Abstract:
A system for and method of securing a network are described herein. A receiving device listens for packets with proper credentials. If a transmitting device sends the correct credentials, the receiving device will respond with an acknowledgment and further data is able to be transmitted. However, if the transmitting device does not send a packet with the proper credentials, then the receiving device will drop the packet and not respond. Thus, the transmitting device will be unaware of the presence of the receiving device, in particular when hackers are using scanning software to locate target devices.

Description:
FIELD OF THE INVENTION 
       [0001]    The present invention relates to the field of networking. More specifically, the present invention relates to the field of providing security to a network. 
       BACKGROUND OF THE INVENTION 
       [0002]    Transmission Control Protocol (TCP) allows applications on networked computers to generate connections to each other. Over these connections, the applications are then able to exchange data packets. Many applications such as the world wide web and email utilize TCP. TCP is reliable and guarantees in-order delivery of data. 
         [0003]    Applications send streams of 8-bit bytes to TCP to be delivered through the network. TCP divides the byte stream into appropriately sized segments and then passes the resulting packets to the Internet Protocol (IP) for delivery through the network to a TCP module of a target computer on the network. TCP ensures that no packets are lost by assigning a sequence number to each packet. This sequence number also ensures the packets are delivered in the correct order. The TCP module of the target computer sends back an acknowledgment for packets which have been successfully received. If an acknowledgment is not received within a reasonable amount of time, a timeout is triggered on the transmitting computer. Then, the data packet is re-sent. 
         [0004]    As briefly described above, a 3-way handshake is implemented to establish a TCP connection. The transmitting computer first sends a synchronization packet to initiate the connection. Then the target computer sends an acknowledgment packet back. Finally, the transmitting computer sends an acknowledgment back to the target. By utilizing a 3-way handshake, computers are able to verify their connection. 
         [0005]    The concern with TCP is that hackers are able to utilize this 3-way handshake to locate future victims to be hacked. Using scanning software, a set of packets are sent out across the network. Any clients on the network will respond to these packets. Then, hackers are able to determine which computers are accessible on the network and which ports are open on those computers. Using that information, a hacker is able to abuse the computer by crashing it or performing other malicious activity with it such as stealing data. 
         [0006]    User Datagram Protocol (UDP) is a connectionless protocol that allows applications on networked computers to send short messages known as datagrams to each other. Unlike TCP, UDP does not provide guaranteed reliability. Datagrams are able to arrive disordered or get lost without notice. The reason for this is that UDP does not utilize the 3-way handshake of TCP where a target computer acknowledges that it is present when an unknown transmitting computer sends an initiating connection. However, as mentioned above, UDP has a number of drawbacks including being unreliable, not ordered, and other issues that make UDP insufficient for a specified purpose. 
       SUMMARY OF THE INVENTION 
       [0007]    A system for and method of securing a network are described herein. A receiving device listens for packets with proper credentials. If a transmitting device sends the correct credentials, the receiving device will respond with an acknowledgment and further data is able to be transmitted. However, if the transmitting device does not send a packet with the proper credentials, then the receiving device will drop the packet and not respond. Thus, the transmitting device will be unaware of the presence of the receiving device, in particular when hackers are using scanning software to locate target devices. 
         [0008]    In one aspect, a method of increasing network security comprises transmitting a packet from a first device to a second device, receiving a packet at the second device from the first device, verifying the packet for proper credentials and sending an acknowledgment from the second device to the first device only if the proper credentials are verified. The first device is a client and the second device is a server. Alternatively, the first device is a server and the second device is a client. The method further comprises dropping the packet if the proper credentials are not verified. A protocol for receiving the packet is similar to or the same as User Datagram Protocol. A protocol for sending an acknowledgment is similar to or the same as Transmission Control Protocol. The first device and the second device are coupled by a network. In one embodiment, the network is the Internet. In another embodiment, the network is an intranet. 
