Methods and systems for network security using a cryptographic firewall

• US 10,469,262 B1
• Filed: 09/15/2016
• Issued: 11/05/2019
• Est. Priority Date: 01/27/2016
• Status: Active Grant

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Inventors: Schroeder, Ted, Lengyel, Gabor
• Primary Examiner(s): Korsak, Oleg
• Assistant Examiner(s): Almeida, Devin E
• Application Number:
  US15/266,980
• Time in Patent Office: 1,146 Days
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 9/0643 Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
• CPC Class Codes: H04L 9/0863 involving passwords or one-time passwords network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3239 involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC

Abstract

A method is performed at a security device. The method includes establishing a network connection with a client system. After establishing the network connection, the security device receives a first packet from the client system. The first packet includes an identifier, a first counter value, and a first one-time password hash generated by the client system. Based on the identifier received, the security device retrieves from a trusted data store the seed and a second counter value. If the first counter value is larger than the second counter value, the security device generates a second one-time password hash based on the identifier, the first counter value, and the seed. In accordance with a determination that the first and second one-time password hashes match, the security device grants, to the client system, access to one or more network resources protected by the security device via the network connection.

Claims

1. A method for accessing network resources protected by a security device, comprising:

at a security device having one or more processors and memory storing one or more programs for execution by the one or more processors;

establishing a network connection with a client system;

after establishing the network connection, receiving from the client system a first packet, the first packet including;

an identifier,

a first counter value, wherein the first counter value is one of a plurality of incremental counts generated by a system counter, and

a first one-time password hash generated by the client system based on the identifier, the first counter value, and a seed;

based on the identifier received from the client system, retrieving from a trusted data store the seed and a second counter value,

wherein the identifier and the seed are provided to the client system by the trusted data store based on authenticating the client system;

based on the first counter value being larger than the second counter value;

generating a second one-time password hash based on the identifier, the first counter value, and the seed;

determining whether the first one-time password hash and the second one-time password hash match; and

in accordance with a determination that the first one-time password hash and the second one-time password hash match, granting, to the client system, access to one or more network resources protected by the security device via the network connection.

2. The method of claim 1, wherein the identifier and the seed are provided to the client system by the trusted data store based on a request for an identifier and seed pair, and prior to the security device establishing the network connection with the client system.

3. The method of claim 1, wherein the network connection is a TCP connection.

4. The method of claim 1, wherein the trusted data store includes the system counter, and wherein the system counter monotonically increases for each request received from the client system.

5. The method of claim 1, wherein the system counter is updated in accordance with a determination that the first one-time password hash and the second one-time password hash match.

6. The method of claim 1, further comprising terminating the network connection with the client system, based on the first counter value being less than or equal to the second counter value.

7. The method of claim 1, further comprising terminating the network connection with the client system in accordance with a determination that the first one-time password hash and the second one-time password hash do not match.

8. The method of claim 7, wherein terminating the network connection with the client system comprises sending a reset packet to the client system.

9. The method of claim 7, wherein terminating the network connection with the client system comprises foregoing acknowledgment of packets received from the client system.

10. The method of claim 7, wherein terminating the network connection with the client system further comprises clearing table entries associated with a connection request.

11. The method of claim 1, wherein receiving the first packet comprises receiving the first packet embedded in a body of an HTTP POST.

12. The method of claim 1, wherein receiving the first packet comprises receiving the first packet embedded within an HTTP GET URL.

13. The method of claim 1, wherein receiving the first packet comprises receiving the first packet in a TLS Client Hello message, wherein the first packet is placed within a random field of the TLS Client Hello message.

14. The method of claim 1, wherein establishing the network connection with the client system comprises:

prior to receiving the first packet from the client system;

receiving a SYN packet from the client system;

based on receiving the SYN packet, sending a SYN-ACK packet to the client system; and

after sending the SYN-ACK packet, receiving, from the client system, an ACK packet, thereby establishing the network connection and permitting receipt of the first packet from the client system.

15. A security device, comprising:

one or more processors; and

memory storing one or more programs for execution by the one or more processors, the one or more programs including instructions for;

establishing a network connection with a client system;

after establishing the network connection, receiving from the client system a first packet, the first packet including;

an identifier,

a first counter value, wherein the first counter value is one of a plurality of incremental counts generated by a system counter, and

a first one-time password hash generated by the client system based on the identifier, the first counter value, and a seed;

based on the identifier received from the client system, retrieving from a trusted data store the seed and a second counter value,

wherein the identifier and the seed are provided to the client system by the trusted data store based on authenticating the client system;

based on the first counter value being larger than the second counter value;

generating a second one-time password hash based on the identifier, the first counter value, and the seed;

determining whether the first one-time password hash and the second one-time password hash match; and

in accordance with a determination that the first one-time password hash and the second one-time password hash match, granting, to the client system, access to one or more network resources protected by the security device via the network connection.

16. The security device of claim 15, wherein the identifier and the seed are provided to the client system by the trusted data store based on a request for an identifier and seed pair, and prior to the security device establishing the network connection with the client system.

17. The security device of claim 15, wherein the network connection is a TCP connection.

18. The security device of claim 15, wherein the trusted data store includes the system counter, and wherein the system counter monotonically increases for each request received from the client system.

19. The security device of claim 15, wherein the system counter is updated in accordance with a determination that the first one-time password hash and the second one-time password hash match.

20. A non-transitory computer readable storage medium, storing one or more programs for execution by one or more processors, the one or more programs including instructions for:

establishing a network connection with a client system;

after establishing the network connection, receiving from the client system a first packet, the first packet including;

an identifier,

a first counter value, wherein the first counter value is one of a plurality of incremental counts generated by a system counter, and

a first one-time password hash generated by the client system based on the identifier, the first counter value, and a seed;

based on the identifier received from the client system, retrieving from a trusted data store the seed and a second counter value,

wherein the identifier and the seed are provided to the client system by the trusted data store based on authenticating the client system;

based on the first counter value being larger than the second counter value;

generating a second one-time password hash based on the identifier, the first counter value, and the seed;

determining whether the first one-time password hash and the second one-time password hash match; and

in accordance with a determination that the first one-time password hash and the second one-time password hash match, granting, to the client system, access to one or more network resources via the network connection.