Security between client and server in a computer network

• US 6,502,192 B1
• Filed: 09/03/1998
• Issued: 12/31/2002
• Est. Priority Date: 09/03/1998
• Status: Expired due to Term

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Nguyen, Dan Linh
• Primary Examiner(s): HUA, LY
• Application Number:
  US09/146,727
• Time in Patent Office: 1,580 Days
• Field of Search: 713/201, 713/200, 380/21
• US Class Current: 726/4
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

Improved security between a client and a server in a computer network is provided by allowing either endpoint (the client or the server) to initiate request messages. In this way, it is possible to configure the system so that the server always makes the opening move of negotiation, allowing the location of the server to remain hidden until a legal session is established. Dynamic relocation of the server further hides the location of the server from unauthorized users. Additionally, each message may be authenticated individually as it is received, with the endpoint making no response to an unauthentic message, thus preventing attacks on its security. Finally, negotiation of both the encryption method and the key used in the encryption process allows for the rapid reconfiguration of encryption to protect against unauthorized users who may have broken the code.

Claims

1. A method for a server to establish a network session with a client logged on to a network, including:

receiving a packet from an authentication server indicating that the client should have access to the server;

sending a message to the client to initiate session negotiation if the client should have access to the server; and

negotiating a session with the client if the client should have access to the server.

2. The method of claim 1, wherein said determining includes receiving a message from an authentication server indicating whether the client should have access to the server.

3. The method of claim 1, wherein said sending includes sending a message to the client which indicates the location of the server, keeping the location of the server hidden from the client until the client is deemed to have the appropriate access privileges to the server.

4. The method of claim 1, further including ignoring any message sent from the client to the server if the client should not have access to the server, and ignoring any message sent from the client to the server before it is determined if the client should have access to the server.

5. The method of claim 1, further including ignoring any message except a ping request sent from the client to the server if the client should not have access to the server, and ignoring any message except a ping request sent from the client to the server before it is determined if the client should have access to the server.

6. The method of claim 5, further including responding to a ping request with a pong message.

7. The method of claim 1, further including dynamically relocating the server.

8. The method of claim 7, wherein said dynamically relocating includes changing the server'"'"'s port address.

9. The method of claim 7, wherein said dynamically relocating includes changing the server'"'"'s IP address.

10. The method of claim 1, wherein said negotiating comprises agreeing with the client upon a set of session parameters, one of said session parameters being an encryption method and another of said session parameters being a key.

11. The method of claim 10, further including communicating with the client during said session by encrypting data using said encryption method and said key, sending the data through the network, and then decrypting said data using said encryption method and said key.

12. A method for network communication between a client and a server during a negotiated session, including:

sending a first request message from the server to the client;

sending a first response message from the client to the server in response to said first request message;

sending a second request message from the client to the server;

sending a second response message from the server to the client in response to said second request message; and

dynamically relocating the server.

13. The method of claim 12, further including:

sending a message from the server to the client indicating that the server has dynamically relocated and informing the client of the new location if it is reasonably possible that the client will send a message to it before it sends a message to the client.

14. The method of claim 12, wherein said dynamically relocating includes changing the server'"'"'s port address.

15. The method of claim 12, wherein said dynamically relocating includes changing the server'"'"'s IP address.

16. The method of claim 12, wherein negotiation of the session involves agreeing upon a set of session parameters, one of said session parameters being an encryption method and another of said session parameters being a key.

17. The method of claim 16, wherein the data contained in said first request message, said first response message, said second request message, and said second response message has been encrypted using said encryption method and said key and is decrypted using said encryption method and said key.

18. A method of network communication between a server and a client logged on to a network including:

receiving a packet from an authentication server indicating that the client should have access to the server;

sending a message to the client to initiate session negotiation if the client should have access to the server;

negotiating a session between the client and the server if the client should have access to the server;

sending a first request message from the server to the client during said session;

sending a first response message from the client to the server in response to said first request message during said session;

sending a second request message from the client to the server during said session; and

sending a second response message from the server to the client in response to said second request message during said session.

