# US 10,313,318 B2 · Port scrambling for computer networks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,313,318 B2 - Document ID: US10313318B2 - Status: Granted - Kind: B2 - Application number: 15/800,965 - Filed: 2017-11-01 - Published: 2018-03-08 - Granted: 2019-06-04 - Earliest claimed: 2017-11-01 - Assignees: Cyber 2.0 (2015) Ltd. - Applicants: Cyber 2.0 (2015) Ltd. - Inventors: Erez Kaplan Haelion - Web page: https://patentgrep.com/patent/US10313318B2 ## CPC - H04L 63/061: {for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838)} - H04L 63/0407: {wherein the identity of one or more communicating identities is hidden (cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00)} - H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)} - H04L 63/068: {using time-dependent keys, e.g. periodically changing keys (cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088)} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method, system and computer program product providing port scrambling for securing communications in internal computer networks are disclosed. A transformation function is applied on an identifier of a first port at which an outgoing communication is designated to be received, whereby an identifier of a second port the outgoing communication is directed to be received at is obtained. The transformation function depends on at least one parameter shared among a plurality of devices in a computer network, whereby a device receiving the communication at the second port is enabled to apply an inverse transformation function on the identifier of the second port to obtain the identifier of the first port and redirect the communication thereto. The transformation function is applied in condition that transmittal of the outgoing communication was requested by an application program listed in a list of authorized application programs for the plurality of devices. ## Claims ### Claim 1 A method comprising: receiving, in a computerized apparatus, a request of a program to transmit an outgoing communication designated to be received at a destination via a port; in response to a determination that the program is listed in a list of authorized programs, modifying the outgoing communication to be designated to be received at the destination via a scrambled port, wherein the scrambled port is computed based on the port and using a transformation function; wherein the transformation function depends on the list of authorized programs. ### Claim 2 (depends on 1) The method of claim 1, wherein the transformation function depends on at least one of: a fixed encryption key; a time-dependent encryption key; a combination of fixed and time-dependent keys. ### Claim 3 (depends on 1) The method of claim 1, wherein the transformation function is based on a time-dependent encryption key, wherein computerized apparatus is connectable via a computer network to a server that is configured to distributing and synchronizing time-dependent encryption keys among a plurality of devices sharing the list of authorized programs. ### Claim 4 (depends on 1) The method of claim 1, wherein the computerized apparatus is comprised by a computer network connecting a plurality of devices, wherein the computer network further comprises a server responsible for maintaining the list of authorized programs and updating the plurality of devices with updates thereto. ### Claim 5 (depends on 1) The method of claim 1 further comprising: receiving, in the computerized apparatus, an incoming communication via a second port, wherein the incoming communication is received from an external device; computing an unscrambled port based on the second port; wherein said computing is performed using an inverse function of the transformation function and is based on the list of authorized programs; and, redirecting the incoming communication to be received at the unscrambled port. ### Claim 6 (depends on 5) The method of claim 5, wherein the unscrambled port is the port; and, wherein the second port is the scrambled port. ### Claim 7 (depends on 1) The method of claim 1 further comprising receiving, in the computerized apparatus, a subsequent request of a second program being executed by the computerized apparatus to transmit an outgoing communication designated to be received at a destination external to the computerized apparatus via the port; determining that the second program is not listed in the list of authorized programs; and in response to said determining, transmitting the subsequent request without modifying a designated port thereof. ### Claim 8 (depends on 1) The method of claim 1, further comprising: automatically updating a content of a parameter that the transformation function is based on in each device of a plurality of devices that are connected via a computerized network, whereby dynamically modifying operation of the transformation function for all devices of the plurality of devices. ### Claim 9 (depends on 1) The method of claim 1, wherein the destination is a second device comprised by a plurality of devices sharing the list of authorized programs, wherein the second device is configured to apply an inverse function of the transformation function to unscramble a port of each incoming communication. ### Claim 10 A method comprising: receiving, in a computerized apparatus, an incoming communication via a port, wherein the incoming communication is received from an external device via a computer network; computing an unscrambled port based on the port, wherein said computing is performed using an inverse function of a transformation function and is based on a list of authorized programs; redirecting the incoming communication to be received in the unscrambled port. ### Claim 11 (depends on 10) The method of claim 10, further comprising issuing a notification to a server responsive to the unscrambled port being identified as a port that is not being used. ### Claim 12 (depends on 10) The method of claim 10, wherein said incoming communication is an