US20110066739A1 - System and method for automatically initiating and dynamically establishing secure internet connections between a fire-walled server and a fire-walled client - Google Patents

System and method for automatically initiating and dynamically establishing secure internet connections between a fire-walled server and a fire-walled client Download PDF

Info

Publication number
US20110066739A1
US20110066739A1 US12/840,356 US84035610A US2011066739A1 US 20110066739 A1 US20110066739 A1 US 20110066739A1 US 84035610 A US84035610 A US 84035610A US 2011066739 A1 US2011066739 A1 US 2011066739A1
Authority
US
United States
Prior art keywords
client
server
connection
party computer
network
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Abandoned
Application number
US12/840,356
Inventor
Brian Gillespie
Helmut Salmen
David Tracey
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
SIMtone Corp (f/k/a XDS Inc)
Original Assignee
SIMtone Corp (f/k/a XDS Inc)
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by SIMtone Corp (f/k/a XDS Inc) filed Critical SIMtone Corp (f/k/a XDS Inc)
Priority to US12/840,356 priority Critical patent/US20110066739A1/en
Publication of US20110066739A1 publication Critical patent/US20110066739A1/en
Priority to US13/467,437 priority patent/US8631139B2/en
Abandoned legal-status Critical Current

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00Data switching networks
    • H04L12/02Details
    • H04L12/22Arrangements for preventing the taking of data from a data transmission channel without authorisation
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00Network arrangements, protocols or services for addressing or naming
    • H04L61/09Mapping addresses
    • H04L61/25Mapping addresses of the same type
    • H04L61/2503Translation of Internet protocol [IP] addresses
    • H04L61/256NAT traversal
    • H04L61/2567NAT traversal for reachability, e.g. inquiring the address of a correspondent behind a NAT server
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/02Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227Filtering policies
    • H04L63/0236Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/02Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/029Firewall traversal, e.g. tunnelling or, creating pinholes
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/10Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00Network arrangements or protocols for supporting network services or applications
    • H04L67/14Session management
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/16Implementing security features at a particular protocol layer
    • H04L63/166Implementing security features at a particular protocol layer at the transport layer

