Secure hidden route in a data network

• US 7,394,756 B1
• Filed: 03/17/2003
• Issued: 07/01/2008
• Est. Priority Date: 03/17/2003
• Status: Active Grant

• Current Assignee: T-Mobile Innovations LLC (Deutsche Telekom AG)
• Original Assignee: Sprint Communications Company LP (Deutsche Telekom AG)
• Inventors: Cook, Fred S.
• Primary Examiner(s): Vu; Huy D.
• Assistant Examiner(s): Nguyen; Phuongchau Ba
• Application Number:
  US10/390,250
• Time in Patent Office: 1,933 Days
• Field of Search: None
• US Class Current: 370/216
• CPC Class Codes: H04L 45/04 Interdomain routing, e.g. hierarchical routing
• CPC Class Codes: H04L 45/302 Route determination based on requested QoS
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A hidden pathway to a host is provided in an internetwork having an egress router coupled to the host. A selected port of the egress router is connected to the host as a hidden access port. A label table in the egress router is configured to associate the selected port with a predetermined label. Distribution of the predetermined label is restricted to one or more controlled access points so that access to the hidden pathway is restricted to the controlled access points. The controlled access points may reside at the users themselves, but are preferably contained within proxy devices coupled to the internetwork using secure connections.

Claims

1. A method of conveying network traffic composed of packets sent in an internetwork between client users and a host, said method comprising:

operating a public traffic channel to said host based on internet protocol (IP) routing tables, said traffic channel including a first border router coupling said host to said internetwork;

configuring a label table in a router connected to said host to associate a predetermined label with said host in order to provide a limited access channel to said host;

configuring a proxy device coupled to said internetwork to recognize at least one authorized client user of said host, to detect network traffic from said authorized client user to said proxy device which is intended for said host, and to forward said network traffic to said host using said predetermined label;

using the public channel to send traffic from one of the client users to the host;

detecting a malfunction condition of said public traffic channel; and

suspending operation of said public traffic channel in response to said malfunction condition;

whereby said authorized client user continues to exchange said traffic with said host during said malfunction condition via said limited access channel.

2. The method of claim 1 wherein said router having said label table is comprised of said first border router.

3. The method of claim 1 wherein said router having said label table is comprised of a second border router separate from said first border router and coupled to said host.

4. The method of claim 1 wherein said proxy device is comprised of a relaying workstation in said internetwork.

5. The method of claim 1 wherein said malfunction condition is comprised of an excessive traffic load condition which is detected by an operational support system coupled to said first border router.

6. The method of claim 1 wherein said step of suspending operation of said public traffic channel is comprised of:

removing an entry associated with said host from a routing table located in said first border router.

7. The method of claim 1 wherein said step of suspending operation of said public traffic channel is comprised of:

designating said first border router as unreachable in other routers within said internetwork.

8. The method of claim 1 wherein said step of suspending operation of said public traffic channel is comprised of:

altering said routing tables within said internetwork to redirect network traffic away from said first border router.

9. The method of claim 1 including a plurality of authorized client users, said method further comprising the steps of:

a particular client user communicating with said host via said public traffic channel and registering as a said authorized client user;

said host sending authorization data to said proxy device to configure said particular user as one of said authorized client users; and

said host sending contact information of said proxy device to said particular client user.

10. The method of claim 9 wherein a plurality of proxy devices in said internetwork are each configured for respective ones of said plurality of client users.

11. The method of claim 1 further comprising the step of:

said proxy device authenticating and authorizing a client user prior to said forwarding of network traffic to said host on behalf of said client user.