Topic
Reverse connection
About: Reverse connection is a research topic. Over the lifetime, 956 publications have been published within this topic receiving 22178 citations.
Papers published on a yearly basis
Papers
Patent•
6 Nov 2003
TL;DR: In this paper, the authors proposed a firewall that achieves maximum network security and maximum user convenience by employing envoys that exhibit the security robustness of prior-art proxies and the transparency and ease-of-use of packet filters, combining the best of both worlds.
Abstract: The present invention provides a firewall that achieves maximum network security and maximum user convenience. The firewall employs “envoys” that exhibit the security robustness of prior-art proxies and the transparency and ease-of-use of prior-art packet filters, combining the best of both worlds. No traffic can pass through the firewall unless the firewall has established an envoy for that traffic. Both connection-oriented (e.g., TCP) and connectionless (e.g., UDP-based) services may be handled using envoys. Establishment of an envoy may be subjected to a myriad of tests to “qualify” the user, the requested communication, or both. Therefore, a high level of security may be achieved. The usual added burden of prior-art proxy systems is avoided in such a way as to achieve fall transparency-the user can use standard applications and need not even know of the existence of the firewall. To achieve full transparency, the firewall is configured as two or more sets of virtual hosts. The firewall is, therefore, “multi-homed,” each home being independently configurable. One set of hosts responds to addresses on a first network interface of the firewall. Another set of hosts responds to addresses on a second network interface of the firewall. In one aspect, programmable transparency is achieved by establishing DNS mappings between remote hosts to be accessed through one of the network interfaces and respective virtual hosts on that interface. In another aspect, automatic transparency may be achieved using code for dynamically mapping remote hosts to virtual hosts in accordance with a technique referred to herein as dynamic DNS, or DDNS.
751 citations
Patent•
28 May 1998TL;DR: In this article, a pervasive, multilayer firewall includes a policy definition component that accepts policy data that define how the firewall should behave, and a collection of network devices that are used to enforce the defined policy.
Abstract: A system provides for establishing security in a network (10) that includes nodes having security functions operating in multiple protocol layers. Multiple network devices, such as remote access equipment (13), routers (14), switches (12), repeaters (16) and network cards (15) having security functions are configured to contribute to implementation of distributed firewall functions in the network. By distributing firewall functionality throughout many layers of the network in a variety of network devices, a pervasive firewall is implemented. The pervasive, multilayer firewall includes a policy definition component (11) that accepts policy data that define how the firewall should behave. The multilayer firewall also includes a collection of network devices that are used to enforce the defined policy. The security functions operating in this collection of network devices across multiple protocol layers are coordinated by the policy definition component so that particular devices enforce that part of the policy pertinent to their part of the network.
633 citations
Patent•
19 Oct 1998
TL;DR: In this paper, the authors propose a firewall for isolating network elements from a publicly accessible network to which such network elements are attached by assigning a variety of proxy agents that are specifically assigned to an incoming request in accordance with the service protocol (i.e., port number) indicated in the incoming access request.
Abstract: Providing a firewall for isolating network elements from a publicly accessible network to which such network elements are attached. The firewall operates on a stand alone computer connected between the public network and the network elements to be protected such that all access to the protected network elements must go through the firewall. The firewall application running on the stand alone computer is preferably the only application running on that machine. The application includes a variety of proxy agents that are specifically assigned to an incoming request in accordance with the service protocol (i.e., port number) indicated in the incoming access request. An assigned proxy agent verifies the authority of an incoming request to access a network element indicated in the request. Once verified, the proxy agent completes the connection to the protected network element on behalf of the source of the incoming request.
508 citations
Patent•
10 Jun 1994
TL;DR: In this article, a first data processing device (node I) coupled to a first private network and to a firewall server (FWA) is presented, where the data packet is then encapsulated in a transmission packet by the firewall FWA.
Abstract: The present invention includes a first data processing device (node I) coupled to a first private network and to a firewall server (FWA). Firewall server FWA is in turn coupled to a public network, such as the Internet. A second data processing device (node J) is coupled to a second private network which is coupled to the Internet through a firewall server (FWB). Node I provides a data packet including IP data and a destination address for the intended receiving node J to firewall FWA. Firewall FWA is provided with a secret value a, and a public value ∝a mod p. Similarly, firewall FWB is provided with a secret value b and a public value ∝b mod p. The firewall FWA obtains a Diffie-Hellman (DH) certificate for firewall FWB and determines the public value ∝b mod p from the DH certificate. Firewall FWA then computes the value of ∝ab mod p, and derives a key Kab from the value ∝ab mod p. A transient key Kp is randomly generated and is used to encrypt the data packet to be transmitted by firewall FWA to firewall FWB. The encrypted data packet is then encapsulated in a transmission packet by the firewall FWA. The transmission packet includes an unencrypted destination address for the firewall FWB. Firewall FWA then sends the transmission packet to firewall FWB over the Internet. Upon receipt of the transmission packet from firewall FWA, firewall FWB obtains a DH certificate for firewall FWA, and determines the public value of ∝a mod p from the DH certificate. Firewall FWB computes the value of ∝ab mod p, and derives the key Kab. Firewall B utilizes the key Kab to decrypt the transient key Kp, and using the decrypted transient key Kp, firewall FWB decrypts the encrypted data packet received from FWA, thereby resulting in the recovery of the original data sent by node I in unencrypted form to the firewall FWA. The firewall FWB then transmits the decrypted data packet to the receiving node J over the second private network.
419 citations
Patent•
IBM1
TL;DR: A lightweight secure tunneling protocol (LSTP) as mentioned in this paper uses three proxies to establish an end-to-end connection that navigates through the firewalls in a typical configuration, where a server is behind a first firewall and a client behind a second firewall are interconnected by an untrusted network.
Abstract: A lightweight secure tunneling protocol or LSTP permits communicating across one or more firewalls by using a middle server or proxy. Three proxies are used to establish an end-to-end connection that navigates through the firewalls. In a typical configuration, a server is behind a first firewall and a client behind a second firewall are interconnected by an untrusted network (e.g., the Internet) between the firewalls. A first inside firewall SOCKS-aware server-side end proxy connects to the server inside the first firewall. A second inside firewall SOCKS-aware client-side end proxy is connected to by the client inside the second firewall. Both server-side and client-side end proxies can address a third proxy (called a middle proxy) outside the two firewalls. The middle proxy is usually started first, as the other two end proxies (server and client) will initiate the connection to the middle proxy some time after they are started. Since the middle proxy is mutually addressable by both inside proxies, a complete end-to-end connection between the server and client is established. It is the use of one or more middle proxies together with the LSTP that establishes the secure communications link or tunnel across multiple firewalls.
299 citations
Related Topics (5)
Performance Metrics
| Year | Papers |
|---|---|
| 2021 | 3 |
| 2020 | 13 |
| 2019 | 21 |
| 2018 | 25 |
| 2017 | 39 |
| 2016 | 38 |