Definitions

  • the present invention relates to the field of computer networking and network security. More specifically it relates to a method automatically and dynamically initiating and establishing secure connections between a computer (i.e., Server) and a plurality of computers (i.e., clients), each of which is behind a Network Address Translator router and/or firewall.
  • a computer i.e., Server
  • a plurality of computers i.e., clients
  • IPv4 Internet Protocol Version 4
  • IPv6 IP (Internet Protocol) addresses
  • IPv6 IP (Internet Protocol) addresses
  • IPv6 uses a 128 bit address space and so provides a larger number of IP addresses, but until this has achieved widespread adoption, other techniques have been used to overcome the address limitations of IPv4 and provide security protection to Internet connected computers.
  • NAT Network Address Translation
  • AOL Internet Service Providers
  • ISP Internet Service Providers
  • NAT routers were designed primarily around the client/server paradigm, where client machines inside a private network initiate connections to public servers with stable IP addresses and domain name service or server (DNS) names.
  • DNS domain name service
  • NAT asymmetric nature of the addressing and connectivity established by NAT does create a number of problems that a) limit the security of widely available internet services to outbound-only applications, such as the World Wide Web, and b) limit the usability and mass market availability of many additional internet applications and services potentially attractive to large consumer markets, to a smaller number of professionally trained users capable of managing the complex configuration and system management requirements imposed by the currently available NAT and NAT-transverse technology.
  • the method and system automatically and dynamically initiates and establishes connections, preferably secured connections, between a server and a fire-walled client device (Client), both connected to an untrusted network (such as the Internet) through a Network Address Translator or Translation (NAT) router or a firewall.
  • the secure connections of present invention are initiated and established without requiring any user configuration on the Client and without accepting any explicit connection request and/or packets from the Client by the Server, thereby advantageously allowing the Server firewall to always remain closed to all inbound traffic.
  • the present invention enables the creation of dynamically instantiated virtual point to point network connections over the Internet to securely connect Servers and Clients on demand, thereby advantageously providing the common user with one single action access (such as one mouse-click, or power-on or network plug-in action) to the Servers with unprecedented ease to use.
  • the system and method as aforementioned utilizes a third Computer, e.g., a trusted party such as a session control server (“SCS”), with a public IP address, independently trusted by both Server and Client, to securely broker the connection parameters required to establish a connection between Server and the Client, preferably a secure connection.
  • a trusted party such as a session control server (“SCS”)
  • SCS session control server
  • the SCS only participates in the Server/Client connection setup and plays no part in the subsequent communications (i.e., exchange of messages) between the Server and the Client. Accordingly, the present invention avoids the performance and security problems associated with the relay and other server based techniques discussed herein.
  • the Client sends a connection request containing its own address and a randomly generated unique identifier (different for each Client connection request to each Server) to the SCS, thus providing the SCS with the Client's connection parameters otherwise hidden by the NAT router and/or by the firewall.
  • the Client can be programmed to always perform this step automatically at power-on, upon connection to any new NAT-ted network, upon any change of its network parameters, thus providing for automatic and dynamic initiation/establishment and re-establishment of the secure connection with the Server without any user configuration or intervention.
  • the SCS then provides each of the Client and the Server with the respective connection parameters, which are then exchanged securely between them so that first the Client's connection parameters are delivered and uniquely identified to the Server and finally, upon successful completion of the preceding step, the Server initiates the secure connection to the Client through the Client's NAT router or firewall, thus enabling an externally initiated connection to be made by securely overcoming the inbound traffic restrictions imposed by the Client NAT router or firewall and allowing the Server to maintain its own NAT router/firewall closed to all inbound traffic coming from the untrusted network.
  • a system for automatically initiating and dynamically establishing secure connections over an untrusted network comprises a client device connected to the untrusted network via a firewall or network address translator (NAT) router, a Server connected to the untrusted network via a firewall and which does not accept explicit connection requests or packets from any client device, and a trusted computer connected to the untrusted network for exchanging connection parameters between the server and the client device without configuring the client device.
  • the client device receives a unique connection identifier from the Server via the trusted computer.
  • the Server's firewall receives an unsolicited packet comprising the unique connection identifier from the client device to dynamically establish a transient mapping between the client device and the Server.
  • the Server transmits a response packet to the client device using the dynamically established transient mapping over the untrusted network, thereby establishing a secure connection between the Server and the client device through the NAT router.
  • FIG. 1 is an exemplary block diagram showing various computers connected to an untrusted network behind a NAT or a firewall;
  • FIGS. 2-8 are exemplary block diagrams showing the steps of automatically initiating and dynamically establishing connections between a Server and a Client, each behind a firewall or NAT router, in accordance with an embodiment of the present invention.
  • the system and method automatically and dynamically initiates and establishes connections, preferably secure connections, between a server and a fire-walled client device.
  • a server 1100 and a client device both connected to an untrusted network 1000 (such as the Internet) through a Network Address Translator or Translation (NAT) router or a firewall 1300 .
  • NAT Network Address Translator or Translation
  • the connections between the Server and the Client are initiated and established without requiring any user configuration on the Client 1200 and without accepting any explicit connection request and/or packets from the Client 1200 by the Server 1100 , thereby allowing the Server firewall 1300 to always remain closed to all inbound traffic.
  • the present invention utilizes a third computer 1400 , e.g., a trusted party such as a session control server (“SCS”), with a public IP address independently trusted and securely connected to both the Server 1100 and the Client 1200 .
  • the Client 1200 sends a connection request comprising its own address and a randomly generated unique identifier (different for each Client connection request to a Server) to the SCS 1400 , thereby providing the SCS 1400 with the Client's connection parameters otherwise hidden by the NAT router 1300 and/or by the firewall 1300 .
  • the Client 1200 can be programmed to always perform this step automatically at power-on, upon connection to any new NAT-ted network, upon any change of its network parameters, thus providing for automatic and dynamic initiation/establishment and re-establishment of the secure connection with the Server 1100 without any user configuration or intervention.
  • the SCS 1400 provides each of the Client 1200 and the Server 1100 with the respective connection parameters, which are then exchanged securely between them so that first the Client's connection parameters are delivered and uniquely identified to the Server 1100 and finally, upon successful completion of the preceding step, the Server 1100 initiates the secure connection to the Client 1200 through the Client's NAT router or firewall 1300 , thus enabling an externally initiated connection to be made by securely overcoming the inbound traffic restrictions imposed by the Client NAT router or firewall 1300 and allowing the Server 1100 to maintain its own NAT router/firewall 1300 closed to all inbound traffic coming from the untrusted network.
  • the SCS only participates in the Server/Client connection setup and plays no part in the subsequent communications (i.e., exchange of messages) between the Server and the Client. Accordingly, the present invention avoids the performance and security problems associated with the relay and other server based techniques.
  • the Relaying technique is a variation of client-server communication and relies on the two Clients using a Server with a public IP address that they can both connect to.
  • the two Clients behind NAT routers cannot make a direct connection to each other, but each make a connection to the Server with the public IP address.
  • the Server then acts as a relay and it forwards messages from one Client to another.
  • This method has the disadvantage that by relying on the Server to relay all communications between the Clients, it needs to use the Server's available processing power and available network bandwidth to connect the Clients, hence its performance and scalability depend on these parameters.
  • a copy of the inter-Client data communications is constantly made on the Server, thereby creating an additional security threat.
  • the UDP hole punching technique is based on the general behavior of firewalls that allow applications to “punch holes” through the NAT router and establish direct connectivity with one another.
  • the following describes the system, method and computer instructions for automatically initiating and establishing a secure connection between the Server 1100 and a Client 1200 behind a NAT router or firewall 1300 over an untrusted network 1000 . It is appreciated that all of the interactions described herein occur over an untrusted network 1100 , such as the Internet. It is also appreciated that all interactions described herein can occur over non-secure connections.
  • the automatic and dynamic client side connectivity to the Server 1100 in accordance with an exemplary embodiment of the present invention is now described in conjunction with FIGS. 2-8 .
  • the Server 1100 initiates and establishes (or maintains permanently) a secure connection to the SCS 1400 in step 2000 .
  • this connection can be made over the network work layer (OSI layer 3) such as with IPSEC.
  • the secure connection can use an application layer (OSI layer 7) mechanism such as with secure sockets layer (SSL). All subsequent communications between the Server 1100 and the SCS 1400 can be conducted over this secure communications channel.
  • the Client 1200 initiates a secure connection with the SCS 1400 in step 2010 .
  • the secure connection can use an application layer (OSI layer 7) mechanism such as with secure sockets layer (SSL). All subsequent communications between the Client 1200 and the SCS 1400 can be conducted over this secure communications channel.
  • OSI layer 7 application layer
  • SSL secure sockets layer
  • the Client 1200 sends a request to the SCS 1400 to be connected to the desired Server 1100 in step 2020 , as shown in FIG. 4 .
  • This can be a result of a Client initiated event such as a user request or the Client 1200 can be programmed to always perform this step automatically at power-on, upon connection to any new NAT-ted network, upon any change of its network parameters, thereby providing for automatic and dynamic initiation/establishment and re-establishment of the secure connection with the Server 1100 without any user configuration or intervention.
  • the SCS 1400 sends a unique tag to the Server consisting of a specific destination inbound port, the client NAT's public address in step 2030 and receives from the Server 1400 a randomly generated connection identifier (ID).
  • ID connection identifier
  • the destination inbound port provided by the Server 1100 remains closed throughout the initiation, establishment and use of the secure connection with the Client 1200 .
  • the Server 1100 configures its own end of the connection that will be likely made to Client 1200 by the Server 1100 .
  • the nature of this configuration is dependent of the nature of the secure connection that will be made but will generally involve some key generation and exchange.
  • the secure connection can be made over the network work layer (OSI layer 3) such as with IPSEC.
  • the secure connection can use an application layer (OSI layer 7) mechanism such as with secure sockets layer (SSL).
  • the SCS 1400 instructs the Client 1200 to send a unsolicited UDP or TCP packet containing the ID to a Server-provided IP address and destination port in step 2040 , as shown in FIG. 6 .
  • the SCS 1400 configures the Client end of the secure connection that will be likely made to the Client 1200 by the Server 1100 . Also for the Client side, the nature of this configuration is dependent of the nature of the secure connection that will be made but will generally involve some key generation and exchange.
  • the secure connection can use an application layer (OSI layer 7) mechanism such as with secure sockets layer (SSL).
  • the Client 1200 sends a UDP or TCP packet to the Server IP address and destination port provided by SCS 1400 in step 2050 . It is appreciated that the Server 1100 and the Server's firewall 1300 still remain closed to the Client 1200 . This establishes a transient mapping in the client NAT router 1300 between the Client 1200 and the Server 1100 in step 2050 .
  • This mapping consists of a translation between the Client's real IP address and source port (private side) and the NAT masqueraded client IP address and source port (public side). This mapping will remain in effect for a small period of time after it is made, thus allowing the Server 1100 to connect through to the Client 1200 at that mapping within a specific time-frame of the mapping having been created.
  • the Server's firewall 1300 sees the UDP or TCP packet, compares the ID and NAT public address in it to those it received from the SCS 1400 in step 2050 . If there is a match then the Server's firewall 1300 notifies the Server 1100 about the event. The Server's firewall 1300 then always drops the unsolicited packet in step 2050 , i.e., the packet never enters up into the Server's IP stack, as depicted in FIG. 7 . The Server's firewall 1300 continues to check incoming packets on specified destination ports to see if they are query packets.
  • the Server's firewall 1300 checks all three elements of the tag to guard against security attacks such as connection requests by a host masquerading as a genuine Client 1200 .
  • the Server's firewall 1300 will only consider packets coming from the NAT public address, to the specified destination port and containing the randomly generated ID.
  • the UDP/TCP packet could be encrypted as part of this technique.
  • the Server 1100 initiates a UDP or TCP connection to the Client 1200 using the source port forwarded by the Server's firewall 1300 in step 2060 . It is appreciated that the NAT mapping created in step 2050 holds for a reasonable period of time (at least several seconds but possibly longer after the UDP or TCP packet has been received). In accordance with an aspect of the present invention, the Server 1100 can connect to the client through the NAT in this manner in step 2060 , see FIG. 8 .
  • the Client 1200 is automatically connected and dynamically reconnected to the Server 1100 upon a change in its network address parameters, such as when the Client 1200 is moved to a different connection location, without requiring any user intervention other than one single user action such as a power-on, one mouse click or one keystroke.
  • the Client 1200 is not required be aware of any user information, or to process or perform any user function to be connected to the Server 1100 by means of an embodiment of this invention.
  • a Stateless Client 1200 is generally defined as a computer that does not perform any user functionality or contain any user data. More precisely a Stateless Client 1200 can be built as a network appliance consisting of a CPU, memory, Framebuffer and network port, mouse and keyboard input and optional IO ports. It's operated by built-in software that only performs network and display management fixed functions and does not allow for any download or execution of other software. It does not run any application. Its only purpose is to be a remote human interface device. The built-in software implements a network stack to allow communications with a server over a network like the Internet.
  • present invention only uses the Stateless Client's network stack implementing the Secure Socket Layer (SSL) over TCP, as described in detail herein, and henceforth enables the automatic and dynamic establishment of secure connections between the Servers 1100 and Stateless Clients 1200 which cannot perform any user functions under any circumstance.
  • SSL Secure Socket Layer
  • the Stateless Client 1200 automatically connects via TCP/SSL to the SCS 1400 and sends the name of the requested Server 1100 over the newly established connection.
  • the SCS 1400 detects the Stateless Client IP address from the socket connection.
  • the SCS 1400 reads the requested Server name and determines if it has a connection to the desired Server 1100 . If the SCS 1400 has no such connection the desired Server 1100 , then the SCS 1400 either waits until it gets such connection or instructs the Stateless Client 1200 to retry later. If the Server 1100 is connected to the SCS 1400 , then the SCS 1400 sends the Stateless Client IP address to the Server 1100 .
  • the Server 1100 reads the Stateless Client address, generates a unique 32 bit random number identifier (the ID) and sends the ID along with its IP address and port to the SCS 1400 .
  • the Server 1100 then instructs its firewall 1300 to sniff for “TCP SYN” (TCP connection request) packets from the Stateless Client's public IP address that have a initial sequence number set to the value of the ID.
  • the SCS 1400 forwards the server IP address, port and ID to the Stateless Client 1200 .
  • the Stateless Client 1200 generates unsolicited TCP connection requests to the Server IP address and port with an initial sequence number set to the value of the ID.
  • This outgoing packet will prime any NAT on the way to the Server 1100 and also deposit servers IP address and port as well as the ID in a SEQ translator layer at the bottom of the Stateless Client's network stack.
  • the Server's firewall 1300 looks for a match and performs the following three tasks: a) store the Stateless Client address/port, server address/port and the sequence number; b) notify the Server 1100 and provide the Stateless Clients public port; and c) drop the packet.
  • the Server 1100 now opens a TCP connection to the Stateless Clients IP/port that will transverse the Server firewall 1300 .
  • the Server's firewall 1300 sees the outgoing TCP connection request (SYN flag is set) and finds a match and sets the TCP ACK flag and the acknowledge number.
  • SYN flag is set
  • the packet looks like a response to the unsolicited TCP connection request received from the Stateless Client 1200 and it travels back through the NAT gateways back to the Stateless Client 1200 .
  • the SEQ translator layer Upon arrival of such packet at the Stateless Client 1200 , the SEQ translator layer matches the packet and deletes the TCP ACK flag such that the Stateless Client TCP stack sees a real connection request from the Server 1100 .
  • the Stateless Clients TCP stack accepts the connection and responds with a TCP packet that has both the SYN and the ACK flag set.
  • This TCP packet is matched by the SEQ translator layer which deletes the SYN flag and stores the difference between Stateless Client sequence number and the previously stored ID. It is appreciated that on the network this TCP packet looks like a third part of the TCP 3-way handshake.
  • the TCP packet from the Stateless Client 1200 arrives at the Server's firewall 1300 , the TCP packet is matched and the SYN flag is set.
  • This TCP packet passes through the Server's firewall 1300 since it is a response to a connection request.
  • the real third TCP handshake packet that comes from the Server 1100 passes through without change since it is treated as a normal acknowledgement packet.
  • every arriving packet gets its acknowledge number adjusted by the previously stored sequence difference and every outgoing packet gets its sequence number adjusted by the difference. It is appreciated that no special flag mangling is necessary on the termination of the connection between the Server 110 and the Stateless Client 1200 .

Abstract

A system and method for automatically and dynamically initiating and establishing secure connections between a Server and a Client using a session control server (SCS). Both the Server and the Client are connected to an untrusted network (such as the Internet) through a Network Address Translator or Translation (NAT) router or a firewall. The SCS, independently trusted by both the Server and the Client, brokers the required connection parameters to establish a secure connection between the Server and the Client. The system and method does not require any user configuration on the Client and eliminates the need for the Server to accept explicit connection requests or packets from the Client, thereby allowing the Server firewall to always remain closed to all inbound traffic.

