Controlling firewall ports in virtualized environments through public key cryptography

A system, comprising:

• one or more processors;
• and memory including instructions that, as a result of execution by the one or more processors, cause the system to:
• receive, at a proxy, information from a client computing system addressed to a port of a target computing system, the information including authorization information and associated with a first communication protocol, wherein the authorization information comprises at least a digital signature and a digital certificate;
• determine that a pass-through mode is not currently enabled at the proxy for communications from the client computing system to the target computing system, the pass-through mode allowing messages from the client computing system addressed to the port of the target computing system to reach the target computing system without being accessed by the proxy;
• perform a set of validation operations on the authorization information received with the information;
• and as a result of the set of validation operations resulting in successful authentication of the client computing system:
• cause the port of the target computing system to be opened;
• and allow data to be communicated from the client computing system to the port of the target computing system via a second communication protocol different from the first protocol, without passing through the proxy in the pass-through mode, wherein the system is configured to disable the pass-through mode, and wherein upon the pass-through mode being disabled, allowing the client computing system to continue to communicate with the target computing system upon the client computing system resending at least one of the digital signature or the a digital certificate specifying the certificate authority.

A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of execution by one or more processors of a computer system, cause the computer system to at least:

• authenticate a client computing system by at least performing, at an authentication system different than a target computing system, a set of validation operations on authorization information included in a communication addressed to a destination port of the target computing system wherein the authorization information comprises at least a digital signature and a digital certificate;
• determine that a pass-through mode is not currently enabled at the authentication system for communications from the client computing system to the target computing system, the pass-through mode allowing messages from the client computing system addressed to the port of the target computing system to reach the target computing system without being accessed by the authentication system;
• and
• as a result of the client computing system being authenticated by the set of validation operations, switch to a pass-through mode wherein a port of the target computing system is opened and data from the client computing system is communicated to the port of the target computing system without passing through the authentication system, wherein the authorization information is provided under a first protocol and the data is communicated to the port of the target computing system under a second protocol, different from the first protocol, wherein the authentication system is configured to disable the pass-through mode, wherein upon the pass-through mode being disabled, the client computing system resends at least one of the digital signature or the a digital certificate specifying the certificate authority to continue to communicate with the target computing system.