# US 10,454,899 B1 · Controlling firewall ports in virtualized environments through public key cryptography > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,454,899 B1 - Document ID: US10454899B1 - Status: Granted - Kind: B1 - Application number: 14/659,367 - Filed: 2015-03-16 - Granted: 2019-10-22 - Earliest claimed: 2015-03-16 - Assignees: Amazon Technologies, Inc. - Applicants: Amazon Technologies, Inc. - Inventors: Jacob Adam Gabrielson - Web page: https://patentgrep.com/patent/US10454899B1 ## CPC - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 9/3247: {involving digital signatures} - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]} - H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 2209/64: Self-signed certificates - H04L 2209/72: Signcrypting, i.e. digital signing and encrypting simultaneously - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system and method for client authentication wherein a client computing system is authenticated by at least performing, at an authentication system different than a target computing system, a set of validation operations on authorization information addressed to a destination port of the target computing system, and, as a result of the client computing system being authenticated by the set of validation operations, switching to a mode wherein a port of the target computing system is opened and data from the client computing system is communicated to the port of the target computing system. ## Claims ### Claim 1 A computer-implemented method, comprising: intercepting, at a proxy, a message from a client computing system addressed to a port of a target computing system, a digital signature, and a digital certificate specifying a certificate authority; determining that a pass-through mode is not currently enabled at the proxy for communications from the client computing system to the target computing system, the pass-through mode allowing messages from the client computing system addressed to the port of the target computing system to reach the target computing system without passing through the proxy; determining that the digital signature is valid, the digital certificate is valid, and that the certificate authority is specified as trusted; communicating with a management service to cause the management service to open the port of the target computing system for the client computing system; enabling the pass-through mode for communications from the client computing system to the target computing system at the proxy, wherein at least the digital signature and the digital certificate are communicated via a first protocol and the communications from the client computing system to the target computing system are communicated via a second protocol, different from the first protocol, wherein at least one of the proxy or the management service is configured to disable the pass-through mode; and upon the pass-through mode being disabled, requesting, from the client computing system, at least one of the digital signature or the a digital certificate specifying the certificate authority to continue to allow communication with the target computing system. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the target computing system is a virtual machine instance of a virtual computer system service. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the digital certificate is a short-duration digital certificate associated with a long-duration digital certificate. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein enabling the pass-through mode includes storing a status of enabled, in association with the client, in a data store accessible to a plurality of proxies. ### Claim 5 A system, comprising: one or more processors; and memory including instructions that, as a result of execution by the one or more processors, cause the system to: receive, at a proxy, information from a client computing system addressed to a port of a target computing system, the information including authorization information and associated with a first communication protocol, wherein the authorization information comprises at least a digital signature and a digital certificate; determine that a pass-through mode is not currently enabled at the proxy for communications from the client computing system to the target computing system, the pass-through mode allowing messages from the client computing system addressed to the port of the target computing system to reach the target computing system without being accessed by the proxy; perform a set of validation operations on the authorization information received with the information; and as a result of the set of validation operations resulting in successful authentication of the client computing system: cause the port of the target computing system to be opened; and allow data to be communicated from the client computing system to the port of the target computing system via a second communication protocol different from the first protocol, without passing through the proxy in the pass-through mode, wherein the system is configured to disable the pass-through mode, and wherein upon the pass-through mode being disabled, allowing the client computing system to continue to communicate with the target computing system upon the client computing system resending at least one of the digital signature or the a digital certificate specifying the certificate authority. ### Claim 6 (depends on 5) The system of claim 5, wherein the instructions that cause the system to cause the port of the target computing system to be opened, further include instructions that, as a result of execution by the one or more processors, cause the system to submit a request to a port agent executing on the target computing system to open the port on the target computing system. ### Claim 7 (depends on 5) The system of claim 5, wherein: the target computing system is a virtual machine instance in a virtual network; and the instructions that cause the system to cause the port of the target computing system to be opened further include instructions that, as a result of execution by the one or more processors, cause the system to submit a request to a virtual networking layer of the virtual network to allow the data to be communicated from the client computing system to the port of the target computing system. ### Claim 8 (depends on 5) The system of claim 5, wherein the authorization information is caused to be provided to the system from the client computing system by a computing resource service provider-provided wrapper function executing on the client computing system. ### Claim 9 (depends on 5) The system of claim 5, wherein the information received from the client computing system is received as a Hypertext Transfer Protocol request. ### Claim 10 (depends on 5) The system of claim 5, wherein the data communicated from the client computing system to the port of the target computing system is received by the proxy and forwarded to the target computing system. ### Claim 11 (depends on 5) The system of claim 5, wherein the instructions that cause the system to allow the data to be communicated from the client computing system to the port of the client computing system include instructions that reconfigure a network of the target computing system such that the data goes directly to the target computing system without being received by the proxy. ### Claim 12 (depends on 5) The system of claim 5, wherein the instructions that cause the system to perform the set of validation operations on the authorization information further include instructions that, as a result of execution by the one or more processors, cause the system to: determine that the digital certificate is valid; and determine that a certificate authority that issued the digital certificate is specified as trusted. ### Claim 13 A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of execution by one or more processors of a computer system, cause the computer system to at least: authenticate a client computing system by at least performing, at an authentication system different than a target computing system, a set of validation operations on authorization information included in a communication addressed to a destination port of the target computing system wherein the authorization information comprises at least a digital signature and a digital certificate; determine that a pass-through mode is not currently enabled at the authentication system for communications from the client computing system to the target computing system, the pass-through mode allowing messages from the client computing system addressed to the port of the target computing system to reach the target computing system without being accessed by the authentication system; and as a result of the client computing system being authenticated by the set of validation operations, switch to a pass-through mode wherein a port of the target computing system is opened and data from the client computing system is communicated to the port of the target computing system without passing through the authentication system, wherein the authorization information is provided under a first protocol and the data is communicated to the port of the target computing system under a second protocol, different from the first protocol, wherein the authentication system is configured to disable the pass-through mode, wherein upon the pass-through mode being disabled, the client computing system resends at least one of the digital signature or the a digital certificate specifying the certificate authority to continue to communicate with the target computing system. ### Claim 14 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein the port of the target computing system that is opened is a different port from the destination port of the target computing system to which the communication was addressed. ### Claim 15 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein the instructions that cause the computer system to the set of validation operations include one or more of verifying the digital signature of the client computing system, verifying a digital signature of a certificate authority, validating information in the digital certificate, or verifying that a certificate authority is specified as a trusted certificate authority. ### Claim 16 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein: the target computing system is a computing system of a customer of a computing resource service provider; the customer specifies through an interface provided by the computing resource service provider whether a certificate authority is trusted by the target computing system; and the set of validation operations include verifying that the certificate authority has been specified by the customer as trusted by the target computing system. ### Claim 17 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein the data is communicated to the port of the target computing system under the second protocol without using the first protocol. ### Claim 18 (depends on 17) The non-transitory computer-readable storage medium of claim 17, wherein the first protocol is a Transport Layer Security or Secure Sockets Layer protocol. ### Claim 19 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein the instructions further include instructions that, as a result of execution by the one or more processors, cause the computer system to, based at least in part on the validation: set a timeout for the opened port; and close the opened port when the timeout for the opened port is reached. ### Claim 20 (depends on 19) The non-transitory computer-readable storage medium of claim 19, wherein the timeout is an idle timeout and the opened port is closed if the target does not receive any data from the client computing system for an amount of time equal to or more than the idle timeout.