Patent ID: 8245298
Filing Date: 2012-08-14
Classification: H04L

Abstract:
1. A port scanning method comprising: creating an authentication bit sequence as an output of an authentication transformation, the authentication transformation having as input at least a given destination address and a given secret key; adding error correction bits to the authentication bit sequence dependent on a given error code transformation comprising a Reed-Solomon-Code transformation and having as input the authentication bit sequence; embedding the authentication bit sequence in at least one authentication port scan event packet comprising the given destination address, the authentication port scan event packet being a TCP SYN-packet; embedding the authentication bit sequence in a destination port field and/or in a source port field and/or in an IP-options field of the authentication port scan event packet; broadcasting the at least one authentication port scan event packet; broadcasting further port scan event packets with given port identifiers and the given destination address; broadcasting the at least one authentication port scan event packet and/or the further port scan event packets with an inter-packet time duration, being characteristic for the time between two consecutive broadcasts of consecutive port scan event packets and being greater than a given minimum inter-packet time duration chosen in order to not exceed a CPU load of the destination by substantially 10% of the maximum CPU load, when processing the port scan event packets; deriving a received authentication bit sequence from at least one received authentication port scan event packet with identical source addresses, the at least one received authentication port scan event packet comprising a received destination address, the received authentication port scan event packet being a TCP SYN-packet; extracting the received authentication bit sequence from a destination port field and/or a source port field and/or an IP-options field of the received authentication port scan event packet; adding error correction bits to the received authentication bit sequence dependent on a given error code transformation including a Reed-Solomon-Code transformation and having as input the received authentication bit sequence; creating a reference authentication bit sequence as an output of an authentication transformation having as input at least the given received destination address and the secret key; determining dependent on the received authentication bit sequence, the received destination address and the reference authentication bit sequence whether an authentication is given, wherein determining whether the authentication is given is further dependent on a further input including at least part of at least one of the received authentication port scan event packets other than the given received destination address, a source address, a nonce derived from a current time, a time stamp, and a key number identifying the secret key; accepting further received port scan event packets with given port identifiers and the given received destination address, if the authentication is given; denying further received port scan event packets with given port identifiers and the given received destination address or initiating an alarm action, if the authentication is not given; and denying the authentication, if the at least one received authentication port scan event packet and/or the further received port scan event packets are received with an inter-packet time duration, being characteristic for the time between two consecutive broadcasts of consecutive received port scan event packets and being smaller than or equal to a given minimum inter-packet time duration chosen not to exceed a CPU load of the destination by approximately 10% of the maximum CPU load, when processing the received port scan event packets; wherein the authentication transformation used to create the authentication bit sequence has as further input at least part of at least one of the authentication port scan event packets other than the destination address input to the authentication transformation used to create the authentication bit sequence, a source address, a nonce derived from a current time, a time stamp, and a key number identifying the given secret key.