to claim 9 , wherein the plurality of clear addresses corresponding to the client computing device include an Internet Protocol Address and a Media Access Control layer address.

11. The machine readable storage device according to claim 9 , wherein the hash further includes positional coordinates corresponding to the client computing device.

Assignees

• IBM
• Lenovo Entpr Solutions Singapore Pte Ltd

Inventors

• Jennings Jeffery Bart
• Kekessie Kofi

Classifications

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• H04L63/029 Primary

  Firewall traversal, e.g. tunnelling or, creating pinholes · CPC title

• H04L63/02 Primary

  for separating internal from external traffic, e.g. firewalls · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L9/3271

  using challenge-response · CPC title