Reverse authorized SYN cookie

1. A method of providing a service on a network, the method comprising:

receiving a transmission control protocol (TCP) synchronize (SYN) packet from a client directed to an internet protocol (IP) address and port number derived from at least a one-time datum associated with the client;

confirming that the TCP SYN packet is addressed to an authorized IP address and port number;

sending a TCP synchronize-acknowledgement (SYN-ACK) packet to the client;

receiving a TCP acknowledge (ACK) from the client;

receiving a data packet from the client, the data packet comprising a client ID and the one-time datum;

generating a calculated one-time datum based at least on the client ID;

verifying that the one-time datum corresponds to the calculated one-time datum; and

establishing a TCP/IP connection with the client in response to the verifying.

2. The method of claim 1 , further comprising not storing any record of the receiving the TCP SYN packet from the client.

3. The method of claim 1 , further comprising not establishing a SYN-RECEIVED state for a connection with the client.

4. The method of claim 1 , further comprising not storing any record of the sending the TCP SYN-ACK packet to the client.

5. The method of claim 1 , further comprising not generating a data structure for data representing half-open connections with clients.

6. The method of claim 1 , further comprising registering a plurality of clients to provide each of the plurality of clients with a password unique to each client.

7. The method of claim 6 , wherein the registering further comprises providing each of the plurality of clients with a user ID.

8. The method of claim 1 , wherein the one-time datum is derived from a time and a hash function applied to at least a password for the client.

9. The method of claim 1 , wherein the IP address and port number are derived as a function of a predefined range of IP and port numbers and the one-time datum.

10. The method of claim 1 , wherein the confirming comprises confirming that the IP address and port number are among a set of periodically changing IP addresses and port number pairs, each IP address and port number pair specific to a single client.

11. The method of claim 10 , wherein each IP address and port number in the set of periodically changing IP addresses and port numbers changes at least every 30 seconds.

12. The method of claim 1 , wherein the generating comprises:

obtaining a password for the client based on the client ID;

obtaining a time associated with the TCP SYN packet;

calculating the calculated one-time datum as a function of at least the time associated with the TCP SYN packet and the password for the client.

13. A system for providing a service on a network, the system comprising:

at least one server comprising computer hardware configured to receive a transmission control protocol (TCP) synchronize (SYN) packet from a client directed to an internet protocol (IP) address and port number derived from at least a one-time datum associated with the client;

at least one hardware processor configured to confirm that the TCP SYN packet is addressed to an authorized IP address and port number;

at least one server comprising computer hardware configured to send a TCP synchronize-acknowledgement (SYN-ACK) packet to the client;

at least one server comprising computer hardware configured to receive a TCP acknowledge (ACK) from the client;

at least one server comprising computer hardware configured to receive a data packet from the client, the data packet comprising a client ID and the one-time datum;

at least one hardware processor configured to generate a calculated one-time datum based at least on the client ID;

at least one hardware processor configured to verify that the one-time datum corresponds to the calculated one-time datum; and

a server comprising computer hardware configured to establish a TCP/IP connection with the client.

14. The system of claim 13 , wherein the system does not store any record of receiving the TCP SYN packet from the client.

15. The system of claim 13 , wherein the system lacks a memory storing a SYN-RECEIVED state for a connection with the client.

16. The system of claim 13 , wherein the system does not store any record of sending the TCP SYN-ACK packet to the client.

17. The system of claim 13 , wherein the system lacks a data structure for data representing half-open connections with clients.

18. The system of claim 13 , further comprising a server configured to register a plurality of clients and to provide each of the plurality of clients with a password unique to each client.

19. The system of claim 18 , wherein the server configured to register is further configured to provide each of the plurality of clients with a user ID.

20. The system of claim 13 , wherein the one-time datum is derived from a time and a hash function applied to at least a password for the client.

21. The system of claim 13 , wherein the IP address and port number are derived as a function of a predefined range of IP and port numbers and the one-time datum.

22. The system of claim 13 , wherein the at least one hardware processor configured to confirm is further configured to confirm that the IP address and port number are among a set of periodically changing IP addresses and port number pairs, each IP address and port number pair specific to a single client.

23. The system of claim 22 , wherein each IP address and port number in the set of periodically changing IP addresses and port numbers changes at least every 30 seconds.

24. The system of claim 13 , wherein the at least one hardware processor configured to generate is further configured to:

obtain a password for the client based on the client ID;

obtain a time associated with the TCP SYN packet;

calculate the calculated one-time datum as a function of at least the time associated with the TCP SYN packet and the password for the client.