Concealing internal applications that are accessed over a network
Examples herein describe systems and methods for concealing internal applications that are accessed over the internet. A user device can select a remote internal application to access using a client. The user device can send an access request to an open listening port of an access server. The access server can be a gateway and proxy to the internal application, which can reside elsewhere. The access server can open a different randomized access port for establishing the connection by proxy to the internal application. The port number for the access port can be identified in the access request at the listening port. The access server can open the access port for a short time interval. The connection can be made through the access port during that time interval. A firewall can then close the access port but maintain an established connection between the user device and the internal application.
1. A method for accessing hidden internal applications over a network, comprising:
receiving an access request at an access server for accessing an internal application, the access request being received at a listening port from a user device, wherein the access request includes a random number generated by the user device, and wherein the access request is received after determining that the user device is in compliance with an enterprise mobility management (“EMM”) policy;
in response to validating the access request, opening fora time interval an access port in a firewall for accessing the internal application, wherein the access port is selected based on the random number and is different than the listening port;
establishing a connection between the user device and the internal application based on communication through the open access port during the time interval; and
closing the access port while allowing the established connection to persist.
2. The method of claim 1 , further comprising validating the access request prior to opening the access port, wherein the access port is unknown to the user device prior to generation of the random number.
3. The method of claim 1 , wherein the access port closes after a time interval.
4. The method of claim 1 , wherein the access request includes a single packet authorization (“SPA”), the SPA being used to determine whether the user device is authorized to access the internal application.
5. The method of claim 1 , wherein the access request includes a destination internet protocol (“IP”) address based on which application is selected for access at the user device, wherein an agent on the user device sends the access request after determining that the user device is in compliance with the enterprise mobility management (“EMM”) policy.
6. The method of claim 5 , wherein the access request is sent to a port determined by a filter driver on the user device, wherein the filter driver looks up the IP address in a table of allowed IP addresses prior to the user device sending the access request.
7. The method of claim 1 , wherein the access request is received from an agent that executes on the user device, wherein the agent generates the random number and checks a selected application against a whitelist of allowed applications before sending the access request.
8. A non-transitory, computer-readable medium comprising instructions that, when executed by a processor, cause the processor to perform stages for accessing hidden receiving an access request at an access server for accessing an internal application, the access request being received at a listening port from a user device, wherein the access request includes a random number generated by the user device, and wherein the access request is received after determining that the user device is in compliance with an enterprise mobility management (“EMM”) policy;
in response to validating the access request, opening fora time interval an access port in a firewall for accessing the internal application, wherein the access port is selected based on the random number and is different than the listening port;
establishing a connection between the user device and the internal application based on communication through the open access port during the time interval; and
closing the access port while allowing the established connection to persist.
9. The non-transitory, computer-readable medium of claim 8 , the stages further comprising validating the access request prior to opening the access port, wherein the access port is unknown to the user device prior to generation of the random number.
10. The non-transitory, computer-readable medium of claim 8 , wherein the access port closes after a time interval.
11. The non-transitory, computer-readable medium of claim 8 , wherein the access request includes a single packet authorization (“SPA”), the SPA being used to determine whether the user device is authorized to access the internal application.
12. The non-transitory, computer-readable medium of claim 8 , wherein the access request includes a destination internet protocol (“IP”) address based on which application is selected for access at the user device, wherein an agent on the user device sends the access request after determining that the user device is in compliance with the enterprise mobility management (“EMM”) policy.
13. The non-transitory, computer-readable medium of claim 12 , wherein the access request is sent to a port determined by a filter driver on the user device, wherein the filter driver looks up the IP address in a table of allowed IP addresses prior to the user device sending the access request.
14. The non-transitory, computer-readable medium of claim 8 , wherein the access request is received from an agent that executes on the user device, wherein the agent generates the random number and checks a selected application against a whitelist of allowed applications before sending the access request.
15. A system for accessing hidden internal applications over a network, comprising:
a non-transitory, computer-readable medium containing instructions; and
a processor that executes the instructions to perform stages comprising: receiving an access request at an access server for accessing an internal application, the access request being received at a listening port from a user device, wherein the access request includes a random number generated by the user device, and wherein the access request is received after determining that the user device is in compliance with an enterprise mobility management (“EMM”) policy;
in response to validating the access request, opening fora time interval an access port in a firewall for accessing the internal application, wherein the access port is selected based on the random number and is different than the listening port;
establishing a connection between the user device and the internal application based on communication through the open access port during the time interval; and
closing the access port while allowing the established connection to persist.
16. The system of claim 15 , the stages further comprising validating the access request prior to opening the access port, wherein the access port is unknown to the user device prior to generation of the random number.
17. The system of claim 15 , wherein the access port closes after a time interval.
18. The system of claim 15 , wherein the access request includes a single packet authorization (“SPA”), the SPA being used to determine whether the user device is authorized to access the internal application.
19. The system of claim 15 , wherein the access request includes a destination internet protocol (“IP”) address based on which application is selected for access at the user device, wherein an agent on the user device sends the access request after determining that the user device is in compliance with the enterprise mobility management (“EMM”) policy.
20. The system of claim 19 , wherein the access request is sent to a port determined by a filter driver on the user device, wherein the filter driver looks up the IP address in a table of allowed IP addresses prior to the user device sending the access request.