19. The method of claim 18, wherein said determining includes receiving a message from an authentication server indicating whether the client should have access to the server.

20. The method of claim 18, wherein said sending a message to the client to initiate session negotiation includes sending a message to the client which indicates the location of the server, keeping the location of the server hidden from the client until the client is deemed to have the appropriate access privileges.

21. The method of claim 18, further including ignoring any message sent from the client to the server if the client should not have access to the server, and ignoring any message sent from the client to the server before it is determined if the client should have access to the server.

22. The method of claim 18, further including ignoring any message except a ping request sent from the client to the server if the client should not have access to the server, and ignoring any message except a ping request sent from the client to the server before it is determined if the client should have access to the server.

23. The method of claim 22, further including responding to a ping request with a pong message.

24. The method of claim 18, further including dynamically relocating the server.

25. The method of claim 24, wherein said dynamically relocating includes changing the server'"'"'s port address.

26. The method of claim 24, wherein said dynamically relocating includes changing the server'"'"'s IP address.

27. The method of claim 18, wherein said negotiating involves agreeing upon a set of session parameters, one of said session parameters being an encryption method and another of said session parameters being a key.

28. The method of claim 27, wherein the data contained in said first request message, said first response message, said second request message, and said second response message has been encrypted using said encryption method and said key and is decrypted using said encryption method and said key.

29. A method for network communication between a server and a client logged on to a network including:

receiving a packet from an authentication server indicating that the client should have access to the server;

sending a message to the client to initiate session negotiation if the client should have access to the server;

negotiating a session between the server and the client if the client should have access to the server, said negotiating comprising agreeing upon a set of session parameters, one of said session parameters being a sequence number and another of said session parameters being an increment value or increment value algorithm;

communicating between the server and client during said session by transmitting messages between the server and client, each message including said sequence number;

incrementing said sequence number by said increment value or a value determined by said increment value algorithm each time a message is transmitted;

checking whether said sequence number matches a predicted sequence number each time a message is received by the client or the server; and

ignoring a received message if the sequence number of said received message does not match said predicted sequence number.

30. The method of claim 29, wherein said sending includes sending a message to the client which indicates the location of the server, keeping the location of the server hidden from the client until the client is deemed to have the appropriate access privileges to the server.

31. The method of claim 29, further including ignoring any message sent from the client to the server if the client should not have access to the server, and ignoring any message sent from the client to the server before it is determined if the client should have access to the server.

32. The method of claim 29, further including ignoring any message except a ping request sent from the client to the server if the client should not have access to the server, and ignoring any message except a ping request sent from the client to the server before it is determined if the client should have access to the server.

33. The method of claim 32, further including responding to a ping request with a pong message.

34. The method of claim 29, further including dynamically relocating the server.

35. The method of claim 29, wherein said predicted sequence number is computed by:

maintaining a local variable representing said predicted sequence number on both the client and the server;

incrementing said local variable on the server by said increment value or a value determined by said increment value algorithm each time the server receives a message from the client; and

incrementing said local variable on the client by said increment value or a value determined by said increment value algorithm each time the client receives a message from the server.

36. The method of claim 29, further including:

terminating the session if the sequence number of a received message does not match said predicted sequence number.

37. The method of claim 29, wherein said another of said session parameters agreed upon during said negotiation step is an encryption method and another of said session parameters agreed upon during said negotiation step is a key.

38. The method of claim 37, wherein said communicating includes:

encrypting said messages using said encryption method and said key;

sending the messages through the network; and

decrypting said data using said encryption method and said key.