         [0009]    In another aspect, a method of increasing network security comprises transmitting a packet from a first device to a second device, receiving a packet at the second device from the first device, verifying the packet for proper credentials, sending an acknowledgment from the second device to the first device only if the proper credentials are verified and dropping the packet if the proper credentials are not verified. The first device is a client and the second device is a server. Alternatively, the first device is a server and the second device is a client. A protocol for receiving the packet is similar to or the same as User Datagram Protocol. A protocol for sending an acknowledgment is similar to or the same as Transmission Control Protocol. The first device and the second device are coupled by a network. In one embodiment, the network is the Internet. In another embodiment, the network is an intranet. 
         [0010]    In yet another aspect, a system for increasing network security comprises one or more first devices for transmitting a packet, one or more second devices for receiving the packet, wherein the one or more second devices are coupled to the one or more first devices through a network and a set of credentials within the packet for verification, wherein the one or more second devices send an acknowledgment back to the one or more first devices only if the set of credentials are verified. The first device is a client and the second device is a server. Alternatively, the first device is a server and the second device is a client. The one or more second devices drop the packet if the set of credentials are not verified. A protocol for receiving the packet is similar to or the same as User Datagram Protocol. A protocol for sending an acknowledgment is similar to or the same as Transmission Control Protocol. In one embodiment, the network is the Internet. In another embodiment, the network is an intranet. 
         [0011]    In another aspect, a network of devices for increasing network security comprises one or more client devices for transmitting a packet, one or more server devices for receiving the packet, wherein the one or more server devices are coupled to the one or more client devices through a network and a set of credentials within the packet for verification, wherein the one or more server devices send an acknowledgment back to the one or more client devices only if the set of credentials are verified. The one or more server devices drop the packet if the set of credentials are not verified. A protocol for receiving the packet is similar to or the same as User Datagram Protocol. A protocol for sending an acknowledgment is similar to or the same as Transmission Control Protocol. In one embodiment, the network is the Internet. In another embodiment, the network is an intranet. 
         [0012]    In yet another aspect, a packet for increasing network security comprises data and a set of credentials, wherein the set of credentials are analyzed by a receiving device such that the receiving device sends an acknowledgment back only if the set of credentials are valid. The set of credentials are selected from the group consisting of a key, a code and a signature. The set of credentials are stored within a header. Alternatively, the set of credentials are stored within a wrapper. The set of credentials are encrypted. The packet is substantially similar to a User Datagram Protocol packet. 
     
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0013]      FIG. 1  illustrates a block diagram of the preferred embodiment of the present invention. 
           [0014]      FIG. 2  illustrates a flow chart of the preferred embodiment of the present invention. 
           [0015]      FIG. 3  illustrates a network of devices implementing the preferred embodiment of the present invention. 
           [0016]      FIG. 4A  illustrates a User Datagram Protocol packet. 
           [0017]      FIG. 4B  illustrates a User Datagram Protocol packet within a wrapper. 
       
    
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT 
       [0018]    The present invention overcomes the issues described above by using a combination of elements of User Datagram Protocol (UDP) and Transmission Control Protocol (TCP) in addition to modifications of each. Using these modifications, a connection is established by only those properly authenticated devices. Furthermore, a target device remains hidden and anonymous to those devices that are not properly authenticated. 
         [0019]      FIG. 1  illustrates a block diagram of the preferred embodiment of the present invention. A system  100  for securely networking devices includes one or more first devices  102  and one or more second devices  104 . A device of the one or more first devices  102  sends a packet  106  with credentials to a device of the one or more second devices  104  over a network  108 . The packet is sent using a protocol  110  such as UDP or a similar protocol. The device of the one or more second devices  104  is listening to the specified protocol. If a packet  106 ′ does not have the correct credentials then the packet  106 ′ is dropped and no response is sent from the device of the one or more second devices  104 . If the credentials are validly verified, then an acknowledgment  114  is sent from the device of the one or more second devices  104  over the network  108  to the device of the one or more first devices  102 . The acknowledgment  114  is sent over a protocol  112  such as TCP, UDP or a similar protocol. After the initial connection is established, data is communicated between the devices. 
