Method for secure network access via message intercept

• US 5,699,513 A
• Filed: 03/31/1995
• Issued: 12/16/1997
• Est. Priority Date: 03/31/1995
• Status: Expired due to Term

• Current Assignee: General Dynamics C4 Systems Incorporated (General Dynamics Corporation)
• Original Assignee: Motorola, Inc. (Motorola Solutions, Inc.)
• Inventors: Lambert, Paul Aerick, Feigen, Ronald Glen
• Primary Examiner(s): Beausoliel, Jr., Robert W.
• Assistant Examiner(s): LE, DIEU MINH T
• Application Number:
  US08/414,823
• Time in Patent Office: 991 Days
• Field of Search: 395/187.01, 395/186, 395/188.01, 380/4, 380/21, 380/23, 380/25, 364/286.4, 364/286.5, 364/222.5
• US Class Current: 726/11
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

Security is provided for an inside network (14) by a security host (26). Connection request messages sent from source hosts (22) in an outside network (12) are intercepted (94) in the security host (26) and prevented from being transmitted on the inside network (14). The user of the source host (22) then establishes a connection (78) to the security host (26) where a dialog session (80, 98, 100) occurs to confirm the user'"'"'s authenticity and authorization. After the user is confirmed, the intercepted connection request message is released (116) for transmission on the inside network (14) where the intended application service will respond and a communication session will commence.

Claims

1. A method of providing security for a network having one or more application services to which connections may be made from outside said network, said method comprising the steps of:

intercepting a plurality of connection request messages each of which establishes a first connection request for an application service provided on said network;

establishing a second connection, said second connection being established with a security service;

confirming, through said second connection, said first connection request;

transmitting a message on said network after said confirming step confirms said first connection request;

establishing said second connection with a source hose having a source host address;

sending data describing ones of said intercepted connection request messages which originated from said source host address to said source host through said second connection; and

receiving selection data from said source host through said second connection, said selection data identifying a selected one of intercepted connection request messages wherein said message transmitted by said transmitting step corresponds to said selected one of intercepted connection request messages.

2. A method as claimed in claim 1 wherein said intercepting, establishing, confirming, and transmitting steps comprise the step of intercepting, establishing, confirming, and transmitting by a security host residing on said network.

3. A method as claimed in claim 1 wherein said intercepting step comprises the step of saving said connection request message.

4. A method as claimed in claim 3 wherein said saving step comprises the step of eliminating duplicate connection request messages.

5. A method as claimed in claim 1 wherein said intercepting step comprises the step of preventing said connection request message from being transmitted on said network.

6. A method as claimed in claim 1 wherein said establishing step comprises the steps of:

receiving a second connection request message, said second connection request message identifying a source which originated said second connection request message, and said second connection request message requesting establishment of a connection to said security service; and

sending an acknowledgment message from said security service to said source.

7. A method as claimed in claim 1 wherein:

said connection request message originates in response to actions taken by a user at a source host; and

said confirming step comprises the step of authenticating said user.

8. A method as claimed in claim 1 wherein:

said connection request message originates in response to actions taken by a user at a source host; and

said confirming step comprises the, step of authorizing said user.

9. A method as claimed in claim 1 wherein said intercepting step intercepts a plurality of connection request messages each of which requests establishment of a connection to an application service provided on said network, and said method additionally comprises the steps of:

identifying ones of said plurality of connection request messages which are not confirmed within a predetermined period of time following their interception; and

dropping said ones of said plurality of connection request messages.

10. A method as claimed in claim 1 additionally comprising the step of preventing said message from being transmitted on said network when said confirming step fails to confirm said first connection request.

11. A method of providing security for a network having one or more application services to which connections may be made from outside said network, said method comprising the steps of:

receiving a connection request message at a security host coupled to said network, said connection request message providing a first connection request to an application service provided on said network whereby said connection request message is originated in response to actions taken by a user at a source host;

establishing a second connection at said security host;

confirming, through said second connection, said first connection request thereby authenticating a user;

preventing, prior to said confirming step, said connection request message from being transmitted on said network; and

transmitting said connection request message on said network after said confirming step confirms said first connection request.

12. A method as claimed in claim 11 additionally comprising the step of preventing said connection request message from being transmitted on said network when said confirming step fails to confirm said first connection request.

13. A method of providing security for a network having an application service to which a connection may be established from outside said network, said connection being initiated through actions taken by a user at a source host having a source host address, and said method comprising the steps of:

intercepting a plurality of connection request messages from said source host, each of said connection request messages requesting establishment of a first connection to said application service provided on said network;

establishing a connection between said source host and a security service;

authenticating said user through said connection between said source host and said security service; and

transmitting said connection request message on said network after said authenticating step authenticates said user;

sending data describing ones of intercepted connection request messages which originated from said source host address to said source host through said connection between said source host and said security service; and

receiving selection data from said source host through said connection between said source host and said security service, said selection data identifying a selected one of said intercepted connection request messages, wherein said message transmitted by said transmitting step corresponds to said selected one of said intercepted connection request messages.

14. A method as claimed in claim 13 additionally comprising the step of preventing, prior to said authenticating step, said connection request message from being transmitted on said network.

15. A method as claimed in claim 13 wherein said intercepting step intercepts a plurality of connection request messages each of which requests establishment of a connection to an application service provided on said network, and said method additionally comprises the steps of:

identifying ones of said plurality of connection request messages which are not confirmed within a predetermined period of time following their interception; and

dropping said connection request messages identified in said identifying step.

16. A method as claimed in claim 13 additionally comprising, prior to said transmitting step, the step of authorizing said user for said application service.