Secure port forwarding

1 . A computer-implemented method for controlling access to services in a network using a network edge device, the network including at least one device configured to provide a service, the service being associated with a port, the computer-implemented method including:

performing a port identification scan on the network to generate port data representing the service provided by the device and the associated port;

obtaining port vulnerability data;

generating a port vulnerability score for the port based on the port data and the port vulnerability data, wherein the port vulnerability score is dependent on the service provided by the device, and generating the port vulnerability score for the port includes;

obtaining an initial vulnerability score from a vulnerabilities and exposures database; and

modifying the initial vulnerability score based on one or more characteristics associated with the port;

obtaining a threshold port vulnerability score; and

controlling access to the port in dependence on a comparison of the port vulnerability score with the threshold port vulnerability score,

wherein, in response to determining that the port is vulnerable based on the comparison of the port vulnerability score with the threshold port vulnerability score, controlling access to the port comprises rejecting port forwarding requests from external devices that are outside of the network attempting to access the service on the port while maintaining access to the port and associated service for local devices within the network.

2 . The computer-implemented method of claim 1 , wherein obtaining port vulnerability data includes accessing a vulnerabilities and exposures database.

3 . The computer-implemented method of claim 1 , wherein obtaining port vulnerability data includes performing a port security scan to generate port security data representing a strength of security features associated with the port, the security features including at least one of:

passwords;

hashes; or

ciphers.

4 . The computer-implemented method of claim 1 , wherein obtaining port vulnerability data includes accessing historical intrusion data identifying historical malicious network penetration attempts.

5 . The computer-implemented method of claim 1 , wherein controlling access to the port includes restricting access to the port based on at least one of:

Internet Protocol (IP) addresses;

a set of subnets; or

a geographic location of a device attempting to access the service.

6 . The computer-implemented method of claim 1 , wherein controlling access to the port includes generating a warning signal in the network based on an outcome of the comparing the port vulnerability score with the threshold port vulnerability score.

7 . The computer-implemented method of claim 1 , wherein at least one of the port identification scan and generating the port vulnerability score is performed repeatedly.

8 . The computer-implemented method of claim 7 , wherein the port identification scan and/or generating the port vulnerability score is performed repeatedly based on at least one of:

a periodic interval;

a change to the network; or

a malicious network penetration attempt.

9 . A network edge device for controlling access to services provided by a device attached to a network, the network edge device comprising a processor and storage, the storage comprising computer-executable instructions which, when executed by the processor, cause the network edge device to:

perform a port identification scan on the network to generate port data representing the service provided by the device and the associated port;

obtain port vulnerability data;

generate a port vulnerability score for the port based on the port data and the port vulnerability data, wherein the port vulnerability score is dependent on the service provided by the device, and generating the port vulnerability score for the port includes:

obtaining an initial vulnerability score from a vulnerabilities and exposures database; and

modifying the initial vulnerability score based on one or more characteristics associated with the port;

obtain a threshold port vulnerability score; and

control access to the port in dependence on a comparison of the port vulnerability score with the threshold port vulnerability score,

wherein, in response to determining that the port is vulnerable based on the comparison of the port vulnerability score with the threshold port vulnerability score, controlling access to the port comprises rejecting port forwarding requests from external devices that are outside of the network attempting to access the service on the port while maintaining access to the port and associated service for local devices within the network.

10 . The network edge device of claim 9 , wherein obtaining port vulnerability data includes accessing a vulnerabilities and exposures database.

11 . The network edge device of claim 9 , wherein obtaining port vulnerability data includes performing a port security scan to generate port security data representing a strength of security features associated with the port, the security features including at least one of:

passwords;

hashes; or

ciphers.

12 . The network edge device of claim 9 , wherein obtaining port vulnerability data includes accessing historical intrusion data identifying historical malicious network penetration attempts.

13 . The network edge device of claim 9 , wherein controlling access to the port includes restricting access to the port based on at least one of:

an Internet Protocol (IP) addresses;

a set of subnets; or

a geographic location of a device attempting to access the service.

14 . The network edge device of claim 9 , wherein at least one of the port identification scan and generating the port vulnerability score is performed repeatedly.

15 . The network edge device of claim 14 , wherein the port identification scan and/or generating the port vulnerability score is performed repeatedly based on at least one of:

a periodic interval;

a change to the network; or

a malicious network penetration attempt.

16 . A non-transitory computer-readable storage medium comprising computer-executable instructions which, when executed by at least one processor, cause the process to:

perform a port identification scan on the network to generate port data representing the service provided by the device and the associated port;

obtain port vulnerability data;

generate a port vulnerability score for the port based on the port data and the port vulnerability data, wherein the port vulnerability score is dependent on the service provided by the device, and generating the port vulnerability score for the port includes:

obtaining an initial vulnerability score from a vulnerabilities and exposures database; and

modifying the initial vulnerability score based on one or more characteristics associated with the port;

obtain a threshold port vulnerability score; and

control access to the port in dependence on a comparison of the port vulnerability score with the threshold port vulnerability score,

wherein, in response to determining that the port is vulnerable based on the comparison of the port vulnerability score with the threshold port vulnerability score, controlling access to the port comprises rejecting port forward requests from external devices that are outside of the network attempting to access the service on the port while maintaining access to the port and associated service for local devices within the network.