Patent Application
20220278960
The invention of the present disclosure was conceived and reduced to practice without the benefit of federal funding.
The invention relates to the technical field of Internet security. When a server or other network appliance is exposed to a network such as the Internet, it becomes accessible to anyone with an Internet access located anywhere. Hacking of network applications (e.g., web servers), distributed denial of service (DDoS) attacks, and password attacks are some examples of what can occur within moments of a valid Internet Protocol (IP) address being accessible via a network.
While firewalls and similar network security-based devices exist, there is no method currently available to automatically and dynamically allow a device to identify its current network parameters (e.g., its source IP address, or its public IP address if it is on a private network behind another router or firewall) so that a headend firewall can “open up” or allow the traffic entrance to the network from that IP address and port. Additionally, the headend firewall may want to signal to the remote network device certain one-time-use connection details to use only for that specification connection. Thus, only those inbound connections that exactly match all those parameters will be permitted. What is missing from the current state of the art is coordination between a remote network device and a headend firewall to relay, authenticate, and configure how a remote device should connect to a central site. It is an object of the invention of the present disclosure to provide a method to establish such coordination.
The invention of the present disclosure accomplishes such coordination by providing attributable security to a network by only allowing network requests and traffic from authorized remote network devices by using the remote devices' specific networking and device parameters. Some examples of such parameters are source and destination IP addresses, protocol type, source or destination port, X509.v3 certificate, VLAN information, and other data within a data packet header or packet body.
The invention of the present disclosure provides concrete countermeasures to overcome issues of network resource exposure to unauthorized network users. The methods described herein enable the blocking of all access to any and all central network services while only permitting pin-point and one-time-only access that is specific to a remote requesting device and its immediate connection to enable data packet movement between networking applications without regard to protocol.
Remote network parameters are determined at the central site and then used to dynamically configure a firewall or equivalent security system to permit or deny access from the remote network. This type of security enables only communications with known remote devices using the immediate and specific networking details for a single connection. This prevents scanning, duplicate access, man-in-the-middle attacks, DDoS attacks, or access by unauthorized devices. Additionally, a stolen or compromised device's configuration cannot be used to make a connection to a headend, unauthorized remote endpoint as it will not include the connection details it should use to connect to a central site.
The invention of the present disclosure is that of systems and methods for deterministic access control for network devices over a communication network with the Internet being one example of such a network. A central network device is provided comprising a software module capable of determining selected remote network parameters and causing a connected microprocessor to dynamically configure a firewall or equivalent useful in controlling access from a remote network to, for example, a web server, the module referred to herein as a conditional access grantor module, or simply “grantor module”.
An exemplary system of the invention described herein may include a conditional access request module (“request module”), a grantor module, and a database storing unique identifier (UID) or other pertinent details posted by the request module, each UID being associated with a request module of a device located on a remote network. Under this framework, method steps may be executed to enable dynamic access control for remote devices, over IP and other communications networks such as but not limited to the Internet, seeking to access a central network and obtain services.
As illustrated in
Once a request module UID has been posted to database 103, a central network device 102 located at a central site, comprising a grantor module 102a in network communication with the database 103 according to a system as illustrated in
A central site may represent a headend body of resources to which remote users and their remote network devices need to connect to obtain desired services. For example, in the private enterprise setting, a central office location may represent a central site housing servers, such as but not limited to web servers, that authenticated users may wish to access in order to obtain services and perform tasks. Another example might be a network of web servers acting as a central network for the provision of services such as high-definition television or movie viewing, as is common in the marketplace today.
Turning now to
In still other embodiments, a grantor module 102a may be in communication with an intermediate network device (not shown) through a logical connection between the grantor module 102a and a management control interface of the intermediate network device, which may, in response to a signal from the grantor module 102a, perform a switching action in response to instructions transmitted from the grantor module 102a to the intermediate device. In this way, a device external to the central network device 102 may configure firewall rules or equivalent security features of the central network device 102 to allow connections to be established between remote networking application 101b and central networking application 102b.
If a grantor module 102a as described herein generates connection details and posts them to the database 103, a request module 101a may then access the database 103 and obtain and process the detail information in order to update its connection and networking details according to the information generated by the grantor module 102a, as illustrated in
Turning now to
These and other methods enabled by a system as described herein allow for secure connections between endpoints on disparate networks that is direct, from endpoint to endpoint, thereby eliminating other points in the communication path that might otherwise subject the network devices involved from hacking, DoS attacks, man-in-the-middle attacks, spoofing and other nefarious activities taking place commonly in the context of Internet communications. The invention described herein affords network administrators with an additional security tool useful for preserving network integrity and deterministic network access control.
Moreover, embodiments of the systems and methods according to the present disclosure are compatible with multiple communications data exchange protocols familiar to those of ordinary skill in the art, including but not limited to connection-oriented protocols such as Transmission Control Protocol (TCP), or connectionless protocols such as IP or the User Datagram Protocol (UDP) and combinations of such known protocols (e.g., TCP/IP). It is an object of the invention to provide for secure data packet movement between applications regardless of the protocol in which connectivity is implemented. These and other advantages will be evident to those of ordinary skill in the art in view of the illustrative embodiments presented and described herein.