39. A method for network communication between a server and a client logged on to a network, including:

receiving a packet from an authentication server indicating that the client should have access to the server;

sending a message to the client to initiate session negotiation if the client should have access to the server;

negotiating a session between the server and the client if the client should have access to the server, said negotiating comprising agreeing upon a set of session parameters, one of said session parameters being a sequence number and another of said session parameters being an increment value or increment value algorithm;

communicating between the server and client during said session by transmitting messages between the server and client, wherein said communicating involves sending a request message from either the client to the server or the server to the client, and then sending a response message in the other direction in response to said request message, each message including said sequence number;

incrementing said sequence number by said increment value or a value determined by said increment value algorithm each time a message is transmitted;

checking whether said sequence number matches a predicted sequence number each time a message is received by the client or the server; and

ignoring a received message if the sequence number of said received message does not match said predicted sequence number.

40. The method of claim 39, wherein said sending includes sending a message to the client which indicates the location of the server, keeping the location of the server hidden from the client until the client is deemed to have the appropriate access privileges.

41. The method of claim 39, further including ignoring any message sent from the client to the server if the client should not have access to the server, and ignoring any message sent from the client to the server before it is determined if the client should have access to the server.

42. The method of claim 39, further including ignoring any message except a ping request sent from the client to the server if the client should not have access to the server, and ignoring any message except a ping request sent from the client to the server before it is determined if the client should have access to the server.

43. The method of claim 42, further including responding to a ping request with a pong message.

44. The method of claim 39, further including dynamically relocating the server.

45. The method of claim 44, wherein said dynamically relocating includes changing the server'"'"'s port address.

46. The method of claim 44, wherein said dynamically relocating includes changing the server'"'"'s IP address.

47. The method of claim 39, wherein said predicted sequence number is computed by:

maintaining a local variable representing said predicted sequence number on both the client and the server;

incrementing said local variable on the server by said increment value or a value determined by said increment value algorithm each time the server receives a message from the client; and

incrementing said local variable on the client by said increment value or a value determined by said increment value algorithm each time the client receives a message from the server.

48. The method of claim 39, further including:

terminating the session if the sequence number of a received message does not match said predicted sequence number.

49. The method of claim 39, wherein said another of said session parameters agreed upon during said negotiation step is an encryption method and another of said session parameters agreed upon during said negotiation step is a key.

50. The method of claim 39, wherein said communicating includes:

encrypting said messages using said encryption method and said key;

sending the messages through the network; and

decrypting said data using said encryption method and said key.

51. A server for use in a computer network, including:

an access determiner which determines if a client logged on to the network should have access to the server;

a session initiator, which sends a message to said client to initiate session negotiation if said client should have access to the server; and

a negotiator, which negotiates a session between the server and said client if said client should have access to the server.

52. The server of claim 51, wherein said access determiner receives a message from an authentication server indicating whether said client should have access to the server.

53. The server of claim 51, wherein said message indicates the location of the server.

54. The server of claim 51, wherein said server ignores any message sent from said client if said client should not have access to said server, and ignores any message sent from said client before it is determined if said client should have access to the server.

55. The server of claim 51, wherein said server ignores any message except a ping request sent from said client if said client should not have access to the server, and ignores any message except a ping request sent from said client before it is determined if said client should have access to said server.

56. The server of claim 55, wherein said server responds to said ping request with a pong message.

57. The server of claim 51, wherein said server dynamically relocates itself.

58. The server of claim 51, wherein said negotiator negotiates an encryption method and a key.

59. A computer network including:

a server designed to send a first request message to a client;

a client designed to send a first response message to said server in response to said first request message;

said client further designed to send a second request message to said server;

said server further designed to send a second response message to said client in response to said second request message; and

said server further designed to dynamically relocate itself.

60. The computer network of claim 59, wherein said server is further designed to send a message to said client indicating that the server has dynamically relocated itself and informing said client of its new location.