Description

    RELATED APPLICATION
  • This application is a continuation of U.S. application Ser. No. 11/104,982, entitled “SYSTEM AND METHOD FOR AUTOMATICALLY INITIATING AND DYNAMICALLY ESTABLISHING SECURE INTERNET CONNECTIONS BETWEEN A FIRE-WALLED SERVER AND A FIRE-WALLED CLIENT,” filed on Apr. 12, 2005, which claims priority under 35 U.S.C. §119(e) to U.S. Provisional patent application No. 60/561,806, entitled “INITIATING SECURE CONNECTIONS TO A HOST BEHIND A NAT OVER AN UNTRUSTED NETWORK USING A TRUSTED PARTY,” filed on Apr. 12, 2004, each of which is incorporated herein by reference in its entirety.
  • FIELD OF THE INVENTION
  • The present invention relates to the field of computer networking and network security. More specifically it relates to a method automatically and dynamically initiating and establishing secure connections between a computer (i.e., Server) and a plurality of computers (i.e., clients), each of which is behind a Network Address Translator router and/or firewall.
  • BACKGROUND OF THE INVENTION
  • The Internet continues undergoing rapid expansion in the numbers of connected computers and it is estimated that the trend towards widely available wireless connectivity and portable computing devices will increase exponentially the number of new computers that connect each day. This rapid expansion has increased radically the need for protecting computers from unauthorized access and has already started causing a number of scalability problems for the Internet network itself. For example the Internet Protocol Version 4 (IPv4) uses 32-bit IP (Internet Protocol) addresses, which means that the theoretical maximum number of computers on the Internet is about 4 billion. The practical limit however, is much lower, due to inefficiencies in how IP addresses are allocated and routed. As such, IPv4 does not provide sufficient unique addresses for the current expansion of the Internet. A newer version of the Internet Protocol (IPv6) uses a 128 bit address space and so provides a larger number of IP addresses, but until this has achieved widespread adoption, other techniques have been used to overcome the address limitations of IPv4 and provide security protection to Internet connected computers.
  • One such solution in wide use today is Network Address Translation (NAT), where private addresses used on internal networks, such as AOL or other Internet Service Providers (ISP), are only converted to public IP addresses when the subscriber's computer needs to reach out and connect to a public Internet server, such as a Web Server for example. Given that the number of computers that communicate over the Internet at any one time is much lower than the total number of computers that are connected but inactive, only those currently communicating are assigned a public IP address by NAT, thereby reducing the required number of IP addresses. This also provides additional security by virtue of the anonymity afforded to the computers behind NAT-routers or firewalls, which cannot be reached through connections initiated from the Internet.
  • NAT routers were designed primarily around the client/server paradigm, where client machines inside a private network initiate connections to public servers with stable IP addresses and domain name service or server (DNS) names.
  • The anonymity and inaccessibility of the internal hosts behind a NAT router is not a problem for client software such as web browsers, which only need to initiate outgoing connections to publicly available Servers. However, this is a problem for applications that require Servers to securely connect to Clients, through incoming connections going through their NAT routers, such as file sharing, games applications, video conferencing, voice-over-IP internet telephony or for secure access to computer servers that do not allow clients to directly connect to them from the internet.
  • When one of these computers is behind a NAT router, then the other computer cannot connect to it, without the use of special techniques and often complex manual configuration required for every change in connection type, location, service or NAT router/firewall type.
  • Therefore the asymmetric nature of the addressing and connectivity established by NAT does create a number of problems that a) limit the security of widely available internet services to outbound-only applications, such as the World Wide Web, and b) limit the usability and mass market availability of many additional internet applications and services potentially attractive to large consumer markets, to a smaller number of professionally trained users capable of managing the complex configuration and system management requirements imposed by the currently available NAT and NAT-transverse technology.
  • SUMMARY OF THE INVENTION
  • Therefore, it is an object of the present invention to provide a method and system for automatically initiating and dynamically establishing Internet connections between a server and a client which overcomes the above-noted shortcomings.
  • In accordance with an embodiment of the present invention, the method and system automatically and dynamically initiates and establishes connections, preferably secured connections, between a server and a fire-walled client device (Client), both connected to an untrusted network (such as the Internet) through a Network Address Translator or Translation (NAT) router or a firewall. The secure connections of present invention are initiated and established without requiring any user configuration on the Client and without accepting any explicit connection request and/or packets from the Client by the Server, thereby advantageously allowing the Server firewall to always remain closed to all inbound traffic.
  • The present invention enables the creation of dynamically instantiated virtual point to point network connections over the Internet to securely connect Servers and Clients on demand, thereby advantageously providing the common user with one single action access (such as one mouse-click, or power-on or network plug-in action) to the Servers with unprecedented ease to use.
  • In accordance with an embodiment of the present invention, the system and method as aforementioned utilizes a third Computer, e.g., a trusted party such as a session control server (“SCS”), with a public IP address, independently trusted by both Server and Client, to securely broker the connection parameters required to establish a connection between Server and the Client, preferably a secure connection. The SCS only participates in the Server/Client connection setup and plays no part in the subsequent communications (i.e., exchange of messages) between the Server and the Client. Accordingly, the present invention avoids the performance and security problems associated with the relay and other server based techniques discussed herein.
  • The Client sends a connection request containing its own address and a randomly generated unique identifier (different for each Client connection request to each Server) to the SCS, thus providing the SCS with the Client's connection parameters otherwise hidden by the NAT router and/or by the firewall. The Client can be programmed to always perform this step automatically at power-on, upon connection to any new NAT-ted network, upon any change of its network parameters, thus providing for automatic and dynamic initiation/establishment and re-establishment of the secure connection with the Server without any user configuration or intervention.
  • The SCS then provides each of the Client and the Server with the respective connection parameters, which are then exchanged securely between them so that first the Client's connection parameters are delivered and uniquely identified to the Server and finally, upon successful completion of the preceding step, the Server initiates the secure connection to the Client through the Client's NAT router or firewall, thus enabling an externally initiated connection to be made by securely overcoming the inbound traffic restrictions imposed by the Client NAT router or firewall and allowing the Server to maintain its own NAT router/firewall closed to all inbound traffic coming from the untrusted network.
  • In accordance with an embodiment of the present invention, a system for automatically initiating and dynamically establishing secure connections over an untrusted network comprises a client device connected to the untrusted network via a firewall or network address translator (NAT) router, a Server connected to the untrusted network via a firewall and which does not accept explicit connection requests or packets from any client device, and a trusted computer connected to the untrusted network for exchanging connection parameters between the server and the client device without configuring the client device. The client device receives a unique connection identifier from the Server via the trusted computer. The Server's firewall receives an unsolicited packet comprising the unique connection identifier from the client device to dynamically establish a transient mapping between the client device and the Server. If the unique connection identifier in the unsolicited packet received from the client device matches a stored unique connection identifier, the Server transmits a response packet to the client device using the dynamically established transient mapping over the untrusted network, thereby establishing a secure connection between the Server and the client device through the NAT router.
  • In order to appreciate the current invention, one must understand that even with all the advances in computer security, the Internet remains an inherently insecure environment because it is difficult to reconcile “ease of use” issues with trusted access elements. This invention strikes at the heart of this problem by supplying a methodical approach that eliminates the possibility that fraudulent users can masquerade as legitimate ones, while at the same time, it does not add, in fact it eliminates, many elements that common users would find burdensome.
  • The foregoing has outlined rather broadly the features and technical advantages of the present invention in order that the detailed description of the invention that follows may be better understood. Additional features and advantages of the invention will be described hereinafter which form the subject of the claims of the invention. It should be appreciated by those skilled in the art that the specific concepts and embodiments disclosed may be readily utilized as a basis for modifying or designing other structures for carrying out the same purposes of the present invention. It should also be realized by those skilled in the art that such equivalent constructions do not depart from the spirit and scope of the invention as set forth in the appended claims. The novel features which are believed to be characteristic of the invention, both as to its organization and method of operation, together with further objects and advantages will be better understood from the following description when considered in connection with the accompanying figures. It is to be expressly understood, however, that each of the figures is provided for the purpose of illustration and description only and is not intended as a definition of the limits of the present invention.
  • BRIEF DESCRIPTION OF THE DRAWINGS
  • The invention may be understood by reference to its description herein, given by way of example and not intended to limit the present invention solely thereto, will be best understood in conjunction with accompanying drawings in which:
  • FIG. 1 is an exemplary block diagram showing various computers connected to an untrusted network behind a NAT or a firewall; and
  • FIGS. 2-8 are exemplary block diagrams showing the steps of automatically initiating and dynamically establishing connections between a Server and a Client, each behind a firewall or NAT router, in accordance with an embodiment of the present invention.
  • DETAILED DESCRIPTION OF THE INVENTION
  • In accordance with an embodiment of the present invention, the system and method automatically and dynamically initiates and establishes connections, preferably secure connections, between a server and a fire-walled client device. Turning now to FIG. 1, there is illustrated a Server 1100 and a client device (Client 1200), both connected to an untrusted network 1000 (such as the Internet) through a Network Address Translator or Translation (NAT) router or a firewall 1300. The connections between the Server and the Client are initiated and established without requiring any user configuration on the Client 1200 and without accepting any explicit connection request and/or packets from the Client 1200 by the Server 1100, thereby allowing the Server firewall 1300 to always remain closed to all inbound traffic.
  • In accordance with an embodiment, the present invention utilizes a third computer 1400, e.g., a trusted party such as a session control server (“SCS”), with a public IP address independently trusted and securely connected to both the Server 1100 and the Client 1200. The Client 1200 sends a connection request comprising its own address and a randomly generated unique identifier (different for each Client connection request to a Server) to the SCS 1400, thereby providing the SCS 1400 with the Client's connection parameters otherwise hidden by the NAT router 1300 and/or by the firewall 1300. In accordance with an aspect of the present invention, the Client 1200 can be programmed to always perform this step automatically at power-on, upon connection to any new NAT-ted network, upon any change of its network parameters, thus providing for automatic and dynamic initiation/establishment and re-establishment of the secure connection with the Server 1100 without any user configuration or intervention.
  • The SCS 1400 provides each of the Client 1200 and the Server 1100 with the respective connection parameters, which are then exchanged securely between them so that first the Client's connection parameters are delivered and uniquely identified to the Server 1100 and finally, upon successful completion of the preceding step, the Server 1100 initiates the secure connection to the Client 1200 through the Client's NAT router or firewall 1300, thus enabling an externally initiated connection to be made by securely overcoming the inbound traffic restrictions imposed by the Client NAT router or firewall 1300 and allowing the Server 1100 to maintain its own NAT router/firewall 1300 closed to all inbound traffic coming from the untrusted network.
