Patent ID: 12250200

DETAIL DESCRIPTIONS OF DRAWINGS

Server and Endpoint Architecture

FIG.1shows a system of two endpoints, setup controller, network provider and a server. The server may provide an exchange of information bidirectionally to and from the endpoints. A network provider170such as a router may provide a wired or wireless communication network for the endpoint and server to transfer information.

An endpoint is a machine configured to detect, scan, or obtain information. Detectors are examples of endpoints. Examples of detectors include X-ray machines, sound detectors, CT scanners, ultrasound scanners, radiation detectors, cameras, or other machine capable of detecting, scanning or obtaining information. A security detector is a detector designed be used as a security stop to detect the presence of target items (drugs, guns, knives, etc.) Detectors may generate records. Records may comprise metadata, image data, image analysis, and other information. A detector may comprise an alarm when it detects a target item. The detector may store an associated image of an item that caused the alarm. Examples of security detectors includes equipment like metal detectors, x-ray machines, and CT scanners. Security detectors are generally used in airports, secure buildings, military bases, and other areas that monitor what users bring into or out of a building or secure location. Detectors may output a status of a machine. The status may contain information such as runtime, IP address, software models, access logs, number of scans, etc.

FIG.1shows a first endpoint100A and a second endpoint100B. An endpoint may comprise scanning hardware102, a processor104, memory106, and a network interface108. The scanning hardware may be configured to scan a person or object to determine additional information about the object (for example whether the object contains a metallic object.)

A server200may comprise a data converter202configured to change data from the endpoint100A from one format to another. The server200may also comprise a data storage204and data analyzer206. The server may also comprise a network interface208, processor210, and memory212. The server may comprise user management software214that may be stored in the memory and run by the processor for setting and adjusting user management rights.

The server200may comprise a report module216. The report module may generate reports such as service information218, alarm records220, alarm images222, data patterns224, staffing reports226, throughput reports228, and endpoint service records and reports230.

Endpoints may comprise a lot of important information such as scans of bags, rosters, number of people scanned, etc. For this reason, endpoints are often targets of hackers and various entities interested in accessing sensitive information. To improve the security and harden the system against hacking various security features to the system are disclosed.

Endpoint and Server System Architecture

Referring toFIG.2, the endpoint and the server may each comprise a network interface108having a timing circuit180. The timing circuit may be configured to automatically turn on or turn off the network interface at preselected times. A server timing circuit233may control timing for the network interface208of the server200. An endpoint timing circuit180may control timing for the network interface108of the endpoint100A.

In some configurations, the endpoint timing circuit180may be set by a setup controller (seeFIG.1,160). The setup controller160may be used when bringing a new endpoint into the system. The setup controller160may also be used when an endpoint has lost connectivity to the server200and/or server network. While shown inFIG.1as a separate component, the setup controller160may be integrated into the server or the endpoint. The network interface of the endpoint108or the network interface of the server208may be configured to automatically turn off after it has transmitted or received information.

The server may comprise antivirus software232to protect the server from software viruses. The server200may also comprise a firewall234with deep packet inspection. The server may comprise a VPN server and the endpoint may comprise a VPN client. The endpoint and server may comprise SCP, SFTP, and SSH software (SSH) for facilitating secure transmissions. The endpoint may comprise an operating system hardened to current STIG (Security Technical Implementation Guide) requirements.

The server may obtain service information records172from an endpoint. Service information may comprise maintenance requests, tolerances, belt tolerances, and scheduled repairs. The server may store the service information in a service records database236.

An endpoint may store scan records174in a connected or integrated storage device or in the endpoint memory. The endpoint may transmit the scan records to the server200. The server200may store the scan records in a scan records database238. Scan information may comprise images, metadata, alarm information, date, location, time, suspected item, analysis data of the image, etc. The scan database and the service record database may be a single database in some configurations. The database may be integrated into the server200or it may be its own device. For example, a database may comprise a processor, memory, storage, network interface, and database management software configured to send, update, modify, transmit, and organize records. A database may be configured to process SQL commands and run database instruction sets.