61. A computer network including:

a server having an access determiner which determines if a client logged on to the network should have access to the server;

said server further having a session initiator, which sends a message to said client to initiate session negotiation if said client should have access to the server; and

said server further having a negotiator, which negotiates a session between the server and said client if said client should have access to the server,

said server designed to send a first request message to a client during said session;

said client designed to send a first response message to said server in response to said first request message during said session;

said client further designed to send a second request message to said server during said session; and

said server further designed to send a second response message to said client in response to said second request message during said session.

62. The computer network of claim 61, wherein said access determiner receives a message from an authentication server indicating whether said client should have access to the server.

63. The computer network of claim 61, wherein said message indicates the location of the server.

64. The computer network of claim 61, wherein said server ignores any message sent from said client if said client should not have access to said server, and ignores any message sent from said client before it is determined if said client should have access to the server.

65. The computer network of claim 61, wherein said server ignores any message except a ping request sent from said client if said client should not have access to the server, and ignores any message except a ping request sent from said client before it is determined if said client should have access to said server.

66. The computer network of claim 65, wherein said server responds to said ping request with a pong message.

67. The computer network of claim 61, wherein said server dynamically relocates itself.

68. The computer network of claim 61, wherein said negotiator negotiates an encryption method and a key.

69. The computer network of claim 61, wherein said server dynamically relocates itself and sends a message to said client indicating that the server has dynamically relocated itself and informing said client of its new location.

70. An apparatus for allowing a server to establish a network session with a client logged on to a network, comprising:

means for receiving a packet from an authentication server indicating that the client should have access to the server;

means for sending a message to the client to initiate session negotiation if the client should have access to the server; and

means for negotiating a session with the client if the client should have access to the server.

71. The apparatus of claim 70, wherein said means for determining includes means for receiving a message from an authentication server indicating whether the client should have access to the server.

72. The apparatus of claim 70, wherein said means for sending includes means for sending a message to the client which indicates the location of the server, keeping the location of the server hidden from the client until the client is deemed to have the appropriate access privileges to the server.

73. The apparatus of claim 70, further including means for ignoring any message sent from the client to the server if the client should not have access to the server, and ignoring any message sent from the client to the server before it is determined if the client should have access to the server.

74. The apparatus of claim 70, further including means for ignoring any message except a ping request sent from the client to the server if the client should not have access to the server, and ignoring any message except a ping request sent from the client to the server before it is determined if the client should have access to the server.

75. The apparatus of claim 74, further including means for responding to a ping request with a pong message.

76. The apparatus of claim 70, further including means for dynamically relocating the server.

77. The apparatus of claim 76, wherein said means for dynamically relocating includes means for changing the server'"'"'s port address.

78. The apparatus of claim 76, wherein said means for dynamically relocating includes means for changing the server'"'"'s IP address.

79. The apparatus of claim 70, wherein said means for negotiating comprises means for agreeing with the client upon a set of session parameters, one of said session parameters being an encryption method and another of said session parameters being a key.

80. The apparatus of claim 79, further including means for communicating with the client during said session by encrypting data using said encryption method and said key, sending the data through the network, and then decrypting said data using said encryption method and said key.

81. A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform a method for a server to establish a network session with a client logged on to a network, the method comprising:

receiving a packet from an authentication server indicating that the client should have access to the server;

sending a message to the client to initiate session negotiation if the client should have access to the server; and

negotiating a session with the client if the client should have access to the server.

82. A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform a method for network communication between a client and a server during a negotiated session, the method comprising:

sending a first request message from the server to the client;

sending a first response message from the client to the server in response to said first request message;

sending a second request message from the client to the server;

sending a second response message from the server to the client in response to said second request message; and

dynamically relocating the server.

83. A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform a method for network communication between a server and a client logged on to a network, the method comprising:

receiving a packet from an authentication server indicating that the client should have access to the server;

sending a message to the client to initiate session negotiation if the client should have access to the server;

negotiating a session between the client and the server if the client should have access to the server;

sending a first request message from the server to the client during said session;

sending a first response message from the client to the server in response to said first request message during said session;

sending a second request message from the client to the server during said session; and

sending a second response message from the server to the client in response to said second request message during said session.

