Secure connection initiation with hosts behind firewalls
AssigneesAlcatel-Lucent USA Inc., Alcatel-Lucent Ireland Ltd.
InventorsKarl Georg Hampel, Davide Cherubini, Rouzbeh Razavi
Life of this patent
Estimating the term…
Abstract
The invention is directed to an inter-host signaling protocol, referred to herein as Knock-On Protocol (KOP), for establishing in a secure manner a connection with a host behind firewall. Some embodiments of the invention are directed to a Knock-On Feature (KOF) used in intermediate firewalls or network address translators to enable connection establishment through the FW or NAT to hosts behind the FW or NAT. Advantageously the KOF may include a prefix-based protection feature to protect against address spoofing used in a message flood attack.
Claims20
A method of establishing a connection between a first host system and a second host system through a firewall protecting the second host system, comprising:
- performing by a knock-on-feature (KOF) apparatus the steps of:
- receiving a first message sent by the first host system;
- determining the first message is of a first type for establishing the connection between the first host system and a second host system;
- determining respective addresses of the first and second hosts systems from the first message;
- determining if any state information exists on the KOF apparatus for a 2-tuple corresponding to the addresses of the first and second host systems;
- and
- sending the first message to the first host system if no said state information for the 2-tuple exists on the KOF apparatus.
Dependencies are inferred from the claim text.