  • The SCS only participates in the Server/Client connection setup and plays no part in the subsequent communications (i.e., exchange of messages) between the Server and the Client. Accordingly, the present invention avoids the performance and security problems associated with the relay and other server based techniques.
  • The Relaying technique is a variation of client-server communication and relies on the two Clients using a Server with a public IP address that they can both connect to. The two Clients behind NAT routers cannot make a direct connection to each other, but each make a connection to the Server with the public IP address. The Server then acts as a relay and it forwards messages from one Client to another. This method has the disadvantage that by relying on the Server to relay all communications between the Clients, it needs to use the Server's available processing power and available network bandwidth to connect the Clients, hence its performance and scalability depend on these parameters. Moreover a copy of the inter-Client data communications is constantly made on the Server, thereby creating an additional security threat.
  • The UDP hole punching technique is based on the general behavior of firewalls that allow applications to “punch holes” through the NAT router and establish direct connectivity with one another.
  • In accordance with an exemplary embodiment of the present invention, the following describes the system, method and computer instructions for automatically initiating and establishing a secure connection between the Server 1100 and a Client 1200 behind a NAT router or firewall 1300 over an untrusted network 1000. It is appreciated that all of the interactions described herein occur over an untrusted network 1100, such as the Internet. It is also appreciated that all interactions described herein can occur over non-secure connections. The automatic and dynamic client side connectivity to the Server 1100 in accordance with an exemplary embodiment of the present invention is now described in conjunction with FIGS. 2-8.
  • As illustrated in FIG. 2, the Server 1100 initiates and establishes (or maintains permanently) a secure connection to the SCS 1400 in step 2000. In accordance with an aspect of the present invention, this connection can be made over the network work layer (OSI layer 3) such as with IPSEC. In accordance with another aspect of the present invention, the secure connection can use an application layer (OSI layer 7) mechanism such as with secure sockets layer (SSL). All subsequent communications between the Server 1100 and the SCS 1400 can be conducted over this secure communications channel.
  • As depicted in FIG. 3, the Client 1200 initiates a secure connection with the SCS 1400 in step 2010. In accordance with an aspect of the present invention, the secure connection can use an application layer (OSI layer 7) mechanism such as with secure sockets layer (SSL). All subsequent communications between the Client 1200 and the SCS 1400 can be conducted over this secure communications channel.
  • The Client 1200 sends a request to the SCS 1400 to be connected to the desired Server 1100 in step 2020, as shown in FIG. 4. This can be a result of a Client initiated event such as a user request or the Client 1200 can be programmed to always perform this step automatically at power-on, upon connection to any new NAT-ted network, upon any change of its network parameters, thereby providing for automatic and dynamic initiation/establishment and re-establishment of the secure connection with the Server 1100 without any user configuration or intervention.
  • The SCS 1400 sends a unique tag to the Server consisting of a specific destination inbound port, the client NAT's public address in step 2030 and receives from the Server 1400 a randomly generated connection identifier (ID). It is appreciated that in accordance with an embodiment of the present invention, the destination inbound port provided by the Server 1100 remains closed throughout the initiation, establishment and use of the secure connection with the Client 1200. Using this SCS provided information, as illustrated in FIG. 5, the Server 1100 configures its own end of the connection that will be likely made to Client 1200 by the Server 1100. The nature of this configuration is dependent of the nature of the secure connection that will be made but will generally involve some key generation and exchange. For example, in accordance with an aspect of the present invention, the secure connection can be made over the network work layer (OSI layer 3) such as with IPSEC. In accordance with another aspect of the present invention, the secure connection can use an application layer (OSI layer 7) mechanism such as with secure sockets layer (SSL).
  • The SCS 1400 instructs the Client 1200 to send a unsolicited UDP or TCP packet containing the ID to a Server-provided IP address and destination port in step 2040, as shown in FIG. 6. The SCS 1400 configures the Client end of the secure connection that will be likely made to the Client 1200 by the Server 1100. Also for the Client side, the nature of this configuration is dependent of the nature of the secure connection that will be made but will generally involve some key generation and exchange. For example, in accordance with an aspect of the present invention, the secure connection can use an application layer (OSI layer 7) mechanism such as with secure sockets layer (SSL).
  • The Client 1200 sends a UDP or TCP packet to the Server IP address and destination port provided by SCS 1400 in step 2050. It is appreciated that the Server 1100 and the Server's firewall 1300 still remain closed to the Client 1200. This establishes a transient mapping in the client NAT router 1300 between the Client 1200 and the Server 1100 in step 2050. This mapping consists of a translation between the Client's real IP address and source port (private side) and the NAT masqueraded client IP address and source port (public side). This mapping will remain in effect for a small period of time after it is made, thus allowing the Server 1100 to connect through to the Client 1200 at that mapping within a specific time-frame of the mapping having been created.
  • The Server's firewall 1300 sees the UDP or TCP packet, compares the ID and NAT public address in it to those it received from the SCS 1400 in step 2050. If there is a match then the Server's firewall 1300 notifies the Server 1100 about the event. The Server's firewall 1300 then always drops the unsolicited packet in step 2050, i.e., the packet never enters up into the Server's IP stack, as depicted in FIG. 7. The Server's firewall 1300 continues to check incoming packets on specified destination ports to see if they are query packets. In accordance with an embodiment of the present invention, the Server's firewall 1300 checks all three elements of the tag to guard against security attacks such as connection requests by a host masquerading as a genuine Client 1200. The Server's firewall 1300 will only consider packets coming from the NAT public address, to the specified destination port and containing the randomly generated ID. As a further guarantee of security the UDP/TCP packet could be encrypted as part of this technique.
  • The Server 1100 initiates a UDP or TCP connection to the Client 1200 using the source port forwarded by the Server's firewall 1300 in step 2060. It is appreciated that the NAT mapping created in step 2050 holds for a reasonable period of time (at least several seconds but possibly longer after the UDP or TCP packet has been received). In accordance with an aspect of the present invention, the Server 1100 can connect to the client through the NAT in this manner in step 2060, see FIG. 8.
  • One skilled in the art would appreciate that the Client 1200 is automatically connected and dynamically reconnected to the Server 1100 upon a change in its network address parameters, such as when the Client 1200 is moved to a different connection location, without requiring any user intervention other than one single user action such as a power-on, one mouse click or one keystroke. As a result, it is appreciated that the Client 1200 is not required be aware of any user information, or to process or perform any user function to be connected to the Server 1100 by means of an embodiment of this invention.
  • By means of example, in accordance with an embodiment of the present invention, one would appreciate the applicability of the invention to establishing secure connections between a Server 1100 and a Stateless Client 1200 over the internet via TCP/SSL. A Stateless Client 1200 is generally defined as a computer that does not perform any user functionality or contain any user data. More precisely a Stateless Client 1200 can be built as a network appliance consisting of a CPU, memory, Framebuffer and network port, mouse and keyboard input and optional IO ports. It's operated by built-in software that only performs network and display management fixed functions and does not allow for any download or execution of other software. It does not run any application. Its only purpose is to be a remote human interface device. The built-in software implements a network stack to allow communications with a server over a network like the Internet.
  • The statelessness of the client is in the context of the human interacting with applications or computational environments where all execution is on the server side. There is no application state or data residing in the client at any time. The only state it has is of temporary nature and related to network connectivity, i.e., TCP connection state. In accordance with an embodiment, present invention only uses the Stateless Client's network stack implementing the Secure Socket Layer (SSL) over TCP, as described in detail herein, and henceforth enables the automatic and dynamic establishment of secure connections between the Servers 1100 and Stateless Clients 1200 which cannot perform any user functions under any circumstance.
  • The Stateless Client 1200 automatically connects via TCP/SSL to the SCS 1400 and sends the name of the requested Server 1100 over the newly established connection.
  • The SCS 1400 detects the Stateless Client IP address from the socket connection. The SCS 1400 reads the requested Server name and determines if it has a connection to the desired Server 1100. If the SCS 1400 has no such connection the desired Server 1100, then the SCS 1400 either waits until it gets such connection or instructs the Stateless Client 1200 to retry later. If the Server 1100 is connected to the SCS 1400, then the SCS 1400 sends the Stateless Client IP address to the Server 1100. The Server 1100 reads the Stateless Client address, generates a unique 32 bit random number identifier (the ID) and sends the ID along with its IP address and port to the SCS 1400. The Server 1100 then instructs its firewall 1300 to sniff for “TCP SYN” (TCP connection request) packets from the Stateless Client's public IP address that have a initial sequence number set to the value of the ID.
  • Meanwhile the SCS 1400 forwards the server IP address, port and ID to the Stateless Client 1200. At this point the Stateless Client 1200 generates unsolicited TCP connection requests to the Server IP address and port with an initial sequence number set to the value of the ID. This outgoing packet will prime any NAT on the way to the Server 1100 and also deposit servers IP address and port as well as the ID in a SEQ translator layer at the bottom of the Stateless Client's network stack. Once such packet arrives at the Server 1100, the Server's firewall 1300 looks for a match and performs the following three tasks: a) store the Stateless Client address/port, server address/port and the sequence number; b) notify the Server 1100 and provide the Stateless Clients public port; and c) drop the packet.
  • The Server 1100 now opens a TCP connection to the Stateless Clients IP/port that will transverse the Server firewall 1300. The Server's firewall 1300 sees the outgoing TCP connection request (SYN flag is set) and finds a match and sets the TCP ACK flag and the acknowledge number. Externally, it is appreciated that the packet looks like a response to the unsolicited TCP connection request received from the Stateless Client 1200 and it travels back through the NAT gateways back to the Stateless Client 1200.
  • Upon arrival of such packet at the Stateless Client 1200, the SEQ translator layer matches the packet and deletes the TCP ACK flag such that the Stateless Client TCP stack sees a real connection request from the Server 1100.
  • The Stateless Clients TCP stack accepts the connection and responds with a TCP packet that has both the SYN and the ACK flag set. This TCP packet is matched by the SEQ translator layer which deletes the SYN flag and stores the difference between Stateless Client sequence number and the previously stored ID. It is appreciated that on the network this TCP packet looks like a third part of the TCP 3-way handshake.
  • When the TCP packet from the Stateless Client 1200 arrives at the Server's firewall 1300, the TCP packet is matched and the SYN flag is set. This TCP packet passes through the Server's firewall 1300 since it is a response to a connection request. The real third TCP handshake packet that comes from the Server 1100 passes through without change since it is treated as a normal acknowledgement packet. At the Stateless Client 1200, every arriving packet gets its acknowledge number adjusted by the previously stored sequence difference and every outgoing packet gets its sequence number adjusted by the difference. It is appreciated that no special flag mangling is necessary on the termination of the connection between the Server 110 and the Stateless Client 1200.
  • Although the present invention and its advantages have been described in detail, it should be understood that various changes, substitutions and alterations can be made herein without departing from the spirit and scope of the invention as defined by the appended claims. Moreover, the scope of the present application is not intended to be limited to the particular embodiments of the process, machine, manufacture, composition of matter, means, methods and steps described in the specification. As one of ordinary skill in the art will readily appreciate from the disclosure of the present invention, processes, machines, manufacture, compositions of matter, means, methods, or steps, presently existing or later to be developed that perform substantially the same function or achieve substantially the same result as the corresponding embodiments described herein may be utilized according to the present invention. Accordingly, the appended claims are intended to include within their scope such processes, machines, manufacture, compositions of matter, means, methods, or steps.