84. A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform a method for network communication between a server and a client logged on to a network, the method comprising:

receiving a packet from an authentication server indicating that the client should have access to the server;

sending a message to the client to initiate session negotiation if the client should have access to the server;

negotiating a session between the server and the client if the client should have access to the server, said negotiating comprising agreeing upon a set of session parameters, one of said session parameters being a sequence number and another of said session parameters being an increment value or increment value algorithm;

communicating between the server and client during said session by transmitting messages between the server and client, each message including said sequence number;

incrementing said sequence number by said increment value or a value determined by said increment value algorithm each time a message is transmitted;

checking whether said sequence number matches a predicted sequence number each time a message is received by the client or the server; and

ignoring a received message if the sequence number of said received message does not match said predicted sequence number.

85. A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform a method for network communication between a server and a client logged on to a network, the method comprising:

receiving a packet from an authentication server indicating that the client should have access to the server;

sending a message to the client to initiate session negotiation if the client should have access to the server;

negotiating a session between the server and the client if the client should have access to the server, said negotiating comprising agreeing upon a set of session parameters, one of said session parameters being a sequence number and another of said session parameters being an increment value or increment value algorithm;

communicating between the server and client during said session by transmitting messages between the server and client, wherein said communicating involves sending a request message from either the client to the server or the server to the client, and then sending a response message in the other direction in response to said request message, each message including said sequence number;

incrementing said sequence number by said increment value or a value determined by said increment value algorithm each time a message is transmitted;

checking whether said sequence number matches a predicted sequence number each time a message is received by the client or the server; and

ignoring a received message if the sequence number of said received message does not match said predicted sequence number.

86. A server for use in a computer network, including:

an authentication packet receiver, which receives a packet from an authentication server indicating that a client should have access to the server;

a session initiator, which sends a message to said client to initiate session negotiation if said client should have access to the server;

a negotiator, which negotiates a session between the server and said client if said client should have access to the server, said negotiating comprising agreeing upon a set of session parameters, one of said session parameters being a sequence number and another of said session parameters being an increment value or increment value algorithm;

a transmitter, which communicates between the server and client by transmitting messages between the server and client, wherein said communicating involves sending a request message from the server to the client and awaiting a response message, or receiving a request message from said client and sending a response message to the client, each message including a sequence number, and wherein a received message is ignored if the sequence number of said received message does not match said predicted sequence number;

a sequence number incrementer, which increments said sequence number by said increment value or a value determined by said increment value algorithm each time a message is transmitted; and

a sequence number checker, which checks whether said sequence number matches a predicted sequence number each time a message is received by the server.

87. The server of claim 86, wherein said session initiator further sends a message to the client which indicates the location of the server, keeping the location of the server hidden from the client until the client is deemed to have appropriate access privileges.

88. The server of claim 86, wherein said transmitter further ignores any message sent from the client to the server if the client should not have access to the server, and ignores any message sent from the client to the server before it is determined if the client should have access to the server.

89. The server of claim 86, wherein said transmitter further ignores any message except a ping request sent from the client to the server if the client should not have access to the server, and ignores any message except a ping request sent from the client to the server before it is determined if the client should have access to the server.

90. The server of claim 89, further including a ping responder, which responds to a ping request with a pong message.

91. The server of claim 86, further including a dynamic server relocator, which dynamically relocates the server.

92. The server of claim 91, wherein said dynamic server relocator dynamically relocates the server by changing the server'"'"'s port address.

93. The server of claim 91, wherein said dynamic server relocator dynamically relocates the server by changing the server'"'"'s Internet Protocol (IP) address.

94. The server of claim 86, wherein said predicted sequence number is computed by:

maintaining a local variable on the server representing said predicted sequence number; and

incrementing said local variable on the server by said increment value or a value determined by said increment value algorithm each time the server receives a message from the client.

