Method for first packet authentication
In a preferred embodiment of the invention, a network client ( 42 ) inserts an authorization key ( 38 ) into the SEQ ( 30 ) and ACK ( 32 ) fields of a TCP connection request ( 56 ). The TCP connection request ( 56 ) is sent to a authorizing server ( 46 ). The authorizing server ( 46 ) extracts the authorization key ( 38 ) and uses the authorization key ( 38 ), with other implicit and explicit data contained within the TCP connection request ( 56 ) to authorize the TCP connection request ( 56 ). If the TCP connection request ( 56 ) is authorized, the authorizing server ( 46 ) sends a TCP-SYN/ACK ( 58 ) back to the network client ( 42 ) as described in the TCP protocol specification. If the TCP connection request ( 56 ) is denied, the TCP connection request ( 56 ) is discarded and nothing is sent back to the network client ( 42 ).
1. A method comprising the steps of:
creating an authorization key ( 37 ) at a first network connected device;
inserting said authorization key ( 37 ) into a TCP header ( 24 ) of a TCP SYN ( 56 );
sending a packet ( 39 ) including said TCP SYN ( 56 ) to a second network connected device ( 46 );
receiving said packet ( 39 ) at said second network connected device ( 46 );
said packet ( 39 ) including a TCP header ( 24 ) containing a TCP connection request SYN ( 56 );
said packet ( 39 ) including an IP header ( 18 ) and a TCP header ( 24 );
said IP header ( 18 ) and said TCP header ( 24 ) including a field ( 19 );
said inserted authorization key ( 37 ) being extracted from said field ( 19 );
said TCP header ( 24 ) including a SEQ field ( 30 ) and an ACK field ( 32 );
said inserted authorization key ( 38 ) being extracted from said SEQ field ( 30 ) and said ACK field ( 32 );
extracting said previously inserted authorization key ( 37 ) from said TCP header ( 24 );
authorizing said TCP connection request SYN ( 56 );
using said inserted authorization key ( 37 ) and associated data;
determining if said authorization is successful; and
responding to said TCP connection request SYN ( 56 ) based on said determination of authorization success.
2. A method as recited in claim 1 , in which:
said associated data includes a received IP source address ( 20 ).
3. A method as recited in claim 1 , in which:
said associated data includes a received IP destination address ( 22 ).
4. A method as recited in claim 1 , in which:
said associated data includes a received TCP source port ( 26 ).
5. A method as recited in claim 1 , in which:
said associated data includes a received TCP destination port ( 28 ).
6. A method as recited in claim 1 , in which:
said associated data includes a time ( 64 ) when said TCP connection request SYN ( 56 ) was received.
7. A method as recited in claim 1 , in which:
said associated data includes a physical port upon which said TCP connection request SYN ( 56 ) was received.
8. A method as recited in claim 1 , in which:
said authorization is performed by a receiving server ( 46 ).
9. A method as recited in claim 1 , in which:
said authorization is performed by an intervening network device ( 48 ).
10. A method as recited in claim 1 , further comprising the additional steps of:
determining that said authorization has failed; and
discarding said TCP connection request SYN ( 56 ).
11. A method as recited in claim 1 , further comprising the additional steps of:
determining that said authorization has succeeded; and
sending a TCP-SYN/ACK ( 58 ) to the sender of said TCP connection request SYN ( 56 ).
12. A method as recited in claim 1 , further comprising the additional steps of:
determining that said authorization has succeeded; and
forwarding said TCP connection request SYN ( 56 ) towards a destination.
13. A method as recited in claim 1 , in which:
the extraction of said inserted authorization key ( 37 ) from said TCP header ( 24 ) does not affect the customary function of said TCP header ( 24 ).
14. A method as recited in claim 1 , in which:
the extraction of said inserted authorization key ( 37 ) from said TCP header ( 24 ) does not require any optional fields ( 19 ) in said TCP ( 24 ) header.
15. A method as recited in claim 1 , in which:
the extraction of said inserted authorization key ( 37 ) from said TCP header ( 24 ) does not require any modification of said TCP ( 24 ) header.
16. A method as recited in claim 1 , in which:
said authorization key ( 37 ) is inserted into said plurality of fields ( 19 ) normally present in the TCP header ( 24 ).
17. A method as recited in claim 1 , in which:
said authorization key ( 37 ) is inserted into a SEQ field ( 30 ) and an ACK field ( 32 ) of said TCP header ( 24 ).
18. A method as recited in claim 1 , in which:
said authorization key ( 37 ) is inserted by a network device performing ( 42 ) said TCP SYN ( 56 ).
19. A method as recited in claim 1 , in which:
said authorization key ( 37 ) is inserted by an intervening network device ( 44 ).
20. A method as recited in claim 1 , in which:
the insertion of said authorization key ( 37 ) into said TCP ( 24 ) header does not affect the customary functions of said TCP header ( 24 ).
21. A method as recited in claim 1 , in which:
the insertion of said authorization key ( 37 ) into said TCP header ( 24 ) does not require any optional fields ( 19 ) in said TCP ( 24 ) header.
22. A method as recited in claim 1 , in which:
the insertion of said authorization key ( 37 ) into said TCP header ( 24 ) does not require any modification of said TCP ( 24 ) header.
23. A method comprising the steps of:
creating an authorization key ( 37 ) at a first network connected device;
inserting said authorization key ( 37 ) into a TCP header ( 24 ) of a TCP SYN ( 56 );
sending a packet ( 39 ) including said TCP SYN ( 56 ) to a second network connected device;
receiving said TCP SYN ( 56 ) at a second network connected device ( 46 );
requiring authorization of said TCP SYN ( 56 ); and
said authorization utilizing an inserted authorization key ( 37 ) extracted from said TCP SYN ( 56 ).
24. A method as recited in claim 23 , in which:
the chance of guessing said inserted authorization key ( 37 ) is reduced from the present level which has no authorization key.
25. A method as recited in claim 23 in which:
said second network connected device ( 46 ) remains concealed in the presence of said unauthorized TCP SYN ( 56 ).