Claims (31)

What is claimed:
1. A method for automatically initiating and dynamically establishing secure connections over an untrusted network between a client and a server which does not accept explicit connection requests or packets from any client, using a third party computer trusted by both said server and said client, each of said client and said server being connected to said untrusted network via a firewall or network address translator (NAT) router, the method comprising the steps of:
automatically transmitting a connection request to said third party computer by said client upon one single action by a user of said client at power-on, upon connection to said untrusted network or upon any change in said client's network parameter, said connection request comprising a request to be connected to said server; and
exchanging connection parameters over said untrusted network between said server and said client using said third party computer, said connection parameters comprising a unique connection identifier to establish a secure connection between said server and said client through a NAT router associated with said client, thereby providing said user of said client with one single action access to said server.
2. The method of claim 1, further comprising steps of:
receiving an unsolicited packet comprising said unique connection identifier from said client by a firewall associated with said server to dynamically establish a transient mapping between said client and said server; and
transmitting a response packet to said client using said dynamically established transient mapping over said untrusted network by said server if it is determined that said unique connection identifier in said unsolicited packet matches a stored unique connection identifier.
3. The method of claim 1, further comprising the steps of:
receiving by said server a destination inbound port of said client and a public address of said NAT router associated with said client from said third party computer; and
transmitting by said server a destination port of said server and IP address of said firewall associated with said server and said unique connection identifier for said client to said third party computer.
4. The method of claim 3, further comprising the steps of:
receiving by said client an instruction to send said unsolicited packet to said server using said destination port of said server and said IP address of said firewall associated with said server from said third party computer; and
transmitting by said server said response packet to said client if it is determined that said unsolicited packet is received on said destination port of said server from said public address of said NAT router associated with said client.
5. The method of claim 3, further comprising the step of initiating by said server said secure connection to said client using said destination inbound port of said client received from said third party computer.
6. The method of claim 2, wherein the step of receiving comprises the step of receiving an unsolicited UDP or TCP packet comprising said unique connection identifier from said client by said firewall associated with said server.
7. A method for automatically initiating and dynamically establishing secure connections over an untrusted network between a client and a server which does not accept explicit connection requests or packets from any client, using a third party computer trusted by both said server and said client, each of said client and said server being connected to said untrusted network via a firewall or network address translator (NAT), the method comprising the steps of:
exchanging connection parameters over said untrusted network between said server and said client using said third party computer, said connection parameters comprising a unique connection identifier;
receiving an unsolicited packet comprising said unique connection identifier from said client by a firewall associated with said server to dynamically establish a transient mapping between said client and said server; and
transmitting a response packet to said client using said dynamically established transient mapping over said untrusted network by said server if it is determined that said unique connection identifier in said unsolicited packet matches a stored unique connection identifier, thereby establishing a secure connection between said server and said client through a NAT router associated with said client.
8. The method of claim 7, further comprising the steps of:
receiving by said server a destination inbound port of said client and a public address of said NAT router associated with said client from said third party computer; and
transmitting by said server a destination port of said server and IP address of said firewall associated with said server and said unique connection identifier for said client to said third party computer.
9. The method of claim 8, further comprising the steps of:
receiving by said client an instruction to send said unsolicited packet to said server using said destination port of said server and said IP address of said firewall associated with said server from said third party computer; and
transmitting by said server said response packet to said client if it is determined that said unsolicited packet is received on said destination port of said server from said public address of said NAT router associated with said client.
10. The method of claim 8, further comprising the step of initiating by said server said secure connection to said client using said destination inbound port of said client received from said third party computer.
11. The method of claim 7, wherein the step of receiving comprises the step of receiving by said firewall associated with said server an unsolicited UDP or TCP packet comprising said unique connection identifier from said client.
12. The method of claim 7, further comprising the step of transmitting by said client a connection request to said third party computer, said connection request comprising a request to be connected to said server.
13. The method of claim 12, further comprising the step of automatically transmitting said connection request to said third party computer by said client upon one single action by a user of said client at power-on, upon connection to said untrusted network or upon any change in said client's network parameter, thereby providing said user of said client with one single action access to said server.
14. A system for automatically initiating and dynamically establishing secure connections over an untrusted network between a client and a server which does not accept explicit connection requests or packets from any client using a third party computer trusted by both said server and said client; wherein each of said client and said server being connected to said untrusted network via a firewall or network address translator (NAT); wherein said client is operable to automatically transmit a connection request to said third party computer upon one single action by a user of said client at power-on, upon connection to said untrusted network or upon any change in said client's network parameter, said connection request comprising a request to be connected to said server; and wherein said server and said client are operable to exchange connection parameters over said untrusted network using said third party computer, said connection parameters comprising a unique connection identifier to establish a secure connection between said server and said client through a NAT router associated with said client, thereby providing said user of said client with one single action access to said server.
15. The system of claim 14, wherein a firewall associated with said server is operable to receive an unsolicited packet comprising said unique connection identifier from said client to dynamically establish a transient mapping between said client and said server; and wherein said server is operable to transmit a response packet to said client using said dynamically established transient mapping over said untrusted network if it is determined that said unique connection identifier in said unsolicited packet matches a stored unique connection identifier.
16. The system of claim 14, wherein said server is operable to receive method of claim 1, further comprising the steps of:
receiving by said server a destination inbound port of said client and a public address of said NAT router associated with said client from said third party computer; and
transmitting by said server a destination port of said server and IP address of said firewall associated with said server and said unique connection identifier for said client to said third party computer.
17. The system of claim 16, wherein said client is operable to receive an instruction to send said unsolicited packet to said server using said destination port of said server and said IP address of said firewall associated with said server from said third party computer; and wherein said server is operable to transmit said response packet to said client if it is determined that said unsolicited packet is received on said destination port of said server from said public address of said NAT router associated with said client.
18. The system of claim 16, wherein said server is operable to initiate said secure connection to said client using said destination inbound port of said client received from said third party computer.
19. The system of claim 15, wherein said server is operable to receive an unsolicited UDP or TCP packet comprising said unique connection identifier from said client.
20. The system of claim 14, wherein said client is a stateless client which does not perform any user functionality or contain any user data.
21. The system of claim 14, wherein said client is a single function network-aware consumer device.
22. The system of claim 21, wherein said single function network-aware consumer device is one of the following: a cellular phone, a music player/recorder, a video player/recorder, a game player, or a portable email device.
23. A system for automatically initiating and dynamically establishing secure connections over an untrusted network between a client and a server which does not accept explicit connection requests or packets from any client using a third party computer trusted by both said server and said client; wherein each of said client and said server being connected to said untrusted network via a firewall or network address translator (NAT); wherein said server and said client are operable to exchange connection parameters over said untrusted network using said third party computer, said connection parameters comprising a unique connection identifier; wherein said firewall associated with said server is operable to receive an unsolicited packet comprising said unique connection identifier from said client to dynamically establish a transient mapping between said client and said server; and wherein said sever is operable to transmit a response packet to said client using said dynamically established transient mapping over said untrusted network if it is determined that said unique connection identifier in said unsolicited packet matches a stored unique connection identifier, thereby establishing a secure connection between said server and said client through said NAT router associated with said client.
24. The system of claim 23, wherein said server is operable to receive a destination inbound port of said client and a public address of said NAT router associated with said client from said third party computer; and wherein said client is operable to receive a destination port and IP address of said server and said unique connection identifier from said third party computer.
25. The system of claim 24, wherein said client is operable to receive an instruction to send said unsolicited packet to said server from said third party computer; and wherein said server is operable to transmit a response packet to said client if it is determined that said unsolicited packet is received on said destination port of said sever from said public address of said NAT router associated with said client.
26. The system of claim 23, wherein said server is operable to initiate said secure connection to said client using said destination inbound port of said client received from said third party computer.
27. The system of claim 23, wherein said client is a stateless client which does not perform any user functionality or contain any user data.
28. The system of claim 23, wherein said client is a single function network-aware consumer device.
29. The system of claim 28, wherein said single function network-aware consumer device is one of the following: a cellular phone, a music player/recorder, a video player/recorder, a game player, or a portable email device.
30. The system of claim 23, wherein said client is operable to transmit a connection request to said third party computer, said connection request comprising a request to be connected to said server.
31. The system of claim 30, wherein said client is operable to automatically transmit said connection request upon one single action by a user of said client at power-on, upon connection to said untrusted network or upon any change in said client's network parameter to said third party computer, thereby providing said user of said client with one single action access to said server.
US12/840,356 2004-04-12 2010-07-21 System and method for automatically initiating and dynamically establishing secure internet connections between a fire-walled server and a fire-walled client Abandoned US20110066739A1 (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US12/840,356 US20110066739A1 (en) 2004-04-12 2010-07-21 System and method for automatically initiating and dynamically establishing secure internet connections between a fire-walled server and a fire-walled client
US13/467,437 US8631139B2 (en) 2004-04-12 2012-05-09 System and method for automatically initiating and dynamically establishing secure internet connections between a fire-walled server and a fire-walled client

Applications Claiming Priority (3)

Application Number Priority Date Filing Date Title
US56180604P 2004-04-12 2004-04-12
US11/104,982 US20050238034A1 (en) 2004-04-12 2005-04-12 System and method for automatically initiating and dynamically establishing secure internet connections between a fire-walled server and a fire-walled client
US12/840,356 US20110066739A1 (en) 2004-04-12 2010-07-21 System and method for automatically initiating and dynamically establishing secure internet connections between a fire-walled server and a fire-walled client

Related Parent Applications (1)

Application Number Title Priority Date Filing Date
US11/104,982 Continuation US20050238034A1 (en) 2004-04-12 2005-04-12 System and method for automatically initiating and dynamically establishing secure internet connections between a fire-walled server and a fire-walled client

