US 8,413,248 B2Granted

Method for secure single-packet remote authorization

OwnerMichael B. Rashinventor

Life of this patent

Estimating the term…

Loading patent…

Abstract

A method for secure single-packet remote authorization using a single packet authorization (SPA) server on a host system that passively monitors the network for connection attempts and anonymously accept or rejects said attempts depending on whether a valid SPA packet is detected, an SPA client on a client system that is responsible for generating the appropriately encrypted SPA packet in order to gain access to services on the host, and a particular packet format sent from the client to the host to gain access. The packet format is encrypted and non-replayable by virtue of 16 bytes of random data in every message, and an MD5 sum that is a hash function of the random data (made via any known hashing function). The SPA server stores the MD5 sum of every valid SPA packet that it monitors and flags any duplicate access attempts using the same MD5 hash as a previously monitored packet, in which case the SPA server treats the packet as being generated by a malicious attempt to replay the original packet.

Claims17

Dependent claims

A method for secure remote authorization using a single packet authorization (SPA) server on a host system, a SPA client on a client system, and a formatted SPA packet sent from the SPA client in order to gain access to services on the host system, comprising the steps of:

constructing by said SPA client a formatted SPA packet having a payload of access code comprising a plurality of bytes of random data;
sending said formatted SPA packet to said SPA server, said SPA server configured to allow access to certain services on said host system upon receipt of a formatted packet containing a payload of predetermined access code, and to maintain a log file of hash values of all formatted SPA packets received from SPA clients allowed access to said host system services;
said SPA server receiving said sent formatted SPA packet and performing the substeps of:
comparing a hash value of said sent SPA packet with the hash values in said log file;
determining whether the payload of said sent formatted SPA packet contains said predetermined access code;
and
allowing access to said services on said host system only when said sent formatted SPA packet payload contains said predetermined access code and said hash value of said sent formatted SPA packet does not match any previously stored hash values;
and after allowing said access, said SPA server storing the hash function value of said sent formatted SPA packet in said log file.

5 more elements

Dependencies are inferred from the claim text.

Facts

Application: 11/726,518Filed 22 Mar 2007 · us provisional application
Priority: 22 Mar 2006
Published: US 2007/0234428 A14 Oct 2007
Granted: 2 Apr 2013
Term ends: Not estimatedThe source records don’t support an estimate.

Classification10 codes

H04L 63/02
Network architectures or network communication protocols for network security: for separating internal from external traffic, e.g. firewalls
G06F 21/552
Detecting local intrusion or implementing counter-measures: involving long-term monitoring or reporting
H04L 63/10
Network architectures or network communication protocols for network security: for controlling access to devices or network resources
H04L 63/12
Network architectures or network communication protocols for network security: applying verification of the received information