outgoing communication of the external device, wherein the outgoing communication is initiated by a program executed by the external device and designated to be received at the computerized apparatus via the unscrambled port, wherein the outgoing communication is directed towards the computerized apparatus via the port based on the external device modifying the outgoing communication to be received at the scrambled port after determining that the program is listed in the list of authorized application programs, wherein the modification of the outgoing communication by the external device is performed using the transformation function. ### Claim 13 A non-transitory computer readable medium retaining program instructions, which program instructions when read by a processor of a computerized apparatus, cause the processor to perform: in response to receiving a request of a program to transmit an outgoing communication designated to be received at a destination via a port and determining whether the program is listed in a list of authorized programs; in response to a determination that the program is listed in the list of authorized programs, modifying the outgoing communication to be designated to be received at the destination via a scrambled port, wherein the scrambled port is computed based on the port and using a transformation function; wherein the transformation function depends on the list of authorized programs. ### Claim 14 (depends on 13) The non-transitory computer readable medium of claim 13, wherein the transformation function depends on at least one of: a fixed encryption key; a time-dependent encryption key; a combination of fixed and time-dependent keys. ### Claim 15 (depends on 13) The non-transitory computer readable medium of claim 13, wherein the transformation function is based on a time-dependent encryption key, wherein computerized apparatus is connectable via a computer network to a server that is configured to distributing and synchronizing time-dependent encryption keys among a plurality of devices sharing the list of authorized programs. ### Claim 16 (depends on 13) The non-transitory computer readable medium of claim 13, wherein the computerized apparatus is comprised by a computer network connecting a plurality of devices, wherein the computer network further comprises a server responsible for maintaining the list of authorized programs and updating the plurality of devices with updates thereto. ### Claim 17 (depends on 13) The non-transitory computer readable medium of claim 13, wherein the instructions further cause the processor to perform: in receiving an incoming communication via a second port, computing an unscrambled port based on the second port, wherein the incoming communication is received from an external device, wherein said computing is performed using an inverse function of the transformation function and is based on the list of authorized programs; and, redirecting the incoming communication to be received at the unscrambled port. ### Claim 18 (depends on 17) The non-transitory computer readable medium of claim 17, wherein the unscrambled port is the port; and, wherein the second port is the scrambled port. ### Claim 19 (depends on 13) The non-transitory computer readable medium of claim 13, wherein the instructions further cause the processor to perform: in response to a determination that the program is not listed in the list of authorized programs, allowing the outgoing communication to be transmitted and remain directed at the port. ### Claim 20 (depends on 13) The non-transitory computer program readable medium of claim 13, wherein the instructions further cause the processor to perform: automatically updating a content of a parameter that the transformation function depends on in each device of a plurality of devices that are connected via a computerized network, whereby dynamically modifying operation of the transformation function for all devices of the plurality of devices. ### Claim 21 (depends on 13) The non-transitory computer program readable medium of claim 13, wherein the destination is a second device comprised by a plurality of devices sharing the list of authorized programs, wherein the second device is configured to apply an inverse function of the transformation function to unscramble a port of each incoming communication. ### Claim 22 A non-transitory computer program readable medium retaining program instructions, which program instructions when read by a processor, cause the processor to perform a method comprising: in response to receiving an incoming communication via a port, computing an unscrambled port based on the port, wherein said computing is performed using an inverse function of a transformation function and is based on a list of authorized programs, wherein the incoming communication is received from an external device via a computer network; redirecting the incoming communication to be received in the unscrambled port. ### Claim 23 (depends on 22) The non-transitory computer program readable medium of claim 22, wherein the instructions further cause the processor to perform: issuing a notification to a server responsive to the unscrambled port being identified as a port that is not being used. ### Claim 24 (depends on 22) The non-transitory computer program readable medium of claim 22, wherein the incoming communication is an outgoing communication of the external device, wherein the outgoing communication is initiated by a program executed by the external device and designated to be received at the computerized apparatus via the unscrambled port, wherein the outgoing communication is directed towards the computerized apparatus via the port based on the external device modifying the outgoing communication to be received at the scrambled port after determining that the program is listed in the list of authorized application programs, wherein the modification of the outgoing communication by the external device is performed using the transformation function.