Concealing a network connected device

• US 20040215771A1
• Filed: 03/05/2002
• Published: 10/28/2004
• Est. Priority Date: 03/05/2002
• Status: Active Grant

• Current Assignee: Invisinet Technologies LLC, John Hayes
• Original Assignee: Archduke Holdings, Inc.
• Inventors: Hayes, John W.
• Granted Patent: US 6,973,496 B2
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/163 In-band adaptation of TCP data exchange; In-band control procedures

Abstract

Methods and apparatus for concealing a network connected device are disclosed. In a preferred embodiment of the invention, a network client inserts an validation key into the SEQ and ACK fields of a TCP connection request (TCP-SYN). The TCP connection request is sent to an validating server. The validating server extracts the validation key and uses it, with other implicit and explicit data contained within the TCP connection request to validate the connection establishment request. If the connection request is validated, the validating server responds with a TCP-SYN/ACK as described in the TCP protocol specification. If the TCP connection request is denied, the request is discarded and nothing is sent back to the requester, in this case the network client. When an internet port scanner sends a TCP connection request to a validating network server without the proper key, the request is silently discarded or “black-holed.” This makes the validating server appear to the internet port scanner to not exist. The validating server has completely concealed itself from unauthorized and unvalidated connections.

Claims

1. A method comprising the steps of:

receiving a TCP connection request on a TCP port to which a network application has been bound on a network server;

extracting a validation key from a SEQ and an ACK field of said TCP connection request;

validating said TCP connection request based on said received validation key and other data contained within said TCP connection request;

determining that said extracted validation key is invalid for said TCP connection request;

discarding said TCP connection request and sending no reply back to a sender of said TCP connection request to conceal said network server from an unvalidated, unauthorized network client.