As shown inFIG.3, the server may be connected to other servers (e.g., server200A and server200B). The architecture of a multi-server network may vary. For example, there may be a command center that controls or has access to the servers. A server may function in a distributed network with or without a central server. The server(s) may have various access level security to provide server operators with an appropriate of access to other servers and/or detectors. Server200A and server200B may also connect to a hub400. A hub is a type of server configured to collect analyze data from one or more servers connected to one or more detectors. InFIG.3, each of the servers is shown connected to multiple endpoints.

A server may comprise a data analyzer240(FIG.2) programmed to run statistical analysis of information from one or more endpoints. The hub400may be configured to run statistical analysis on data from multiple servers. For example, the hub may be configured to analyze whether there is an increase in how many guns are being detected in a time period (like per hour or per day). A server could be configured to perform a similar analysis. In some configurations, a secure location (like a building, military base or airport) will have one or more servers connected to plurality of endpoints. A secure location may comprise a hub as well. The hub400may be configured to run statistical analysis on data from multiple servers; each of the servers comprising a data analyzer configured to run statistical analysis of information from one or more endpoints.

The server, endpoint, and/or hub may compose a system1(FIG.3). The system may comprise: a reservation system containing reservations for people expected to enter or leave a location in a time window through an entrance or exit; a demand prediction engine269(FIG.2) configured to determine or predict demand at one or more scanning locations; a queue analyzer configured to determine demand by analyzing video or photos of people waiting in a queue; a usage analyzer configured to analyze how many scans one or more endpoints has processed in a given time window on a given date; a predictive algorithm and logic to process data generated by the usage analyzer to predict how many scans a given endpoint will need to process in on a future date, day of the week, or calendar date in a future time window; a staffing module configured to update duty rosters to make more agents available to work at machines at times that have more people entering or leaving a building; the staffing module may be configured to analyze various data inputs such as the predictive algorithm, reservation system, queue analyzer, usage analyzer, etc. to predict what updates to make to the duty roster; the staffing module may be configured to requisition additional equipment to improve scan rate of people waiting in the queue.

Referring toFIG.2, the server and/or hub may be configured to determine or predict demand at one or more scanning locations. The server and/or hub may be connected to a reservation system242which may contain reservations for people expected to enter or leave a location in a time window through an entrance/exit. The server and/or hub may comprise a queue analyzer244configured to determine demand by analyzing video and/or photos of cameras of queues. The server and/or hub may be equipped with a usage analyzer246configured to analyze how many scans one or more detector processed in a given time window on a given date. A predictive algorithm can process data generated by the usage analyzer246to predict how many scans a given endpoint may need to process in on a future date, day of the week, or calendar date in a future time window (e.g., 5-7 PM on Fridays.) A staffing module250may be configured to update duty rosters252so that more agents are available to staff machines at times that have more people entering or leaving a building. The staffing module250may analyze various data inputs such as the predictive algorithm, reservation system, queue analyzer, usage analyzer, etc. to predict what updates to make to the duty roster. The staffing module250may be configured to requisition additional equipment to aid in detecting such as a mobile scanner.

The server may comprise an endpoint diagnostic module254. The endpoint diagnostic module254may be configured to generate and maintain records on service life, repairs, and costs for operating different types of endpoints or detectors. For example, the endpoint diagnostic module may be configured to generate reports on which brand of X-Ray machine has more error messages or which type of CT Scanners have more mechanical failures. The endpoint diagnostic module may be configured to generate cost to operate reports. Cost to operate reports may include energy costs, planned upgrades, planned and unplanned repairs, staffing costs, costs to acquire, etc.

A report generator256may comprise one or more data inputs. A data input may receive output from one or more components of the server200. For example, the report generator256may receive data from the endpoint diagnostic module, staffing module, predictive algorithm, reservation system, queue analyzer, usage analyzer, etc. to generate useful reports. For example, an airline might requisition scan data from the usage analyzer246to determine how much overhead bin space is necessary for new airplanes based on how many bags and what size bags travelers bring onto planes.

