# US 10,313,305 B2 · Method of unblocking external computer systems in a computer network infrastructure, distributed computer network having such a computer network infrastructure as well as computer program product

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,313,305 B2
- Document ID: US10313305B2
- Status: Granted
- Kind: B2
- Application number: 15/535,168
- Filed: 2016-06-27
- Published: 2018-04-19
- Granted: 2019-06-04
- Earliest claimed: 2015-06-30
- Assignees: Fujitsu Technology Solutions Intellectual Property GmbH
- Applicants: Fujitsu Technology Solutions Intellectual Property GmbH
- Inventors: Heinz-Josef Claes; Alexander Hosfeld
- Web page: https://patentgrep.com/patent/US10313305B2

## CPC

- H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL}
- H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/10: {for controlling access to devices or network resources}
- H04L 63/166: {at the transport layer}
- H04L 69/162: {involving adaptations of sockets based mechanisms (secure socket layer H04L63/168)}
- G06F 2221/2101: Auditing as a secondary aspect
- H04L 63/102: {Entity profiles}
- H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A method unblocks external computer systems for communication with secured processing computer systems in a computer network infrastructure. An instruction packet is transmitted from an external computer system to a broker computer system within the computer network infrastructure. A random port number of a network port is then generated by the broker computer system, and the random port number is transmitted to a processing computer system. The processing computer system at least temporarily keeps predetermined network ports closed so that access by the external computer system via network by the network ports is prevented, wherein the random port number and/or other information can be interchanged between the processing computer system and the broker computer system, however. Subsequently, the network port corresponding to the random port number is unblocked by the processing computer system, and a connection to the unblocked network port of the processing computer system is established by the external computer system.

## Claims

### Claim 1

A method of unblocking external computer systems for communication with secured processing computer system in a computer network infrastructure, comprising:
transmitting an instruction packet from an external computer system, which is configured outside the computer network infrastructure, to a broker computer system within the computer network infrastructure,
generating a random port number of a network port by the broker computer system,
transmitting the random port number from the broker computer system to the external computer system and at least one processing computer system within the computer network infrastructure in an automated manner, wherein the processing computer system at least temporarily keeps predetermined network ports closed toward the external computer system so that access to the processing computer system by the external computer system via network by the network ports is prevented,
generating and encrypting a first random number by the external computer system such that only the processing computer system can decrypt the first random number and the first random number is not read by the broker computer system,
transmitting the encrypted first random number from the external computer system to the broker computer system,
generating and encrypting a second random number by the broker computer system such that only the processing computer system can decrypt the second random number and the second random number is not read by the external computer system,
transmitting the encrypted second random number from the broker computer system to the external computer system,
transmitting the encrypted first and second random number from the broker computer system to the processing computer system,
unblocking the network port corresponding to the random port number by the processing computer system for communication with the external computer system,
establishing a connection to the unblocked network port of the processing computer system by the external computer system,
restricting the communication between the processing computer system and the external computer system to the unblocked network port of the processing computer system and a network port of the external computer system known to the processing computer system by the established connection,
transmitting the encrypted first and second random number from the external computer system directly to the processing computer system by the established connection,
decrypting the encrypted first and second random number, which were transmitted to the processing computer system by the broker computer system, in the processing computer system and decrypting the encrypted first and second random number, which were transmitted directly to the processing computer system by the external computer system, in the processing computer system, and
verifying a respective match between the decrypted first and second random number, which were transmitted to the processing computer system by the broker computer system, with the decrypted first and second random number, which were transmitted directly to the processing computer system by the external computer system, in the processing computer system.

### Claim 2 (depends on 1)

The method according to claim 1, wherein the processing computer system at least temporarily keeps predetermined network ports closed toward the broker computer system so that access to the processing computer system by the broker computer system via network by the network ports is prevented, wherein, however, the processing computer system can access the broker computer system to retrieve the random port number and/or other information from the broker computer system.

### Claim 3 (depends on 1)

The method according to claim 1, further comprising:
restricting the connection established to the selectively unblocked network port by the external computer system to an exchange of authentication information between the external computer system and the processing computer system,
verifying authentication information transmitted by the external computer system, and
unblocking the connection to the selectively unblocked network port of the processing computer system established by the external computer system for extended access to the processing computer system or to further processing computer systems within the computer network infrastructure when verifying the authentication information was successful.

### Claim 4 (depends on 1)

The method according to claim 1, wherein the first random number is signed with a signature of the external computer system prior to the transmission, and the second random number generated in the broker computer system is signed with a signature of the broker computer system prior to the transmission.

### Claim 5 (depends on 4)

The method according to claim 4, wherein, after the transmission of the signed first random number from the external computer system to the broker computer system, the signature of the first random number is signed with a further signature of the broker computer system, and
after the transmission of the signed second random number from the broker computer system to the external computer system, the signature of the second random number is signed with a further signature of the external computer system.

### Claim 6 (depends on 1)

The method according to claim 1, wherein the connection between the external computer system and the processing computer system is disestablished by the processing computer when the verification of the respective match of the first and second random numbers is negative.

### Claim 7 (depends on 2)

The method according to claim 2, wherein the transmission of the random port number or other information from the broker computer system to the processing computer system comprises:
sending a predetermined data sequence from the broker computer system or from the external computer system to the processing computer system, wherein the predetermined network ports of the processing computer system are closed, and the sequence addresses one or multiple network ports of the processing computer system in a predetermined order,
verifying whether the sent data sequence matches a predetermined sequence in the processing computer system, and
causing the transmission of the random port number or other information by the processing computer system if the verification of the sent sequence is positive, wherein the processing computer system per se establishes a connection to the broker computer system and retrieves the random port number or other information from the broker computer system.