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US13/467,437 Continuation US8631139B2 (en) 2004-04-12 2012-05-09 System and method for automatically initiating and dynamically establishing secure internet connections between a fire-walled server and a fire-walled client

Publications (1)

Publication Number Publication Date
US20110066739A1 true US20110066739A1 (en) 2011-03-17

Family

ID=35150655

Family Applications (3)

Application Number Title Priority Date Filing Date
US11/104,982 Abandoned US20050238034A1 (en) 2004-04-12 2005-04-12 System and method for automatically initiating and dynamically establishing secure internet connections between a fire-walled server and a fire-walled client
US12/840,356 Abandoned US20110066739A1 (en) 2004-04-12 2010-07-21 System and method for automatically initiating and dynamically establishing secure internet connections between a fire-walled server and a fire-walled client
US13/467,437 Expired - Fee Related US8631139B2 (en) 2004-04-12 2012-05-09 System and method for automatically initiating and dynamically establishing secure internet connections between a fire-walled server and a fire-walled client

Family Applications Before (1)

Application Number Title Priority Date Filing Date
US11/104,982 Abandoned US20050238034A1 (en) 2004-04-12 2005-04-12 System and method for automatically initiating and dynamically establishing secure internet connections between a fire-walled server and a fire-walled client

Family Applications After (1)

Application Number Title Priority Date Filing Date
US13/467,437 Expired - Fee Related US8631139B2 (en) 2004-04-12 2012-05-09 System and method for automatically initiating and dynamically establishing secure internet connections between a fire-walled server and a fire-walled client

Country Status (9)

Country Link
US (3) US20050238034A1 (en)
EP (1) EP1738530A2 (en)
JP (2) JP2008505512A (en)
KR (1) KR20070041438A (en)
CN (1) CN101095134A (en)
AU (1) AU2005234496A1 (en)
BR (1) BRPI0509900A (en)
CA (1) CA2562912A1 (en)
WO (1) WO2005101747A2 (en)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103684960A (en) * 2012-08-29 2014-03-26 株式会社日立制作所 Network system and virtual node migration method
US20150128199A1 (en) * 2011-11-10 2015-05-07 Through Tek Technology (ShenZhen) Co., Ltd. Information concentrating center capable of making p2p connections with remote client devices
TWI566592B (en) * 2014-01-07 2017-01-11 物聯智慧科技(深圳)有限公司 An information concentrating center capable of making p2p connections with remote client devices
US20180062960A1 (en) * 2016-08-31 2018-03-01 Synology Incorporated Method and associated control apparatus for controlling a client device to access a network device

Families Citing this family (48)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2004023263A2 (en) * 2002-09-09 2004-03-18 Netrake Corporation System for allowing network traffic through firewalls
JP4421946B2 (en) * 2004-05-31 2010-02-24 京セラ株式会社 Communication terminal device and communication method thereof
US20060072569A1 (en) * 2004-10-04 2006-04-06 Wizzysoft Corporation Network address translation protocol for transmission control protocol connections
CN101147362A (en) * 2005-03-22 2008-03-19 日本电气株式会社 Connection parameter setting system, method thereof, access point, server, radio terminal, and parameter setting device
WO2007002434A2 (en) * 2005-06-23 2007-01-04 Xds, Inc. Methods and apparatus for network address change for mobile devices
NO20055084L (en) * 2005-10-31 2007-05-02 Telenor Asa System and method for establishing a connection between a client on one network and a web service on another network
US8788706B2 (en) * 2006-02-27 2014-07-22 Vudu, Inc. Method and system for managing data transmission between devices behind network address translators (NATs)
US7706373B2 (en) * 2006-11-01 2010-04-27 Nuvoiz, Inc. Session initiation and maintenance while roaming
WO2008082483A1 (en) * 2006-12-21 2008-07-10 Simtone Corporation Service chaining methods and apparatus
US20080225749A1 (en) * 2007-03-13 2008-09-18 Dennis Peng Auto-configuration of a network device
US10469556B2 (en) * 2007-05-31 2019-11-05 Ooma, Inc. System and method for providing audio cues in operation of a VoIP service
US9225626B2 (en) 2007-06-20 2015-12-29 Ooma, Inc. System and method for providing virtual multiple lines in a communications system
US7707294B2 (en) * 2007-06-26 2010-04-27 Microsoft Corporation Edge traversal service dormancy
US8056890B2 (en) * 2007-07-02 2011-11-15 William Thomas Engel Cut mat
US20090168755A1 (en) * 2008-01-02 2009-07-02 Dennis Peng Enforcement of privacy in a VoIP system
US8515021B2 (en) * 2008-02-25 2013-08-20 Ooma, Inc. System and method for providing personalized reverse 911 service
US8374188B2 (en) * 2008-06-24 2013-02-12 Microsoft Corporation Techniques to manage a relay server and a network address translator
US20120144475A1 (en) 2009-02-06 2012-06-07 Sagemcom Canada, Inc. Scalable nat traversal
KR20100134433A (en) * 2009-06-15 2010-12-23 엘지전자 주식회사 Mobile terminal with function control module and the method thereof
US20110219443A1 (en) * 2010-03-05 2011-09-08 Alcatel-Lucent Usa, Inc. Secure connection initiation with hosts behind firewalls
US8681973B2 (en) * 2010-09-15 2014-03-25 At&T Intellectual Property I, L.P. Methods, systems, and computer program products for performing homomorphic encryption and decryption on individual operations
JP5760736B2 (en) 2011-06-22 2015-08-12 富士通株式会社 Communication device
US9166952B2 (en) * 2012-10-15 2015-10-20 Thales Canada Inc Security device bank and a system including the and SD security device bank
CN102946387B (en) * 2012-11-01 2016-12-21 惠州Tcl移动通信有限公司 A kind of method defending rejection service attack
US20140223178A1 (en) 2013-02-01 2014-08-07 Junaid Islam Securing Communication over a Network Using User Identity Verification
US20140247941A1 (en) * 2013-03-01 2014-09-04 Oplink Communications, Inc. Self-configuring wireless network
US9386010B2 (en) * 2013-05-02 2016-07-05 Globalfoundries Inc. Abstracted authenticated client connectivity application programming interface (API)
US9560198B2 (en) 2013-09-23 2017-01-31 Ooma, Inc. Identifying and filtering incoming telephone calls to enhance privacy
US9386148B2 (en) 2013-09-23 2016-07-05 Ooma, Inc. Identifying and filtering incoming telephone calls to enhance privacy
US10553098B2 (en) 2014-05-20 2020-02-04 Ooma, Inc. Appliance device integration with alarm systems
US9633547B2 (en) 2014-05-20 2017-04-25 Ooma, Inc. Security monitoring and control
US10769931B2 (en) 2014-05-20 2020-09-08 Ooma, Inc. Network jamming detection and remediation
US11330100B2 (en) 2014-07-09 2022-05-10 Ooma, Inc. Server based intelligent personal assistant services
US9288272B2 (en) * 2014-07-10 2016-03-15 Real Innovations International Llc System and method for secure real-time cloud services
US9521069B2 (en) 2015-05-08 2016-12-13 Ooma, Inc. Managing alternative networks for high quality of service communications
US10009286B2 (en) 2015-05-08 2018-06-26 Ooma, Inc. Communications hub
US10771396B2 (en) 2015-05-08 2020-09-08 Ooma, Inc. Communications network failure detection and remediation
US10911368B2 (en) 2015-05-08 2021-02-02 Ooma, Inc. Gateway address spoofing for alternate network utilization
US11171875B2 (en) 2015-05-08 2021-11-09 Ooma, Inc. Systems and methods of communications network failure detection and remediation utilizing link probes
US10116796B2 (en) 2015-10-09 2018-10-30 Ooma, Inc. Real-time communications-based internet advertising
US10021117B2 (en) * 2016-01-04 2018-07-10 Bank Of America Corporation Systems and apparatus for analyzing secure network electronic communication and endpoints
US10469262B1 (en) 2016-01-27 2019-11-05 Verizon Patent ad Licensing Inc. Methods and systems for network security using a cryptographic firewall
CN106096923A (en) * 2016-06-27 2016-11-09 联想(北京)有限公司 A kind of secure payment means of defence and electronic equipment
US10554480B2 (en) 2017-05-11 2020-02-04 Verizon Patent And Licensing Inc. Systems and methods for maintaining communication links
US10917384B2 (en) * 2017-09-12 2021-02-09 Synergex Group Methods, systems, and media for modifying firewalls based on dynamic IP addresses
US11201925B2 (en) 2020-04-28 2021-12-14 Caterpillar Inc. Communicating parameters based on a change
EP4002798A1 (en) * 2020-11-17 2022-05-25 Wobben Properties GmbH Method for establishing a data connection to a wind farm and a wind farm communication system
CN114598532B (en) * 2022-03-11 2023-07-28 北京百度网讯科技有限公司 Connection establishment method, device, electronic equipment and storage medium

