Method of unblocking external computer systems in a computer network infrastructure, distributed computer network having such a computer network infrastructure as well as computer program product

A distributed computer network comprising:

• a computer network infrastructure including at least a broker computer system and a processing computer system, and
• at least an external computer system located outside the computer network infrastructure, wherein the external computer system is configured to 1) transmit an instruction packet to the broker computer system for instructing communication with the processing computer system, 2) generate and encrypt a first random number such that only the processing computer system can decrypt the first random number and the first random number is not readable by the broker computer system, and 3) transmit the encrypted first random number to the broker computer system,
• the broker computer system is configured to 1) generate a random port number of a network port in an automated manner, 2) transmit the random port number both to the processing computer system and to the external computer system, 3) generate and encrypt a second random number such that only the processing computer system can decrypt the second random number and the second random number is not readable by the external computer system, and 4) transmit the encrypted second random number to the external computer system,
• the processing computer system comprises an access control unit configured to keep predetermined network ports at least temporarily closed such that access to the processing computer system by the external computer system via a network by the network ports is prevented, but connection establishment between the processing computer system and the broker computer system is permitted to exchange the random port number or other information,
• the access control unit is further configured to unblock a network port corresponding to the random port number for communication with the external computer system and, after establishment of a connection to the selectively unblocked network port of the processing computer system, to restrict communication between the processing computer system and the external computer system to the unblocked network port of the processing computer system and a network port of the external computer system, known to the processing computer system by the established connection,
• the broker computer system is further configured to transmit the encrypted first and second random number to the processing computer system,
• the external computer system is further configured to transmit the encrypted first and second random number directly to the processing computer system by the established connection, and
• the processing computer system is further configured to decrypt the encrypted first and second random numbers transmitted to the processing computer system by the broker computer system and the external computer system respectively, and verify a respective match between the decrypted first and second random numbers transmitted to the processing computer system by the broker computer system and the external computer system respectively.

A computer program product configured to be executed within respective hardware processors on multiple computer systems of a distributed computer network, comprising a computer network infrastructure including at least a broker computer system and a processing computer system, and at least an external computer system located outside the computer network infrastructure, and which, when executed within the respective hardware processors, performs a method comprising:

• transmitting an instruction packet from an external computer system, which is configured outside the computer network infrastructure, to a broker computer system within the computer network infrastructure,
• generating a random port number of a network port by the broker computer system,
• transmitting the random port number from the broker computer system to the external computer system and at least one processing computer system within the computer network infrastructure in an automated manner,
• wherein the processing computer system at least temporarily keeps predetermined network ports closed toward the external computer system so that access to the processing computer system by the external computer system via network by the network ports is prevented,
• generating and encrypting a first random number by the external computer system such that only the processing computer system can decrypt the first random number and the first random number is not read by the broker computer system,
• transmitting the encrypted first random number from the external computer system to the broker computer system,
• generating and encrypting a second random number by the broker computer system such that only the processing computer system can decrypt the second random number and the second random number is not read by the external computer system,
• transmitting the encrypted second random number from the broker computer system to the external computer system,
• transmitting the encrypted first and second random number from the broker computer system to the processing computer system,
• unblocking the network port corresponding to the random port number by the processing computer system for communication with the external computer system,
• establishing a connection to the unblocked network port of the processing computer system by the external computer system,
• restricting the communication between the processing computer system and the external computer system to the unblocked network port of the processing computer system and a network port of the external computer system known to the processing computer system by the established connection,
• transmitting the encrypted first and second random number from the external computer system directly to the processing computer system by the established connection,
• decrypting the encrypted first and second random number, which were transmitted to the processing computer system by the broker computer system, in the processing computer system and decrypting the encrypted first and second random number, which were transmitted directly to the processing computer system by the external computer system, in the processing computer system, and
• verifying a respective match between the decrypted first and second random number, which were transmitted to the processing computer system by the broker computer system, with the decrypted first and second random number, which were transmitted directly to the processing computer system by the external computer system, in the processing computer system.