Concealing internal applications that are accessed over a network
Examples herein describe systems and methods for concealing internal applications that are accessed over the internet. A user device can select a remote internal application to access using a client. The user device can send an access request to an open listening port of an access server. The access server can be a gateway and proxy to the internal application, which can reside elsewhere. The access server can open a different randomized access port for establishing the connection by proxy to the internal application. The port number for the access port can be identified in the access request at the listening port. The access server can open the access port for a short time interval. The connection can be made through the access port during that time interval. A firewall can then close the access port but maintain an established connection between the user device and the internal application.
1. A method for accessing hidden internal applications over a network, comprising:
receiving an access request at an access server, the access request being received at a listening port from a user device;
based on validating the access request, opening for a time interval an access port in a firewall for accessing an internal application, the access port being randomized and the time interval being less than 15 seconds, the access port being different than the listening port and unknown to the user device prior to randomization;
establishing a connection between the user device and the internal application based on communication through the open access port during the time interval; and
closing the access port while allowing the established connection to persist.
2. The method of claim 1 , wherein the access request includes a single packet authorization (“SPA”), the SPA being used to determine whether the user device is authorized to access the internal application.
3. The method of claim 1 , wherein the access request includes a destination internet protocol (“IP”) address based on which application is selected for access at the user device, wherein an agent on the user device sends the access request after determining that the user device is in compliance with an enterprise mobility management (“EMM”) policy.
4. The method of claim 3 , wherein a filter driver on the user device looks up the IP address in a table of allowed IP addresses prior to the user device sending the access request.
5. The method of claim 1 , wherein the access request identifies a random port number to use for the access port.
6. The method of claim 1 , wherein the user device executes an agent that sends the access request, and wherein the agent checks a selected application against a whitelist of allowed applications before sending the access request.
7. The method of claim 1 , wherein the access server sends no response to the user device based on receiving the access request at the listening port.
8. A non-transitory, computer-readable medium comprising instructions that, when executed by a processor, cause the processor to perform stages for accessing hidden internal applications over a network, the stages comprising:
receiving an access request at an access server, the access request being received at a listening port from a user device;
based on validating the access request, opening for a time interval an access port in a firewall for accessing an internal application, the access port being randomized and the time interval being less than 15 seconds, the access port being different than the listening port and unknown to the user device prior to randomization;
establishing a connection between the user device and the internal application based on communication through the open access port during the time interval; and
closing the access port while allowing the established connection to persist.
9. The non-transitory, computer-readable medium of claim 8 , wherein the access request includes a single packet authorization (“SPA”), the SPA being used to determine whether the user device is authorized to access the internal application.
10. The non-transitory, computer-readable medium of claim 8 , wherein the access request includes a destination internet protocol (“IP”) address based on which application is selected for access at the user device, wherein an agent on the user device sends the access request after determining that the user device is in compliance with an enterprise mobility management (“EMM”) policy.
11. The non-transitory, computer-readable medium of claim 10 , wherein a filter driver on the user device looks up the IP address in a table of allowed IP addresses prior to the user device sending the access request.
12. The non-transitory, computer-readable medium of claim 8 , wherein the access request identifies a random port number to use for the access port.
13. The non-transitory, computer-readable medium of claim 8 , wherein the user device executes an agent that sends the access request, and wherein the agent checks a selected application against a whitelist of allowed applications before sending the access request.
14. The non-transitory, computer-readable medium of claim 8 , wherein the access server sends no response to the user device based on receiving the access request at the listening port.
15. A system for accessing hidden internal applications over a network, comprising:
a non-transitory, computer-readable medium containing instructions; and
a processor that executes the instructions perform stages comprising:
receiving an access request at an access server, the access request being sent to a listening port from a user device;
based on validating the access request, opening for a time interval an access port in a firewall for accessing an internal application, the access port being randomized and the time interval being less than 15 seconds, the access port being different than the listening port and unknown to the user device prior to randomization;
establishing a connection between the user device and the internal application based on communication through the open access port during the time interval; and
closing the access port while allowing the established connection to persist.
16. The system of claim 15 , wherein the access request includes a single packet authorization (“SPA”), the SPA being used to determine whether the user device is authorized to access the internal application.
17. The system of claim 15 , wherein the access request includes a destination internet protocol (“IP”) address based on which application is selected for access at the user device, wherein an agent on the user device sends the access request after determining that the user device is in compliance with an enterprise mobility management (“EMM”) policy.
18. The system of claim 15 , wherein the access request identifies a random port number to use for the access port.
19. The system of claim 15 , wherein the user device executes an agent that sends the access request, and wherein the agent checks a selected application against a whitelist of allowed applications before sending the access request.
20. The system of claim 15 , wherein the access server sends no response to the user device based on receiving the access request at the listening port.