US 2013/0298218 A1Published application

Method for secure single-packet authorization within cloud computing networks

OwnerMichael B. Rashinventor

Life of this patent

Estimating the term…

Loading patent…

Abstract

A method for secure single-packet authorization and secure transparent access to software services residing on cloud-based servers other than the host system where the SPA server itself is running. A single packet authorization (SPA) server running on a host system passively monitors a network for a valid SPA packet while maintaining a default deny stance on a gateway packet filter. The SPA server stores the MD5 sum of every valid SPA packet that it monitors and flags any duplicate access attempts. This way, if any SPA packet has the same MD5 hash as a previously monitored packet the SPA server treats the packet as malicious. After a valid SPA packet is sent, the SPA host server provides a Network Address Translation (NAT) which essentially creates an “SPA gateway” within a Cloud network independent of any other border gateway devices that already exist within the Cloud. The client system may then request access via the SPA gateway to services that are on other Cloud systems besides the one where the SPA server is running.

Claims1

Dependent claims

A method for secure remote authorization of services within a Cloud computing network using a single packet authorization (SPA) server on a host system that is also running a NAT-enabled firewall in a default-drop stance, a SPA client on a client system, a NAT-enabled router in said Cloud computing network with an access control list of rentable IP addresses in said Cloud computing network, and a formatted SPA packet sent from the client in order to gain access to services on the host, comprising the steps of:

configuring constructing a NAT rule to translate the incoming SPA-authenticated connection to the specified non-routable internal IP addressaid SPA server to allow certain predetermined packets;
constructing an encrypted packet of access code at said SPA client comprising a non-routable IP address that is internal to tire Cloud computing network, a plurality of bytes of random data and a hash function of the random data;
sending said packet to the SPA server on said host system over the Internet;
replacing the non-routable IP address in said packet at said SPA server with a routable IP address acquired from the access control list of routable IP addresses in said Cloud computing network to thereby allow access to said routable IP address if said packet matches a predetermined packet;
constructing a NAT rule to translate the incoming SPA-authenticated connection to the specified non-routable internal IP address
storing the hash function of every allowed packet at the SPA server and preventing access for any subsequently sent duplicate packets.

3 more elements

Dependencies are inferred from the claim text.

Facts

Application: 13/855,662Filed 2 Apr 2013
Priority: 22 Mar 2006
Published: 7 Nov 2013
Term ends: Not estimatedThe source records don’t support an estimate.

Classification10 codes

H04L 63/02
Network architectures or network communication protocols for network security: for separating internal from external traffic, e.g. firewalls
G06F 21/552
Detecting local intrusion or implementing counter-measures: involving long-term monitoring or reporting
H04L 63/10
Network architectures or network communication protocols for network security: for controlling access to devices or network resources
H04L 63/12
Network architectures or network communication protocols for network security: applying verification of the received information

Family

Application60/784,701Us provisional application · filed 22 Mar 2006
Application11/726,518Continuation · filed 22 Mar 2007
Application13/855,662Continuation
US 2007/0234428 A1Published application
US 8,413,248 B2Related patent
US 9,210,126 B2Related patent
US 2013/0298218 A1This patent

From the US filing history. Foreign family members aren’t listed.