### Claim 8

A distributed computer network comprising:
a computer network infrastructure including at least a broker computer system and a processing computer system, and
at least an external computer system located outside the computer network infrastructure, wherein the external computer system is configured to 1) transmit an instruction packet to the broker computer system for instructing communication with the processing computer system, 2) generate and encrypt a first random number such that only the processing computer system can decrypt the first random number and the first random number is not readable by the broker computer system, and 3) transmit the encrypted first random number to the broker computer system,
the broker computer system is configured to 1) generate a random port number of a network port in an automated manner, 2) transmit the random port number both to the processing computer system and to the external computer system, 3) generate and encrypt a second random number such that only the processing computer system can decrypt the second random number and the second random number is not readable by the external computer system, and 4) transmit the encrypted second random number to the external computer system,
the processing computer system comprises an access control unit configured to keep predetermined network ports at least temporarily closed such that access to the processing computer system by the external computer system via a network by the network ports is prevented, but connection establishment between the processing computer system and the broker computer system is permitted to exchange the random port number or other information,
the access control unit is further configured to unblock a network port corresponding to the random port number for communication with the external computer system and, after establishment of a connection to the selectively unblocked network port of the processing computer system, to restrict communication between the processing computer system and the external computer system to the unblocked network port of the processing computer system and a network port of the external computer system, known to the processing computer system by the established connection,
the broker computer system is further configured to transmit the encrypted first and second random number to the processing computer system,
the external computer system is further configured to transmit the encrypted first and second random number directly to the processing computer system by the established connection, and
the processing computer system is further configured to decrypt the encrypted first and second random numbers transmitted to the processing computer system by the broker computer system and the external computer system respectively, and verify a respective match between the decrypted first and second random numbers transmitted to the processing computer system by the broker computer system and the external computer system respectively.

### Claim 9 (depends on 8)

The distributed computer network according to claim 8, which is configured to perform a method comprising:
transmitting an instruction packet from an external computer system, which is configured outside the computer network infrastructure, to a broker computer system within the computer network infrastructure,
generating a random port number of a network port by the broker computer system,
transmitting the random port number from the broker computer system to the external computer system and at least one processing computer system within the computer network infrastructure in an automated manner, wherein the processing computer system at least temporarily keeps predetermined network ports closed toward the external computer system so that access to the processing computer system by the external computer system via network by the network ports is prevented,
generating and encrypting a first random number by the external computer system such that only the processing computer system can decrypt the first random number and the first random number is not read by the broker computer system,
transmitting the encrypted first random number from the external computer system to the broker computer system,
generating and encrypting a second random number by the broker computer system such that only the processing computer system can decrypt the second random number and the second random number is not read by the external computer system,
transmitting the encrypted second random number from the broker computer system to the external computer system,
transmitting the encrypted first and second random number from the broker computer system to the processing computer system,
unblocking the network port corresponding to the random port number by the processing computer system for communication with the external computer system,
establishing a connection to the unblocked network port of the processing computer system by the external computer system,
restricting the communication between the processing computer system and the external computer system to the unblocked network port of the processing computer system and a network port of the external computer system known to the processing computer system by the established connection,
transmitting the encrypted first and second random number from the external computer system directly to the processing computer system by the established connection,
decrypting the encrypted first and second random number, which were transmitted to the processing computer system by the broker computer system, in the processing computer system and decrypting the encrypted first and second random number, which were transmitted directly to the processing computer system by the external computer system, in the processing computer system, and
verifying a respective match between the decrypted first and second random number, which were transmitted to the processing computer system by the broker computer system, with the decrypted first and second random number, which were transmitted directly to the processing computer system by the external computer system, in the processing computer system.

### Claim 10

A computer program product configured to be executed within respective hardware processors on multiple computer systems of a distributed computer network, comprising a computer network infrastructure including at least a broker computer system and a processing computer system, and at least an external computer system located outside the computer network infrastructure, and which, when executed within the respective hardware processors, performs a method comprising:
transmitting an instruction packet from an external computer system, which is configured outside the computer network infrastructure, to a broker computer system within the computer network infrastructure,
generating a random port number of a network port by the broker computer system,
transmitting the random port number from the broker computer system to the external computer system and at least one processing computer system within the computer network infrastructure in an automated manner,
wherein the processing computer system at least temporarily keeps predetermined network ports closed toward the external computer system so that access to the processing computer system by the external computer system via network by the network ports is prevented,
generating and encrypting a first random number by the external computer system such that only the processing computer system can decrypt the first random number and the first random number is not read by the broker computer system,
transmitting the encrypted first random number from the external computer system to the broker computer system,
generating and encrypting a second random number by the broker computer system such that only the processing computer system can decrypt the second random number and the second random number is not read by the external computer system,
transmitting the encrypted second random number from the broker computer system to the external computer system,
transmitting the encrypted first and second random number from the broker computer system to the processing computer system,
unblocking the network port corresponding to the random port number by the processing computer system for communication with the external computer system,
establishing a connection to the unblocked network port of the processing computer system by the external computer system,
restricting the communication between the processing computer system and the external computer system to the unblocked network port of the processing computer system and a network port of the external computer system known to the processing computer system by the established connection,
transmitting the encrypted first and second random number from the external computer system directly to the processing computer system by the established connection,
decrypting the encrypted first and second random number, which were transmitted to the processing computer system by the broker computer system, in the processing computer system and decrypting the encrypted first and second random number, which were transmitted directly to the processing computer system by the external computer system, in the processing computer system, and
verifying a respective match between the decrypted first and second random number, which were transmitted to the processing computer system by the broker computer system, with the decrypted first and second random number, which were transmitted directly to the processing computer system by the external computer system, in the processing computer system.