Open sesame

A computing device for network security, the computing device comprising:

• a processor;
• a memory, the memory storing instructions, which when executed by the processor, cause the computing device to perform operations comprising:
• receiving, over a network, an access request from an application on a second computing device for access to a network-based service;
• authenticating the second computing device;
• determining a third computing device, the third computing device providing the network-based service;
• and
• causing a firewall protecting the third computing device to allow a connection between the third computing device and the second computing device, the firewall denying all connections unless first allowed by the computing device.

A system for network security, the system comprising:

• a first computing device comprising:
• a processor;
• a memory, the memory storing instructions, which when executed by the processor, cause the first computing device to perform operations comprising:
• receiving, over a network, an access request from an application on a second computing device for access to a network-based service;
• authenticating the second computing device;
• determining a third computing device, the third computing device providing the network-based service;
• and
• sending a message causing a firewall device protecting the third computing device to allow a connection between the third computing device and the second computing device, the firewall device denying all connections unless first allowed by the first computing device;
• and
• the firewall device, comprising:
• a second processor;
• a second memory, the second memory storing second instructions, which when executed by the second processor, cause the firewall device to perform second operations comprising:
• maintaining a list of allowed traffic to the third computing device, the list of allowed traffic being initially empty;
• blocking all network traffic to the third computing device that is not on the list of allowed traffic;
• receiving from the first computing device the message to allow the connection between the third computing device and the second computing device;
• responsive to receiving the message from the first computing device, storing a source address of the third computing device and a source address of the second computing device in the list of allowed traffic;
• and
• subsequent to receiving from the first computing device the message, allowing traffic from the second computing device to the third computing device for a limited time, and upon expiry of the limited time, removing the source address of the third computing device and a source address of the second computing device in the list of allowed traffic such that subsequent network traffic from the second computing device is blocked unless another message is first received from the first computing device to allow the traffic.