Securing access to network devices utilizing two factor authentication and dynamically generated temporary firewall rules

A method providing a technical solution to the technical problem of providing authenticated remote access to an electronic device on an internal network in a manner which obviates the ability of attackers to gain access via an exposed port, the method comprising:

• (a) effecting display, to a user who has utilized a web browser loaded on a first device remote from the internal network to navigate to a uniform resource locator corresponding to a network security system portal implemented at a network security system device providing selective access to the internal network, of a login page prompting the user to input first authentication credentials to authenticate, the first authentication credentials comprising a user name and password;
• (b) receiving, at the network security device, data corresponding to input by the user at the first device representing an attempt to provide the first authentication credentials;
• (c) authenticating, based on communication with a domain controller of the internal network, that the input by the user at the first device representing an attempt to provide the first authentication credentials matches valid authentication credentials;
• (d) effecting display, to the user in the web browser loaded on the first device, of a second factor authentication interface prompting the user to input a second factor authentication verification code;
• (e) receiving, at the network security device, data corresponding to input by the user at the first device representing an attempt to provide the second factor authentication verification code;
• (f) authenticating the user to the network security system portal based on the received data corresponding to input representing an attempt to provide the second factor authentication verification code by validating that such input is the correct second factor authentication verification code, the second factor authentication verification code having been generated at a mobile device of the user based on a stored second factor authentication secret;
• (g) after authenticating the user,
• (i) determining one or more network security system rules for the network security system portal for which the user is an allowed user,
• (ii) determining one or more available hosts associated with the determined one or more security system rules,
• (iii) effecting display, to the user in the web browser loaded on the first device, of an interface of the network security system portal providing a list of devices available to be connected to, each listed device corresponding to one of the determined one or more available hosts,
• (iv) receiving, at the network security device, data corresponding to input by the user at the first device representing a selection of a particular listed available device;
• (h) based on user selection of the available device, automatically creating a one-time port forwarding rule to set up a connection between the first device and the selected particular device, the one-time port forwarding rule being defined to forward packets received at the network security device at a particular port determined based on the respective rule for the available host representing the selected particular device, and the one time port forwarding rule being defined to forward such packets to the IP address and port specified in the respective rule for the available host representing the selected particular device;
• (i) receiving, at the network security device, an initial packet sent by the first device to the network security device at the particular port to set up the connection between the first device and the particular device;
• (j) based on the one-time port forwarding rule, updating one or more destination fields of the received initial packet to be the IP address and port specified in the respective rule for the available host representing the selected particular device, and forwarding the received initial packet to the particular device;
• (k) adding, by the network security device to a state table, connection information for the received initial packet, the connection information including an indication that the connection has been established;
• (l) based on determining that the connection has been established, automatically deleting the one-time port forwarding rule;
• and
• (m) thereafter, upon receiving a subsequent packet at the network security device addressed to the particular port from the first device, determining that the subsequent packet belongs to the connection for which connection information exists in the state table, and based thereon updating one or more destination fields of the received subsequent packet to be the IP address and port specified for the connection in the state table, and forwarding the received subsequent packet to the particular device;
• (n) whereby, automatic creation of a dynamic one-time port forwarding rule for an authorized user's current IP address following two factor authentication of the authorized user is provided which enables authenticated remote access to an electronic device on an internal network in a manner which obviates the ability of attackers to gain access via an exposed port.

A method providing a technical solution to the technical problem of providing authenticated remote access to a remote electronic device in a manner which obviates the ability of attackers to gain access, the method comprising:

• (a) effecting display, to a user who has utilized a web browser loaded on a first device remote from the internal network to navigate to a uniform resource locator corresponding to a network security system portal implemented at a network security system device providing selective access to one or more remote electronic resources, of a login page prompting the user to input first authentication credentials to authenticate, the first authentication credentials comprising a user name and password;
• (b) receiving, at the network security device, data corresponding to input by the user at the first device representing an attempt to provide the first authentication credentials;
• (c) authenticating, based on communication with a domain controller of the internal network, that the input by the user at the first device representing an attempt to provide the first authentication credentials matches valid authentication credentials;
• (d) effecting display, to the user in the web browser loaded on the first device, of a second factor authentication interface prompting the user to input a second factor authentication verification code;
• (e) receiving, at the network security device, data corresponding to input by the user at the first device representing an attempt to provide the second factor authentication verification code;
• (f) authenticating the user to the network security system portal based on the received data corresponding to input representing an attempt to provide the second factor authentication verification code by validating that such input is the correct second factor authentication verification code, the second factor authentication verification code having been generated at a mobile device of the user based on a stored second factor authentication secret;
• (g) after authenticating the user,
• (i) determining one or more network security system rules for the network security system portal for which the user is an allowed user,
• (ii) determining one or more available hosts associated with the determined one or more security system rules,
• (iii) effecting display, to the user in the web browser loaded on the first device, of an interface of the network security system portal providing a list of devices available to be connected to, each listed device corresponding to one of the determined one or more available hosts,
• (iv) receiving, at the network security device, data corresponding to input by the user at the first device representing a selection of a particular listed available device;
• (h) based on user selection of the available device, automatically creating a one-time firewall rule to set up a transmission control protocol (TCP) connection between the first device and the selected particular device, the one-time firewall rule being defined to allow packets received at the network security device addressed to the selected particular device at a particular port determined based on the respective rule for the available host representing the selected particular device;
• (i) receiving, at the network security device, an initial SYN packet sent by the first device addressed to the particular device at the particular port to set up the TCP connection between the first device and the particular device;
• (j) based on the one-time port firewall rule, allowing the received SYN packet to pass through on its way to the particular device;
• (k) adding, by the network security device to a state table, connection information for the received SYN packet, the connection information including an indication that the connection has not yet been established;
• (l) receiving, at the network security device, a response SYN-ACK packet sent by the particular device representing a second step of a three-step handshake to set up the TCP connection between the first device and the particular device;
• (m) allowing the received SYN-ACK packet to pass through on its way to the first device;
• (n) receiving, at the network security device, a response ACK packet sent by the first device representing a third step of a three-step handshake completing set up of the TCP connection between the first device and the particular device;
• (o) allowing the received ACK packet to pass through on its way to the particular device;
• (p) updating, by the network security device, connection information in its state table for the TCP connection by replacing the indication that the connection has not yet been established with an indication that the TCP connection is established;
• (q) based on determining that the TCP connection has been established, automatically deleting the one-time port forwarding rule;
• and
• (r) thereafter, upon receiving a subsequent packet at the network security device addressed to the particular device at the particular port from the first device, determining that the subsequent packet belongs to the TCP connection for which connection information exists in the state table, and based thereon allowing the received subsequent packet to pass through on its way to the particular device;
• (s) whereby, automatic creation of a dynamic one-time firewall rule for an authorized user's current IP address following two factor authentication of the authorized user is provided which enables authenticated remote access to a remote electronic device in a manner which obviates the ability of attackers to gain access via an exposed port.