System for and method of securing a network utilizing credentials

• US 8,811,396 B2
• Filed: 05/24/2006
• Issued: 08/19/2014
• Est. Priority Date: 05/24/2006
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Maxsp Corporation
• Inventors: Keith, Robert O. Jr.
• Primary Examiner(s): HO, DUC CHI
• Application Number:
  US11/440,564
• Publication Number:
  US 20070274315A1
• Time in Patent Office: 3,009 Days
• Field of Search: None
• US Class Current: 370/392
• CPC Class Codes: H04L 2101/663 Transport layer addresses, e.g. aspects of transmission control protocol [TCP] or user datagram protocol [UDP] ports
• CPC Class Codes: H04L 47/27 Evaluation or update of window size, e.g. using information derived from acknowledged [ACK] packets
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Abstract

A system for and method of securing a network are described herein. A receiving device listens for packets with proper credentials. If a transmitting device sends the correct credentials, the receiving device will respond with an acknowledgment and further data is able to be transmitted. However, if the transmitting device does not send a packet with the proper credentials, then the receiving device will drop the packet and not respond. Thus, the transmitting device will be unaware of the presence of the receiving device, in particular when hackers are using scanning software to locate target devices.

Claims

1. A method of increasing network security comprising:

a. transmitting an initial packet from a first device to a second device;

b. receiving the initial packet at the second device from the first device;

c. verifying the initial packet has proper credentials, wherein the credentials are selected from the group consisting of a key, a code and a signature;

d. sending an acknowledgment from the second device to the first device only if the proper credentials are verified, wherein the credentials are not required to construct the acknowledgment; and

e. transmitting one or more subsequent packets from the first device to the second device without verifying the subsequent packets have proper credentials;

wherein the verification of the initial packet is performed independent of whether a device identifier or a user identifier of the first device is recognized by the second device, and further wherein the credentials are verified at the second device and stored within a wrapper header.

2. The method as claimed in claim 1 wherein the first device is a client and the second device is a server.

3. The method as claimed in claim 1 wherein the first device is a server and the second device is a client.

4. The method as claimed in claim 1 further comprising dropping the initial packet if the proper credentials are not verified.

5. The method as claimed in claim 1 wherein a protocol for receiving the initial packet is User Datagram Protocol or any functionally equivalent protocol.

6. The method as claimed in claim 1 wherein a protocol for sending an acknowledgment is Transmission Control Protocol or any functionally equivalent protocol.

7. The method as claimed in claim 1 wherein the first device and the second device are coupled by a network.

8. The method as claimed in claim 7 wherein the network is the Internet.

9. The method as claimed in claim 7 wherein the network is an intranet.

10. A method of increasing network security comprising:

a. transmitting an initial packet from a first device to a second device;

b. receiving the initial packet at the second device from the first device;

c. verifying the initial packet has proper credentials, wherein the credentials are selected from the group consisting of a key, a code and a signature;

d. sending an acknowledgment from the second device to the first device only if the proper credentials are verified, wherein the credentials are not required to construct the acknowledgment, further wherein the credentials are verified at the second device, and further wherein the credentials are stored within a wrapper header;

e. dropping the initial packet if the proper credentials are not verified; and

f. transmitting one or more subsequent packets from the first device to the second device without verifying the subsequent packets have proper credentials;

wherein the verification of the initial packet is performed independent of whether device identifier or a user identifier of the first device is recognized by the second device.

11. The method as claimed in claim 10 wherein the first device is a client and the second device is a server.

12. The method as claimed in claim 10 wherein the first device is a server and the second device is a client.

13. The method as claimed in claim 10 wherein a protocol for receiving the initial packet is User Datagram Protocol or any functionally equivalent protocol.

14. The method as claimed in claim 10 wherein a protocol for sending an acknowledgment is Transmission Control Protocol or any functionally equivalent protocol.

15. The method as claimed in claim 10 wherein the first device and the second device are coupled by a network.

16. The method as claimed in claim 15 wherein the network is the Internet.

17. The method as claimed in claim 15 wherein the network is an intranet.

18. A system for increasing network security comprising:

a. one or more first devices for transmitting an initial packet and one or more subsequent packets;

b. one or more second devices for receiving the initial packet and one or more subsequent packets, wherein the one or more second devices are coupled to the one or more first devices through a network; and

c. a set of credentials within the initial packet for verification, wherein the one or more second devices send an acknowledgment back to the one or more first devices only if the set of credentials are verified, wherein the credentials are not required to construct the acknowledgment, wherein the credentials are verified at the one or more second devices, wherein the set of credentials are selected from the group consisting of a key, a code and a signature, and further wherein the credentials are stored within a wrapper header;

wherein the verification of the initial packet is performed independent of whether a device identifier or a user identifier of each of the first devices is recognized by the second devices, and further wherein the first devices transmit and the second devices receive the subsequent packets without verifying the subsequent packets have proper credentials if the acknowledgment is received.