Citations (62)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5621660A (en) * 1995-04-18 1997-04-15 Sun Microsystems, Inc. Software-based encoder for a software-implemented end-to-end scalable video delivery system
US5623605A (en) * 1994-08-29 1997-04-22 Lucent Technologies Inc. Methods and systems for interprocess communication and inter-network data transfer
US5802178A (en) * 1996-07-30 1998-09-01 Itt Industries, Inc. Stand alone device for providing security within computer networks
US5896499A (en) * 1997-02-21 1999-04-20 International Business Machines Corporation Embedded security processor
US5918051A (en) * 1995-07-19 1999-06-29 Ricoh Company, Ltd. Object-oriented communication system with support for multiple remote machine types
US6038301A (en) * 1997-12-31 2000-03-14 Alcatel Usa Sourcing, L.P. Method and system for engineering a service in an advanced intelligent network
US6044403A (en) * 1997-12-31 2000-03-28 At&T Corp Network server platform for internet, JAVA server and video application server
US6085247A (en) * 1998-06-08 2000-07-04 Microsoft Corporation Server operating system for supporting multiple client-server sessions and dynamic reconnection of users to previous sessions using different computers
US6104392A (en) * 1997-11-13 2000-08-15 The Santa Cruz Operation, Inc. Method of displaying an application on a variety of client devices in a client/server network
US6104716A (en) * 1997-03-28 2000-08-15 International Business Machines Corporation Method and apparatus for lightweight secure communication tunneling over the internet
US6154843A (en) * 1997-03-21 2000-11-28 Microsoft Corporation Secure remote access computing system
US6178438B1 (en) * 1997-12-18 2001-01-23 Alcatel Usa Sourcing, L.P. Service management system for an advanced intelligent network
US6182123B1 (en) * 1988-07-15 2001-01-30 Ibm Corp. Interactive computer network and method of operation
US6202156B1 (en) * 1997-09-12 2001-03-13 Sun Microsystems, Inc. Remote access-controlled communication
US6209031B1 (en) * 1998-07-17 2001-03-27 International Business Machines Corporation Configuring computer network operations based upon a sequence of interactive user entries into a network server computer with a one time entry of data commonly required by multiple clients
US6216157B1 (en) * 1997-11-14 2001-04-10 Yahoo! Inc. Method and apparatus for a client-server system with heterogeneous clients
US6223289B1 (en) * 1998-04-20 2001-04-24 Sun Microsystems, Inc. Method and apparatus for session management and user authentication
US6230296B1 (en) * 1998-04-20 2001-05-08 Sun Microsystems, Inc. Method and apparatus for providing error correction
US6233577B1 (en) * 1998-02-17 2001-05-15 Phone.Com, Inc. Centralized certificate management system for two-way interactive communication devices in data networks
US20010042202A1 (en) * 2000-04-14 2001-11-15 Horvath Charles J. Dynamically extendible firewall
US20010047406A1 (en) * 2000-04-13 2001-11-29 Netilla Networks Inc. Apparatus and accompanying methods for providing, through a centralized server site, an integrated virtual office environment, remotely accessible via a network-connected web browser, with remote network monitoring and management capabilities
US6349337B1 (en) * 1997-11-14 2002-02-19 Microsoft Corporation Maintaining a first session on a first computing device and subsequently connecting to the first session via different computing devices and adapting the first session to conform to the different computing devices system configurations
US6362836B1 (en) * 1998-04-06 2002-03-26 The Santa Cruz Operation, Inc. Universal application server for providing applications on a variety of client devices in a client/server network
US20020046300A1 (en) * 2000-10-17 2002-04-18 Hanko James G. Associating multiple display units in a grouped server environment
US20020049803A1 (en) * 2000-08-24 2002-04-25 Jagadish Bandhole Dynamic computing environment using remotely allocable resources
US6385666B1 (en) * 1997-12-15 2002-05-07 Clearcube Technology, Inc. Computer system having remotely located I/O devices where signals are encoded at the computer system through two encoders and decoded at I/O devices through two decoders
US6393605B1 (en) * 1998-11-18 2002-05-21 Siebel Systems, Inc. Apparatus and system for efficient delivery and deployment of an application
US20020065949A1 (en) * 2000-06-14 2002-05-30 Dennis Heaton Virtual network computing
US6425005B1 (en) * 1997-10-06 2002-07-23 Mci Worldcom, Inc. Method and apparatus for managing local resources at service nodes in an intelligent network
US6438141B1 (en) * 1998-04-20 2002-08-20 Sun Microsystems, Inc. Method and management of communications over media of finite bandwidth
US20020129266A1 (en) * 2001-03-08 2002-09-12 Bender Michael S. System for identification of smart cards
US20020133330A1 (en) * 2001-03-13 2002-09-19 Microsoft Corporation Provisioning computing services via an on-line networked computing environment
US20020133529A1 (en) * 2001-01-16 2002-09-19 Schmidt Brian Keith Method and apparatus for representing and encapsulating active computing environments
US20020138629A1 (en) * 2001-03-22 2002-09-26 Schmidt Brian K. Method and apparatus for migration of open network connections
US6505248B1 (en) * 1999-03-24 2003-01-07 Gte Data Services Incorporated Method and system for monitoring and dynamically reporting a status of a remote server
US20030009568A1 (en) * 2001-06-26 2003-01-09 Eastman Kodak Company Method and system for managing images over a communication network
US6510216B1 (en) * 1998-03-23 2003-01-21 Mci Communications Corporation Intelligent network provisioning system and method
US20030028653A1 (en) * 2001-08-06 2003-02-06 New John C. Method and system for providing access to computer resources
US20030061301A1 (en) * 2001-09-25 2003-03-27 Frank Chethik Music on demand system and method
US20030084103A1 (en) * 2001-10-29 2003-05-01 Comverse, Ltd. Method and system for third-party initiation of an anonymous tele-chat session
US20030120747A1 (en) * 2001-12-20 2003-06-26 Samsung Electronics Co., Ltd. Thin client network system and data transmitting method therefor
US6591306B1 (en) * 1999-04-01 2003-07-08 Nec Corporation IP network access for portable devices
US6643701B1 (en) * 1999-11-17 2003-11-04 Sun Microsystems, Inc. Method and apparatus for providing secure communication with a relay in a network
US6711610B1 (en) * 1999-09-10 2004-03-23 International Business Machines Corporation System and method for establishing secure internet communication between a remote computer and a host computer via an intermediate internet computer
US6874088B1 (en) * 1999-10-22 2005-03-29 Mission Critical Linux, Llc Secure remote servicing of a computer system over a computer network
US6886103B1 (en) * 1999-10-28 2005-04-26 Lucent Technologies Inc. Method and apparatus for extending network address translation for unsupported protocols
US6917586B1 (en) * 1997-10-01 2005-07-12 Nortel Networks Limited Communication system architecture and operating methods thereof
US6928479B1 (en) * 2000-05-24 2005-08-09 01 Communique Laboratory Inc. System computer product and method for providing a private communication portal
US6934706B1 (en) * 2002-03-22 2005-08-23 International Business Machines Corporation Centralized mapping of security credentials for database access operations
US6954792B2 (en) * 2001-06-29 2005-10-11 Sun Microsystems, Inc. Pluggable authentication and access control for a messaging system
US6993651B2 (en) * 1999-12-08 2006-01-31 Hewlett-Packard Development Company, L.P. Security protocol
US7003668B2 (en) * 2000-11-03 2006-02-21 Fusionone, Inc. Secure authentication of users via intermediate parties
US7010608B2 (en) * 2001-09-28 2006-03-07 Intel Corporation System and method for remotely accessing a home server while preserving end-to-end security
US7036010B2 (en) * 1999-12-08 2006-04-25 Hewlett-Packard Development Company, L.P. Method and apparatus for a secure communications session with a remote system via an access-controlling intermediate system
US7035828B2 (en) * 2000-10-25 2006-04-25 Topmoxie, Inc. Method and system for modifying and transmitting data between a portable computer and a network
US7069438B2 (en) * 2002-08-19 2006-06-27 Sowl Associates, Inc. Establishing authenticated network connections
US7092369B2 (en) * 1995-11-17 2006-08-15 Symbol Technologies, Inc. Communications network with wireless gateways for mobile terminal access
US7103770B2 (en) * 2000-01-27 2006-09-05 Web Data Solutions, Inc. Point-to-point data streaming using a mediator node for administration and security
US7117267B2 (en) * 2001-06-28 2006-10-03 Sun Microsystems, Inc. System and method for providing tunnel connections between entities in a messaging system
US7130888B1 (en) * 1996-02-16 2006-10-31 G&H Nevada-Tek Method and apparatus for controlling a computer over a TCP/IP protocol network
US7143093B1 (en) * 1998-12-17 2006-11-28 Webmethods, Inc. Enterprise computer system
US7363363B2 (en) * 2002-05-17 2008-04-22 Xds, Inc. System and method for provisioning universal stateless digital and computing services

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2002067531A1 (en) * 2001-02-20 2002-08-29 Eyeball Networks Inc. Method and apparatus to permit data transmission to traverse firewalls
WO2002103964A1 (en) * 2001-06-18 2002-12-27 Sony Corporation Data transmission apparatus, data transmission method, and data transmission method program
US7676579B2 (en) * 2002-05-13 2010-03-09 Sony Computer Entertainment America Inc. Peer to peer network communication