95. The server of claim 86, further including a session terminator, which terminates the session if the sequence number of a received message does not match said predicted sequence number.

96. The server of claim 86, wherein another of said session parameters agreed upon during negotiation is an encryption method and another of said session parameters agreed upon during said negotiation is a key.

97. The server of claim 86, wherein said transmitter encrypts said messages using said encryption method and said key and sends the messages through the network.

98. An apparatus for network communication between a server and a client logged on to a network, including:

means for receiving a packet from an authentication server indicating that the client should have access to the server;

means for sending a message to the client to initiate session negotiation if the client should have access to the server;

means for negotiating a session between the server and the client if the client should have access to the server, said negotiating comprising agreeing upon a set of session parameters, one of said session parameters being a sequence number and another of said session parameters being an increment value or increment value algorithm;

means for communicating between the server and client during said session by transmitting messages between the server and client, wherein said communicating involves sending a request message from the server to the client and awaiting a response message, or receiving a request message from said client and sending a response message to said client, each message including said sequence number and wherein a received message is ignored if the sequence number of said received message does not match said predicted sequence number;

means for incrementing said sequence number by said increment value or a value determined by said increment value algorithm each time a message is transmitted; and

means for checking whether said sequence number matches a predicted sequence number each time a message is received by the server.

99. The apparatus of claim 98, wherein said means for sending includes means for sending a message to the client which indicates the location of the server, keeping the location of the server hidden from the client until the client is deemed to have the appropriate access privileges.

100. The apparatus of claim 98, wherein said means for communicating further ignores any message sent from the client to the server if the client should not have access to the server, and ignores any message sent from the client to the server before it is determined if the client should have access to the server.

101. The apparatus of claim 98, wherein said means for communicating further ignores any message except a ping request sent from the client to the server if the client should not have access to the server, and ignoring any message except a ping request sent from the client to the server before it is determined if the client should have access to the server.

102. The apparatus of claim 101, further including means for responding to a ping request with a pong message.

103. The apparatus of claim 98, further including means for dynamically relocating the server.

104. The apparatus of claim 103, wherein said means for dynamically relocating includes means for changing the server'"'"'s port address.

105. The apparatus of claim 103, wherein said means for dynamically relocating includes means for changing the server'"'"'s IP address.

106. The apparatus of claim 98, wherein said predicted sequence number is computed by the steps of:

maintaining a local variable representing said predicted sequence number on both the client and the server;

incrementing said local variable on the server by said increment value or a value determined by said increment value algorithm each time the server receives a message from the client; and

incrementing said local variable on the client by said increment value or a value determined by said increment value algorithm each time the client receives a message from the server.

107. The apparatus of claim 98, further including means for terminating the session if the sequence number of a received message does not match said predicted sequence number.

108. The apparatus of claim 98, wherein said another of said session parameters agreed upon during said negotiation is an encryption method and another of said session parameters agreed upon during said negotiation is a key.

109. The apparatus of claim 98, wherein said means for communicating includes:

means for encrypting said messages using said encryption method and said key; and

means for sending the messages through the network.

110. A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform a method for network communication between a server and a client logged on to a network, the method including:

receiving a packet from an authentication server indicating that the client should have access to the server;

sending a message to the client to initiate session negotiation if the client should have access to the server;

negotiating a session between the server and the client if the client should have access to the server, said negotiating comprising agreeing upon a set of session parameters, one of said session parameters being a sequence number and another of said session parameters being an increment value or increment value algorithm;

communicating between the server and client during said session by transmitting messages between the server and client, wherein said communicating involves sending a request message from the server to the client and awaiting a response message, or receiving a request message from said client and sending a response message to said client, each message including said sequence number;

incrementing said sequence number by said increment value or a value determined by said increment value algorithm each time a message is transmitted;

checking whether said sequence number matches a predicted sequence number each time a message is received by the server; and

ignoring a received message if the sequence number of said received message does not match said predicted sequence number.