         [0020]      FIG. 2  illustrates a flow chart of the preferred embodiment of the present invention. In the step  200 , a device of the one or more first devices  102  transmits a packet  106  to a device of the one or more second devices  104 . In the step  202 , the device of the one or more second devices  104  receives the packet  106 . In the step  204 , the device  106  of the one or more second devices  104  determines if the packet  106  has the proper credentials. Proper credentials are able to be included as a specific key, code, signature or other appropriate verification device. Furthermore, the credentials are stored in a header, wrapper or other location to accompany the packet. In some embodiments, the set of credentials are encrypted. If the packet  106  does not have the proper credentials, the packet  106  is dropped and no acknowledgment is sent back to the device of the one or more first devices  102 , in the step  206 . If the packet  106  does have the proper credentials, then an acknowledgment  114  is sent back to the device of the one or more first devices  102 , in the step  208 . By utilizing an implementation such as this, hackers&#39; net scans will produce no results, as the devices will not respond, thus giving no indication that the device is even there. 
         [0021]      FIG. 3  illustrates a network of devices implementing the present invention. One or more client devices  300  are coupled to a server  310  through a network  308 . The one or more client devices  300  initiate communication with the server  310  by sending a packet  304  with credentials. The server validates the credentials and then responds by sending an acknowledgment  306  back to the appropriate client device  300 . If a hacker  302  attempts to communicate with the server  310  by sending a packet  304 ′ with either the incorrect credentials or no credentials, the server receives the packet  304 ′ but then drops the packet  304 ′. The server does not respond to the hacker  302 . Thus, only properly authenticated clients  300  with correct credentials are able to communicate with the server  310  and hackers  302  are not. In an alternate embodiment, a server sends the packet with credentials to a client device. 
         [0022]      FIG. 4A  illustrates a UDP packet  400 . Within a header  402  of the UDP packet  400  are four 16 bit fields including a source port, destination port, length and checksum. A data portion  404  of the packet contains the data to be transmitted. 
         [0023]      FIG. 4B  illustrates the UDP packet within a wrapper  410 . The wrapper  410  is formatted appropriately to contain the necessary components including any additional credentials such as a signature, a key or a code. Furthermore, the wrapper  410  is able to have a wrapper header  412  where the credentials are able to be stored. The credentials necessary to verify a valid incoming packet are located within the wrapper header  412  in some embodiments or within the wrapper  410  elsewhere in other embodiments. 
         [0024]    To utilize the present invention a network of devices is configured so that only properly authenticated devices are able to communicate with devices on the network. A transmitting device sends a packet with credentials to a receiving device. If the credentials are valid, the receiving device responds with an acknowledgment similar to that in TCP so that other communications are possible. If the credentials are not valid or if a packet does not have credentials, then the packet is dropped. This aspect is similar to UDP and unlike TCP which always responds with an acknowledgment. By only responding to authorized users, the system is able to remain undetected by unauthorized users such as hackers. After a connection is established, the devices communicate as typical network devices do, allowing the transfer of data from device to device over and through networks. 
         [0025]    In operation the present invention performs very similarly to standard networks that implement TCP with the exception that unauthorized packets are dropped. For authorized users, standard operations are available with the network such that users of an intranet are able to print to network printers, share data across computers and access applications from servers. In some embodiments, the network is the Internet. Many other typical network operations are possible with the present invention aside from those that require access to a device without valid credentials. 
         [0026]    The devices that are able to implement the present invention include, but are not limited to laptops, personal computers, Apple computers, handhelds, servers, thin clients and cell phones. 
         [0027]    The present invention has been described in terms of specific embodiments incorporating details to facilitate the understanding of principles of construction and operation of the invention. Such reference herein to specific embodiments and details thereof is not intended to limit the scope of the claims appended hereto. It will be readily apparent to one skilled in the art that other various modifications may be made in the embodiment chosen for illustration without departing from the spirit and scope of the invention as defined by the claims.