Secure network communications
Apparatus, systems, and methods may operate to establish a secure communications tunnel between a server node and a client node, and to receive user requests from the client node at the server node via the secure communications tunnel. The user requests may be received in conjunction with a device verification token derived from nonces generated by the server node and transmitted to the client node as part of keep-alive response messages. The nonces may change according to a period of time established by the server node. Additional apparatus, systems, and methods are disclosed.
1. An apparatus, comprising:
a server at a server node for authenticating a user at a client node;
a secure tunnel established by the server node and the user node to transmit user requests in conjunction with a user identification token and a device verification token from a user device at the client node through the secure communications tunnel to the server node, the secure tunnel being established to transmit said user requests following authentication of the user; and
a processor to manage transmission of the user requests, the user identification token and the device verification token, the user identification token being derived from a random number from the server and user identification information of the user, the device verification token identifying the user device and being derived from the user identification token and from nonces generated by the server node as part of keep-alive response messages, the nonces changing according to a period of time established by the server node.
2. The apparatus of claim 1 , further comprising: an encryption module to form the device verification token by encrypting a combination of one of the nonces and the user identification token attributed to an authenticated user associated with the user device coupled to the apparatus.
3. The apparatus of claim 1 , further comprising:
a header manipulator module to append to user requests a header including the user identification token, the device verification token and a tunnel endpoint connection identification.
4. A system, comprising:
a tunneling provider module to establish a secure communications tunnel between a server node and a client node for a user following authentication of the user; and
a processor to receive user requests from the client node via the secure communications tunnel, the user requests received in conjunction with a user identification token of a user of a device at the client node and a device verification token identifying the user device, the device verification token being derived from the user identification token and nonces generated by the processor and transmitted to the client node as part of keep-alive response messages, the nonces changing according to a period of time selected by the processor, the user identification token being derived from a random number from the server node and user identification information of the user.
5. The system of claim 4 , wherein the server node comprises a reverse proxy node to process the user requests.
6. The system of claim 4 , wherein the random number is randomly generated at the server node and transmitted to the client node upon the user requesting authentication and prior to receiving a user request.
7. A computer-implemented method, comprising:
authenticating at a server node a user located at a client node;
establishing to transmit requests of the user following said authenticating a secure communications tunnel between the server node and the client node;
and receiving at the server node user requests from a user device of said user at the client node via the secure communications tunnel, the user requests received in conjunction with a user identification token derived from a random number from the server node and user identification information of the user, and a device verification token identifying the user device and being derived from said user identification information and from nonces generated by the server node and transmitted to the client node as part of keep-alive response messages, the nonces changing according to a period of time established by the server node.
8. The method of claim 7 , further comprising:
prior to the establishing, sending an initial nonce from the server node to the client node when the client node is blocking all ports except a port coupled to the server node.
9. The method of claim 8 , wherein the initial nonce is not encrypted and is used to form the user identification token.
10. The method of claim 7 , further comprising:
receiving an initial user request at a tunneling provider communicatively coupled to the server node, wherein the initial user request comprises a redirected request from a proxy node, said tunneling provider establishing said secure tunnel.
11. The method of claim 10 , wherein the user requests have a header that comprises the device verification token, the user identification token, and a tunnel endpoint connection identification.
12. The method of claim 7 , wherein the device verification token is generated as a hash of one of the nonces and the user identification token of the user.
13. The method of claim 7 , further comprising: verifying, at the server node, that the device verification token includes one of the nonces most recently transmitted to the client node.
14. The method of claim 7 , further comprising:
forwarding the user requests from the server node to a proxy node after content of the device verification token has been verified.
15. The method of claim 7 , wherein the secure communications tunnel comprises a virtual private network tunnel.
16. The method of claim 7 , wherein the user requests are formatted according to a HyperText Transfer Protocol.
17. The method of claim 7 , comprising:
a user request from a device having an incorrect device verification token as part of an attempted communication from a man-in-the-middle.
18. A computer-implemented method, comprising:
authenticating at a server node a user located at a client node;
establishing a secure communications tunnel between the client node and the server node following said authenticating; and
sending user requests from the client node to the server node via the secure communications tunnel, the user requests sent in conjunction with a user identification token derived from a random number from the server node and user identification information of the user and a device verification token identifying a user device of the user, the device verification token being derived from the user identification token and nonces generated by the server node and transmitted to the client node as part of keep-alive response messages, the nonces changing according to a period of time established by the server node.
19. The method of claim 18 , further comprising:
appending the user identification token and the device verification token as part of a header to the user requests.
20. The method of claim 19 , wherein the header further comprises a tunnel endpoint connection identification.
21. The method of claim 18 , further comprising:
generating the device verification token to identify the user device as a hash of one of the nonces and the user identification token of the user.
22. The method of claim 18 , further comprising:
blocking all ports of the client node except a single port to be coupled to the server node; and receiving an initial nonce from the server node at the client node via the single port, the initial nonce being used to form the user identification token.
23. The method of claim 22 , further comprising:
unblocking the ports after the initial nonce is received by the client node and the secure communications tunnel is established, and transmitting all further communications between the client node and the server through the secure communications tunnel.
24. The method of claim 18 , further comprising: receiving the user requests at the client node from a user device associated with an authenticated user.