Back to results
US 8,301,789 B2Granted
Techniques for port hopping
AssigneeEMC Corporation
InventorsCameron Craig Morris, Lloyd Leon Burch, David Thomas Robinson
Life of this patent
Estimating the term…
Abstract
Techniques for port hopping are presented. A sender and a receiver engage in a communication session with one another and dynamically switch ports during that communication session. A decision to switch ports is based on a data length or packet count of a given transaction occurring during the communication session. The data length and packet count randomly and dynamically change during the communication session and varies from one transaction to another transaction. Any particular port to switch to during the communication session is also randomly and dynamically generated and varies from one transaction to another transaction.
Claims14
A method, comprising:
- assisting a sender and a receiver in establishing between the sender and the receiver a mutually secret key that is used to seed random number generators used by the sender and the receiver so that both the sender and the receiver have the same first random numbers and same second random numbers, the mutually secret key established via a Diffie-Hellman key exchange process between the sender and the receiver;
- periodically receiving first requests for the first random numbers from the sender and the receiver and supplying the first random numbers to the sender and the receiver;
- periodically receiving second requests for the second random numbers from the sender and the receiver and supplying the second random numbers to the sender and the receiver;
- using, by the sender and the receiver, the first random numbers to determine conditions that are not time based for communications to occur over one or more communication ports, the second random numbers identify specific ones of the communication ports based on specific conditions defined by specific first random numbers and the first random numbers identify the conditions that represent values for the data length of communications as byte lengths for data packets used during the session and when the data length for a particular communication is exceeded the sender and the receiver switch to different one of the communications ports identified by a specific second random number to continue a session with one another, the different one of the communications ports uses different byte lengths from a previous communication over a previous communication port during the session, and all communications between the sender and the receiver during the session occur over a local area connection (LAN) and are unencrypted;
- and
- injecting synthetic traffic on non-active ports of the sender and receiver that the sender and receiver ignore during the session, the session occurring over the LAN, said synthetic traffic being generated by mimicking protocols commonly used over the other communication ports.
3 more elements
A method, comprising:
- regularly supplying varying packet counts to a client and a server for use during a communication session between the client and the server, each packet count identifies a total number of packets to be sent between the client and the server before communication ports are switched during the session, each packet count communicated to the client and the server via a specific first random number and the communication session occurring over a local area network (LAN) and all communication is unencrypted during the session between the client and the server;
- regularly supplying identifiers for different ones of the communication ports as specific second random numbers to the client connection and the server during the communication session, the client and the server use each identifier to select a particular communication port for communications for any given packet count during the session, each identifier communicated as one of the specific second random number and each identifier mapped to a specific packet count, specific first random number and the specific second random number obtained by the client and server supplying a same seed value to a random number generator and the same seed value is a mutual secret key jointly established between the client and the server before the specific first and second random numbers are obtained by the client and the server;
- randomly switching the packet counts and the identifiers supplied during the session between the client and the server;
- and
- injecting synthetic data on non-active ports of the client and the server during the session that the client and the server ignore, said synthetic traffic being generated by mimicking protocols commonly used over the other communication ports.
2 more elements
A system, comprising:
- a machine configured having a random data or packet length generator implemented in a non-transitory computer-readable medium and to process on the machine;
- and
- the machine or a different machine having a random port assignment generator implemented within a non-transitory computer-readable medium and to process on the machine or the different machine, the random data or packet length generator is to dynamically and regularly supply random data lengths as byte lengths to senders and receivers engaged in communication sessions with one another as first random numbers, the senders and receivers engage in the sessions by using particular communication ports that are identified by the random port assignment generator as specific second random numbers for given transactions of the sessions, each session having a plurality of transactions and each transaction occurring over a different one of the communication ports and communication over each transaction is unencrypted traffic on a local area network (LAN), the communication ports identified as the specific second random numbers by the random port assignment generator, and each transaction occurring for a particular byte length before the senders and receivers switch to a different communication port for a different transaction using a different byte length, each byte length corresponds to a particular first random number and each first random number corresponds to a specific second random number that is used to identify a specific communication port, the senders and the receivers establish a mutual secret between one another and use the mutual secret as a seed value to the random data or packet length generator and the random port assignment generator so that the senders and the receivers obtain the same values for the first random numbers and the second random numbers, and during any specific session synthetic data is generated on non active ports for that specific session that a specific sender and a specific receiver ignore, said synthetic traffic being generated by mimicking protocols commonly used over the other communication ports.
A system, comprising:
- a machine having a condition-to-port-hop service implemented in a non-transitory computer-readable medium and to process on the machine;
- and
- the machine or a different machine having a port assigner service implemented in a non-transitory computer-readable medium and to process on the machine or the different machine, the condition-to-port-hop supplies time-independent conditions as first random numbers to a client and to a proxy for the client and proxy to use during a communication session over a local area network (LAN) where communications over the LAN are unencrypted and the first random numbers are used by the client and the proxy to decide when to switch communication ports during the session, the random numbers used to identify byte lengths for each transaction of the communication session and when a particular byte length is reached a different transaction for the communication session initiated over a different port, and the port assigner service supplies particular communication ports as second random numbers that the client and the proxy are to use during any particular point during the communication session, each first random number maps to a specific second random number, the client and proxy establish a mutual secret with one another that is used as a seed value to obtain the first random numbers and the second random numbers, and synthetic traffic is generated on non-active ports during the communication session that the client and the proxy ignore, said synthetic traffic being generated by mimicking protocols commonly used over the other communication ports.
Dependencies are inferred from the claim text.