19. The system as claimed in claim 18 wherein the first device is a client and the second device is a server.

20. The system as claimed in claim 18 wherein the first device is a server and the second device is a client.

21. The system as claimed in claim 18 wherein the one or more second devices drop the initial packet if the set of credentials are not verified.

22. The system as claimed in claim 18 wherein a protocol for receiving the initial packet is User Datagram Protocol or any functionally equivalent protocol.

23. The system as claimed in claim 18 wherein a protocol for sending an acknowledgment is Transmission Control Protocol or any functionally equivalent protocol.

24. The system as claimed in claim 18 wherein the network is the Internet.

25. The system as claimed in claim 18 wherein the network is an intranet.

26. A network of devices for increasing network security comprising:

a. one or more client devices for transmitting an initial packet and one or more subsequent packets;

b. one or more server devices for receiving the initial packet and the subsequent packets, wherein the one or more server devices are coupled to the one or more client devices through a network; and

c. a set of credentials within the initial packet for verification, wherein the one or more server devices send an acknowledgment back to the one or more client devices only if the set of credentials are verified, wherein the credentials are not required to construct the acknowledgment, wherein the set of credentials are verified at the one or more server devices, wherein the set of credentials are selected from the group consisting of a key, a code and a signature, and further wherein the credentials are stored within a wrapper header;

wherein the verification of the initial packet is performed independent of whether a device identifier or a user identifier of each of the client devices is recognized by the server devices, and further wherein the client devices transmit and the server devices receive the subsequent packets without verifying the subsequent packets have proper credentials if the acknowledgment is received.

27. The network of devices as claimed in claim 26 wherein the one or more server devices drop the initial packet if the set of credentials are not verified.

28. The network of devices as claimed in claim 26 wherein a protocol for receiving the initial packet is User Datagram Protocol or any functionally equivalent protocol.

29. The network of devices as claimed in claim 26 wherein a protocol for sending an acknowledgment is Transmission Control Protocol or any functionally equivalent protocol.

30. The network of devices as claimed in claim 26 wherein the network is the Internet.

31. The network of devices as claimed in claim 26 wherein the network is an intranet.

32. An apparatus comprising a memory device, the memory device comprising:

a. an initial packet for increasing network security, the initial packet comprising;

i. data; and

ii. a set of credentials,

wherein the set of credentials are analyzed by a receiving device such that the receiving device sends an acknowledgment back and receives one or more subsequent packets without verifying the subsequent packets have proper credentials only if the set of credentials are valid, wherein the credentials are not required to construct the acknowledgment, wherein the set of credentials are selected from the group consisting of a key, a code and a signature and are stored within a wrapper header, and further wherein the apparatus is configured to transmit the initial packet to the receiving device independent of whether a device identifier or a user identifier of the receiving device is recognized by the apparatus.

33. The packet as claimed in claim 32 wherein the set of credentials are stored within a header.

34. The packet as claimed in claim 32 wherein the set of credentials are stored within a wrapper.

35. The packet as claimed in claim 32 wherein the set of credentials are encrypted.

36. The packet as claimed in claim 32 wherein the initial packet is a User Datagram Protocol packet or a functionally equivalent protocol packet.

37. A method of increasing network security comprising:

a. transmitting an initial packet from a first device to a second device;

b. receiving the initial packet at the second device from the first device using a User Datagram Protocol;

c. verifying the initial packet has proper credentials, wherein the credentials are selected from the group consisting of a key, a code and a signature;

d. sending an acknowledgment from the second device to the first device only if the proper credentials are verified; and

e. transmitting one or more subsequent packets from the first device to the second device without verifying the subsequent packets have proper credentials;

wherein the verification of the initial packet is performed independent of whether a device identifier or a user identifier of the first device is recognized by the second device, and further wherein the initial packet comprises a packet header and a wrapper with a wrapper header, and the credentials are stored within the wrapper header.