Method for secure single-packet remote authorization

• US 20070234428A1
• Filed: 03/22/2007
• Published: 10/04/2007
• Est. Priority Date: 03/22/2006
• Status: Active Grant

• Current Assignee: Michael Rash
• Original Assignee: Michael Rash
• Inventors: Rash, Michael
• Granted Patent: US 8,413,248 B2
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32

Abstract

A method for secure single-packet remote authorization using a single packet authorization (SPA) server on a host system that passively monitors the network for connection attempts and anonymously accept or rejects said attempts depending on whether a valid SPA packet is detected, an SPA client on a client system that is responsible for generating the appropriately encrypted SPA packet in order to gain access to services on the host, and a particular packet format sent from the client to the host to gain access. The packet format is encrypted and non-replayable by virtue of 16 bytes of random data in every message, and an MD5 sum that is a hash function of the random data (made via any known hashing function). The SPA server stores the MD5 sum of every valid SPA packet that it monitors and flags any duplicate access attempts using the same MD5 hash as a previously monitored packet, in which case the SPA server treats the packet as being generated by a malicious attempt to replay the original packet.

Claims

1. A method for secure remote authorization using a single packet authorization (SPA) server on a host system, a SPA client on a client system, and a formatted SPA packet sent from the client in order to gain access to services on the host, comprising the steps of:

constructing a packet of access code comprising a plurality of bytes of random data and a hash function of the random data;

sending said packet to a server configured to allow certain predetermined packets;

allowing access to said server if said packet matches a predetermined packet;

storing the hash function of every allowed packet at the server and preventing access for any subsequently sent duplicate packets.

2. The method for secure remote authorization according to claim 1, wherein said packet format is encrypted and non-replayable.

3. The method for secure remote authorization according to claim 2, wherein said SPA packet format comprises a plurality of bytes of random data and a hash function of the random data.

4. The method for secure remote authorization according to claim 3, wherein said SPA packet format comprises 16 bytes of random data and a hash function of the random data.

5. The method for secure remote authorization according to claim 4, wherein said hash function of the random data comprises an MD5 compression function.

6. The method for secure remote authorization according to claim 4, wherein said hash function of the random data comprises an MD5 compression function calculated over the random data.

7. The method for secure remote authorization according to claim 4, wherein said hash function of the random data comprises an MD5 compression function calculated over the entire message.

8. The method for secure remote authorization according to claim 6, wherein said SPA server stores the MD5 sum of every valid SPA packet that it monitors to prevent duplicate access attempts.

9. The method for secure remote authorization according to claim 8, wherein if said SPA server detects a duplicate SPA packet it treats said packet as a malicious access attempt.

10. The method for secure remote authorization according to claim 9, wherein said SPA client dynamically reconfigures each valid SPA packet after granting access.

11. A system for secure single-packet remote authorization, comprising:

a single packet authorization (SPA) server in communication with a network and configured to passively monitor said network for a valid SPA packet having a predetermined format while maintaining a gateway packet filter in a default deny state;

an SPA client on a client system configured to generate formatted SPA packets in order to gain access to services on the network;

wherein said predetermined SPA format is encrypted and non-replayable.

12. The system for secure single-packet remote authorization according to claim 11, wherein said SPA packet format comprises a plurality of bytes of random data and a hash function of the random data.

13. The system for secure single-packet remote authorization according to claim 12, wherein said SPA packet format comprises 16 bytes of random data and a hash function of the random data.

14. The system for secure single-packet remote authorization according to claim 13, wherein said hash function of the random data comprises an MD5 compression function.

15. The system for secure single-packet remote authorization according to claim 14, wherein said hash function of the random data comprises an MD5 compression function calculated over the random data.

16. The system for secure single-packet remote authorization according to claim 14, wherein said hash function of the random data comprises an MD5 compression function calculated over the entire message.

17. The system for secure single-packet remote authorization according to claim 14, wherein said SPA server stores the MD5 sum of every valid SPA packet that it monitors to prevent duplicate access attempts.

18. The system for secure single-packet remote authorization according to claim 12, wherein if said SPA server detects a duplicate SPA packet it treats said packet as a malicious access attempt.

19. The system for secure single-packet remote authorization according to claim 12, wherein said SPA client dynamically reconfigures each valid SPA packet after granting access.