Patent Citations (65)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6182123B1 (en) * 1988-07-15 2001-01-30 Ibm Corp. Interactive computer network and method of operation
US5623605A (en) * 1994-08-29 1997-04-22 Lucent Technologies Inc. Methods and systems for interprocess communication and inter-network data transfer
US5768535A (en) * 1995-04-18 1998-06-16 Sun Microsystems, Inc. Software-based encoder for a software-implemented end-to-end scalable video delivery system
US5621660A (en) * 1995-04-18 1997-04-15 Sun Microsystems, Inc. Software-based encoder for a software-implemented end-to-end scalable video delivery system
US6438617B1 (en) * 1995-07-19 2002-08-20 Ricoh Company, Ltd. Object-oriented communication system with support for multiple remote machine types
US5918051A (en) * 1995-07-19 1999-06-29 Ricoh Company, Ltd. Object-oriented communication system with support for multiple remote machine types
US7092369B2 (en) * 1995-11-17 2006-08-15 Symbol Technologies, Inc. Communications network with wireless gateways for mobile terminal access
US7130888B1 (en) * 1996-02-16 2006-10-31 G&H Nevada-Tek Method and apparatus for controlling a computer over a TCP/IP protocol network
US5802178A (en) * 1996-07-30 1998-09-01 Itt Industries, Inc. Stand alone device for providing security within computer networks
US5896499A (en) * 1997-02-21 1999-04-20 International Business Machines Corporation Embedded security processor
US6154843A (en) * 1997-03-21 2000-11-28 Microsoft Corporation Secure remote access computing system
US6104716A (en) * 1997-03-28 2000-08-15 International Business Machines Corporation Method and apparatus for lightweight secure communication tunneling over the internet
US6202156B1 (en) * 1997-09-12 2001-03-13 Sun Microsystems, Inc. Remote access-controlled communication
US6917586B1 (en) * 1997-10-01 2005-07-12 Nortel Networks Limited Communication system architecture and operating methods thereof
US6425005B1 (en) * 1997-10-06 2002-07-23 Mci Worldcom, Inc. Method and apparatus for managing local resources at service nodes in an intelligent network
US6104392A (en) * 1997-11-13 2000-08-15 The Santa Cruz Operation, Inc. Method of displaying an application on a variety of client devices in a client/server network
US6216157B1 (en) * 1997-11-14 2001-04-10 Yahoo! Inc. Method and apparatus for a client-server system with heterogeneous clients
US6349337B1 (en) * 1997-11-14 2002-02-19 Microsoft Corporation Maintaining a first session on a first computing device and subsequently connecting to the first session via different computing devices and adapting the first session to conform to the different computing devices system configurations
US6385666B1 (en) * 1997-12-15 2002-05-07 Clearcube Technology, Inc. Computer system having remotely located I/O devices where signals are encoded at the computer system through two encoders and decoded at I/O devices through two decoders
US6178438B1 (en) * 1997-12-18 2001-01-23 Alcatel Usa Sourcing, L.P. Service management system for an advanced intelligent network
US6038301A (en) * 1997-12-31 2000-03-14 Alcatel Usa Sourcing, L.P. Method and system for engineering a service in an advanced intelligent network
US6044403A (en) * 1997-12-31 2000-03-28 At&T Corp Network server platform for internet, JAVA server and video application server
US6233577B1 (en) * 1998-02-17 2001-05-15 Phone.Com, Inc. Centralized certificate management system for two-way interactive communication devices in data networks
US6510216B1 (en) * 1998-03-23 2003-01-21 Mci Communications Corporation Intelligent network provisioning system and method
US6362836B1 (en) * 1998-04-06 2002-03-26 The Santa Cruz Operation, Inc. Universal application server for providing applications on a variety of client devices in a client/server network
US6438141B1 (en) * 1998-04-20 2002-08-20 Sun Microsystems, Inc. Method and management of communications over media of finite bandwidth
US6230296B1 (en) * 1998-04-20 2001-05-08 Sun Microsystems, Inc. Method and apparatus for providing error correction
US6223289B1 (en) * 1998-04-20 2001-04-24 Sun Microsystems, Inc. Method and apparatus for session management and user authentication
US6085247A (en) * 1998-06-08 2000-07-04 Microsoft Corporation Server operating system for supporting multiple client-server sessions and dynamic reconnection of users to previous sessions using different computers
US6209031B1 (en) * 1998-07-17 2001-03-27 International Business Machines Corporation Configuring computer network operations based upon a sequence of interactive user entries into a network server computer with a one time entry of data commonly required by multiple clients
US6393605B1 (en) * 1998-11-18 2002-05-21 Siebel Systems, Inc. Apparatus and system for efficient delivery and deployment of an application
US7143093B1 (en) * 1998-12-17 2006-11-28 Webmethods, Inc. Enterprise computer system
US6505248B1 (en) * 1999-03-24 2003-01-07 Gte Data Services Incorporated Method and system for monitoring and dynamically reporting a status of a remote server
US6591306B1 (en) * 1999-04-01 2003-07-08 Nec Corporation IP network access for portable devices
US6711610B1 (en) * 1999-09-10 2004-03-23 International Business Machines Corporation System and method for establishing secure internet communication between a remote computer and a host computer via an intermediate internet computer
US6874088B1 (en) * 1999-10-22 2005-03-29 Mission Critical Linux, Llc Secure remote servicing of a computer system over a computer network
US6886103B1 (en) * 1999-10-28 2005-04-26 Lucent Technologies Inc. Method and apparatus for extending network address translation for unsupported protocols
US6643701B1 (en) * 1999-11-17 2003-11-04 Sun Microsystems, Inc. Method and apparatus for providing secure communication with a relay in a network
US6993651B2 (en) * 1999-12-08 2006-01-31 Hewlett-Packard Development Company, L.P. Security protocol
US7036010B2 (en) * 1999-12-08 2006-04-25 Hewlett-Packard Development Company, L.P. Method and apparatus for a secure communications session with a remote system via an access-controlling intermediate system
US7103770B2 (en) * 2000-01-27 2006-09-05 Web Data Solutions, Inc. Point-to-point data streaming using a mediator node for administration and security
US20020032725A1 (en) * 2000-04-13 2002-03-14 Netilla Networks Inc. Apparatus and accompanying methods for providing, through a centralized server site, an integrated virtual office environment, remotely accessible via a network-connected web browser, with remote network monitoring and management capabilities
US20010047406A1 (en) * 2000-04-13 2001-11-29 Netilla Networks Inc. Apparatus and accompanying methods for providing, through a centralized server site, an integrated virtual office environment, remotely accessible via a network-connected web browser, with remote network monitoring and management capabilities
US20010042202A1 (en) * 2000-04-14 2001-11-15 Horvath Charles J. Dynamically extendible firewall
US6928479B1 (en) * 2000-05-24 2005-08-09 01 Communique Laboratory Inc. System computer product and method for providing a private communication portal
US20020065949A1 (en) * 2000-06-14 2002-05-30 Dennis Heaton Virtual network computing
US20020049803A1 (en) * 2000-08-24 2002-04-25 Jagadish Bandhole Dynamic computing environment using remotely allocable resources
US20020046300A1 (en) * 2000-10-17 2002-04-18 Hanko James G. Associating multiple display units in a grouped server environment
US7035828B2 (en) * 2000-10-25 2006-04-25 Topmoxie, Inc. Method and system for modifying and transmitting data between a portable computer and a network
US7003668B2 (en) * 2000-11-03 2006-02-21 Fusionone, Inc. Secure authentication of users via intermediate parties
US20020133529A1 (en) * 2001-01-16 2002-09-19 Schmidt Brian Keith Method and apparatus for representing and encapsulating active computing environments
US20020129266A1 (en) * 2001-03-08 2002-09-12 Bender Michael S. System for identification of smart cards
US20020133330A1 (en) * 2001-03-13 2002-09-19 Microsoft Corporation Provisioning computing services via an on-line networked computing environment
US20020138629A1 (en) * 2001-03-22 2002-09-26 Schmidt Brian K. Method and apparatus for migration of open network connections
US20030009568A1 (en) * 2001-06-26 2003-01-09 Eastman Kodak Company Method and system for managing images over a communication network
US7117267B2 (en) * 2001-06-28 2006-10-03 Sun Microsystems, Inc. System and method for providing tunnel connections between entities in a messaging system
US6954792B2 (en) * 2001-06-29 2005-10-11 Sun Microsystems, Inc. Pluggable authentication and access control for a messaging system
US20030028653A1 (en) * 2001-08-06 2003-02-06 New John C. Method and system for providing access to computer resources
US20030061301A1 (en) * 2001-09-25 2003-03-27 Frank Chethik Music on demand system and method
US7010608B2 (en) * 2001-09-28 2006-03-07 Intel Corporation System and method for remotely accessing a home server while preserving end-to-end security
US20030084103A1 (en) * 2001-10-29 2003-05-01 Comverse, Ltd. Method and system for third-party initiation of an anonymous tele-chat session
US20030120747A1 (en) * 2001-12-20 2003-06-26 Samsung Electronics Co., Ltd. Thin client network system and data transmitting method therefor
US6934706B1 (en) * 2002-03-22 2005-08-23 International Business Machines Corporation Centralized mapping of security credentials for database access operations
US7363363B2 (en) * 2002-05-17 2008-04-22 Xds, Inc. System and method for provisioning universal stateless digital and computing services
US7069438B2 (en) * 2002-08-19 2006-06-27 Sowl Associates, Inc. Establishing authenticated network connections

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150128199A1 (en) * 2011-11-10 2015-05-07 Through Tek Technology (ShenZhen) Co., Ltd. Information concentrating center capable of making p2p connections with remote client devices
US9774916B2 (en) * 2011-11-10 2017-09-26 Throughtek Technology (Shenzhen) Co., Ltd. Information concentrating center capable of making P2P connections with remote client devices
CN103684960A (en) * 2012-08-29 2014-03-26 株式会社日立制作所 Network system and virtual node migration method
TWI566592B (en) * 2014-01-07 2017-01-11 物聯智慧科技(深圳)有限公司 An information concentrating center capable of making p2p connections with remote client devices
US20180062960A1 (en) * 2016-08-31 2018-03-01 Synology Incorporated Method and associated control apparatus for controlling a client device to access a network device

Also Published As

Publication number Publication date
US8631139B2 (en) 2014-01-14
BRPI0509900A (en) 2007-09-18
JP2008505512A (en) 2008-02-21
US20120222108A1 (en) 2012-08-30
US20050238034A1 (en) 2005-10-27
CA2562912A1 (en) 2005-10-27
WO2005101747A2 (en) 2005-10-27
CN101095134A (en) 2007-12-26
JP2011072038A (en) 2011-04-07
AU2005234496A1 (en) 2005-10-27
KR20070041438A (en) 2007-04-18
EP1738530A2 (en) 2007-01-03
WO2005101747A3 (en) 2007-09-13

Similar Documents

Publication Publication Date Title
US8631139B2 (en) System and method for automatically initiating and dynamically establishing secure internet connections between a fire-walled server and a fire-walled client
Rosenberg et al. TCP Candidates with Interactive Connectivity Establishment (ICE)
US7609701B2 (en) Communication using private IP addresses of local networks
EP1714434B1 (en) Addressing method and apparatus for establishing host identity protocol (hip) connections between legacy and hip nodes
US8918525B2 (en) Routing hints
EP2790387B1 (en) Method and system for providing connectivity for an ssl/tls server behind a restrictive firewall or nat
US8266294B2 (en) Routing hints
US11575757B2 (en) Cloaked remote client access
IL173157A (en) Routing hints
Ng et al. A Waypoint Service Approach to Connect Heterogeneous Internet Address Spaces.
US9088542B2 (en) Firewall traversal driven by proximity
US20160315824A1 (en) Networking systems
Bhattacharjya et al. On mapping of address and port using translation
Ylitalo et al. SPINAT: Integrating IPsec into overlay routing
JP4401302B2 (en) Communication management system, communication management method, and communication management program
Janbeglou et al. Overudp: Tunneling transport layer protocols in udp for p2p application of ipv4
Rosenberg et al. RFC 6544: TCP Candidates with Interactive Connectivity Establishment (ICE)
Asghar et al. Security issues of SIP
Slehat et al. Securing teredo client from NAT holes vulnerability
Egeland et al. Peer-to-Peer IP Telephony

Legal Events

Date Code Title Description
STCB Information on status: application discontinuation

Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION