# US 2022/0045992 A1 · Concealing internal applications that are accessed over a network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2022/0045992 A1 - Document ID: US20220045992A1 - Status: Published application - Kind: A1 - Application number: 17/509,315 - Filed: 2021-10-25 - Published: 2022-02-10 - Earliest claimed: 2019-12-16 - Assignees: VMware, Inc. - Applicants: Vmware, Inc. - Inventors: Sisimon Soman; Arun P C - Web page: https://patentgrep.com/patent/US20220045992A1 ## CPC - H04L 63/0281: {Proxies} - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes} - H04L 63/0407: {wherein the identity of one or more communicating identities is hidden (cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00)} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 63/108: {when the policy decisions are valid for a limited amount of time} - H04L 63/166: {at the transport layer} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Examples herein describe systems and methods for concealing internal applications that are accessed over the internet. A user device can select a remote internal application to access using a client. The user device can send an access request to an open listening port of an access server. The access server can be a gateway and proxy to the internal application, which can reside elsewhere. The access server can open a different randomized access port for establishing the connection by proxy to the internal application. The port number for the access port can be identified in the access request at the listening port. The access server can open the access port for a short time interval. The connection can be made through the access port during that time interval. A firewall can then close the access port but maintain an established connection between the user device and the internal application. ## Claims ### Claim at position 1 -20. (canceled) ### Claim 21 A method for accessing hidden internal applications over a network, comprising: receiving an access request at an access server, the access request being received at a listening port from a user device, wherein the access request includes a random number; opening for a time interval an access port in a firewall for accessing an internal application, wherein the access port is selected based on the random number and is different than the listening port; establishing a connection between the user device and the internal application based on communication through the open access port during the time interval; and closing the access port while allowing the established connection to persist. ### Claim 22 (depends on 21) The method of claim 21, further comprising validating the access request prior to opening the access port, wherein the access port is unknown to the user device prior to generation of the random number. ### Claim 23 (depends on 21) The method of claim 21, wherein the access port closes after a time interval. ### Claim 24 (depends on 21) The method of claim 21, wherein the access request includes a single packet authorization (“SPA”), the SPA being used to determine whether the user device is authorized to access the internal application. ### Claim 25 (depends on 21) The method of claim 21, wherein the access request includes a destination internet protocol (“IP”) address based on which application is selected for access at the user device, wherein an agent on the user device sends the access request after determining that the user device is in compliance with an enterprise mobility management (“EMM”) policy. ### Claim 26 (depends on 25) The method of claim 25, wherein the access request is sent to a port determined by a filter driver on the user device, wherein the filter driver looks up the IP address in a table of allowed IP addresses prior to the user device sending the access request. ### Claim 27 (depends on 21) The method of claim 21, wherein the access request is received from an agent that executes on the user device, wherein the agent generates the random number and checks a selected application against a whitelist of allowed applications before sending the access request. ### Claim 28 A non-transitory, computer-readable medium comprising instructions that, when executed by a processor, cause the processor to perform stages for accessing hidden internal applications over a network, the stages comprising: receiving an access request at an access server, the access request being received at a listening port from a user device, wherein the access request includes a random number; opening for a time interval an access port in a firewall for accessing an internal application, wherein the access port is selected based on the random number and is different than the listening port; establishing a connection between the user device and the internal application based on communication through the open access port during the time interval; and closing the access port while allowing the established connection to persist. ### Claim 29 (depends on 28) The non-transitory, computer-readable medium of claim 28, the stages further comprising validating the access request prior to opening the access port, wherein the access port is unknown to the user device prior to generation of the random number. ### Claim 30 (depends on 28) The non-transitory, computer-readable medium of claim 28, wherein the access port closes after a time interval. ### Claim 31 (depends on 28) The non-transitory, computer-readable medium of claim 28, wherein the access request includes a single packet authorization (“SPA”), the SPA being used to determine whether the user device is authorized to access the internal application. ### Claim 32 (depends on 28) The non-transitory, computer-readable medium of claim 28, wherein the access request includes a destination internet protocol (“IP”) address based on which application is selected for access at the user device, wherein an agent on the user device sends the access request after determining that the user device is in compliance with an enterprise mobility management (“EMM”) policy. ### Claim 33 (depends on 32) The non-transitory, computer-readable medium of claim 32, wherein the access request is sent to a port determined by a filter driver on the user device, wherein the filter driver looks up the IP address in a table of allowed IP addresses prior to the user device sending the access request. ### Claim 34 (depends on 28) The non-transitory, computer-readable medium of claim 28, wherein the access request is received from an agent that executes on the user device, wherein the agent generates the random number and checks a selected application against a whitelist of allowed applications before sending the access request. ### Claim 35 A system for accessing hidden internal applications over a network, comprising: a non-transitory, computer-readable medium containing instructions; and a processor that executes the instructions perform stages comprising: receiving an access request at an access server, the access request being received at a listening port from a user device, wherein the access request includes a random number; opening for a time interval an access port in a firewall for accessing an internal application, wherein the access port is selected based on the random number and is different than the listening port; establishing a connection between the user device and the internal application based on communication through the open access port during the time interval; and closing the access port while allowing the established connection to persist. ### Claim 36 (depends on 35) The system of claim 35, the stages further comprising validating the access request prior to opening the access port, wherein the access port is unknown to the user device prior to generation of the random number. ### Claim 37 (depends on 35) The system of claim 35, wherein the access port closes after a time interval. ### Claim 38 (depends on 35) The system of claim 35, wherein the access request includes a single packet authorization (“SPA”), the SPA being used to determine whether the user device is authorized to access the internal application. ### Claim 39 (depends on 35) The system of claim 35, wherein the access request includes a destination internet protocol (“IP”) address based on which application is selected for access at the user device, wherein an agent on the user device sends the access request after determining that the user device is in compliance with an enterprise mobility management (“EMM”) policy. ### Claim 40 (depends on 39) The system of claim 39, wherein the access request is sent to a port determined by a filter driver on the user device, wherein the filter driver looks up the IP address in a table of allowed IP addresses prior to the user device sending the access request.