Secure network communication system and method
A secure network communication system and method for secure data exchange using TCP are disclosed. The system provides data exchange between a client and server, through an agent and broker interconnected to exchange data over an unsecured network. Upon receipt of a control packet from the client, the broker forwards a modified control packet to the agent using a secure protocol. The agent inspects the modified control packet and forwards it to the server. Upon receipt of a response packet from the server, the agent forwards the response packet to the broker using a secure protocol. Upon receipt of the response packet, the agent modifies the response packet and forwards it to the client. If the exchange of control packets indicates establishment of a TCP session, the agent and the broker establish a data channel between themselves to create a transparent TCP channel between the client and the server.
1 . A data transmission system for secure data exchange using transmission control protocol between a client and a server, comprising:
an agent computing device connected to the server, and a broker computing device connected to the client, wherein at least one of the agent computing device and the broker computing device comprise computer program code executed by a hardware processor, wherein:
the agent computing device is configured to initiate a secure control session with the broker computing device;
the broker computing device is configured to receive a control packet from the client and, in response, to generate and send a modified version of the control packet to the agent computing device using the secure control session;
the agent computing device is configured to receive the modified version of the control packet and, in response, to initiate a control connection with the server;
the agent computing device is configured to respond to establishment of the control connection with the server to initiate a secure data session with the broker computing device; and
the broker computing device is configured to respond to initiation of the secure data session to send a response to the control packet from the client such that a data connection is established between the client and the broker computing device;
wherein the secure control session is established from a direction of the server towards the client, and the control packet to establish the data connection is sent from the direction of the client towards the server.
2 . The data transmission system as described in claim 1 wherein the agent computing device and the broker computing device are coupled to one another over an unsecured network link.
3 . The data transmission system as described in claim 1 wherein the agent computing device and the client are coupled to one another over a secure link.
4 . The data transmission system as described in claim 1 wherein the broker computing device and the server are coupled to one another over a secure link.
5 . The data transmission system of claim 1 wherein initiating the control connection with the server comprises generating a new control packet and sending the new control packet to the server.
6 . The data transmission system of claim 5 wherein the new control packet is a Transport Control Protocol Synchronize (TCP SYN) packet.
7 . The data transmission system of claim 5 wherein the control packet, the modified version of the control packet, and the new control packet are Transport Control Protocol Synchronize (TCP SYN) packets.
8 . The data transmission system of claim 1 wherein the secure data session between the agent computing device and the broker computing device occurs via at least one of: a firewall, a proxy, and a Network Address Translation (NAT) device.