The server200and/or hub400may comprise a user management controller258configured to setup user access on one or more endpoints or detectors. Conventionally, a system administrator would need to physically travel to a detector and set user permissions for the detector. For example, the system administrator might configure which agents can run or access an endpoint and at what times. The user management controller258may be configured to establish and/or change endpoint level access policies.

The server200may be configured with a translator260configured to standardize information from different endpoints into a standard format. For example, different endpoints might output a date using a different format Feb. 5, 2022 vs 20220205. The translator may be configured to homogenize data from different branded endpoints or differently configured endpoints so that data received from the endpoint may be processed by the server or hub.

The endpoint may be configured to take an image of an object near (e.g., within optical view of the scanner or camera) of the detector with a scanner or camera118. The endpoint may comprise an image analyzer120configured to analyze the image for an object of interest. The image analyzer may comprise an algorithm to determine an interest level, a binary decision, or a probability that the image shows an object of interest. The endpoint may comprise a user interface122configured to receive an image identification and object status. The image identification may comprise a name or description of the scanned object. An object status may comprise a machine or human verified decision as to whether the object is an object of interest. The endpoint may comprise a machine learning algorithm124to improve its image analysis algorithm. The server or hub may aggregate data from many detectors to increase a sample size of object scans. The server or hub to generate improved algorithms for the image analyzer and update the detector with an improved algorithm.

The server or hub may comprise an endpoint update module262configured to install an improved image analyzer, timing circuit, or other software installed on the endpoint.

The server may comprise a network interface208comprising software to generate a rotating IP address. A rotating IP address is more difficult to hack because a hacker would need to first determine a current or future IP address of the server before attempting to connect to the server. The server200may be configured to randomly determine a next IP address or a next IP address may be selected from a predetermined sequence. A next IP address is the next IP address that the server will have when it connects to the internet for communication with other servers or endpoints. The server may also rotate the ports that the server will accept communications from endpoints. The server may use standard, nonstandard, and/or incongruent ports. The server may also specify a time window and date at which it will accept communications on a specific IP port.

ReferringFIG.2, the firewall and/or server may comprise an intrusion detection algorithm264configured to identify a rogue machine attempting to guess which port is open. The server200may also comprise an ID verification module266configured verify that the endpoint is on a whitelist or not on a blacklist.

Endpoint Server Connection Protocol

As shown inFIG.4, the server may send a connection packet310to one or more detectors so that the detectors can communicate with the server at a future time. The connection packet310may comprise a next IP address, a next IP Port, a next connection time, and a next connection date. In other words, the server200may instruct the endpoint100when and how to send its communication to the server. A firewall312in the server may be configured to keep ports closed other than the next port.

The endpoint may comprise an identity generator320configured to generate an identity (ID) using, for example, the IP address, Mac Address, passcode, username and password, a hardware key, or other features of the endpoint. The ID verification module (266,FIG.2) may be configured to accept communications only from an endpoint with a specific identity such as the IP address. In some configurations, the endpoint may be configured to transmit a passcode to the server. The ID verification module266may be configured to delete, quarantine, or export data from an endpoint that fails an ID Verification. The server may trigger an alarm if an ID verification fails.

The system may be configured to provide secure transfer of data packets (upload and download) between endpoints and the server. The data packets may be any type of file in any format. The data packet may be limited in size based on network bandwidth considerations between the two devices and the time allotted to a “time transfer window” as described above. The data packet may include the connection packet. The endpoint and/or server may comprise a data compressor268configured to compress the data and/or “zip” the data. A time transfer window generator270may generate a time window comprising a date, start time and end time may be approximately 5 minutes, 10 minutes, 15 minutes, or 20 minutes in duration. The time window may be open daily, open on certain days of the week, or open on certain days of the month. A scheduling monitor272in the server200may be configured adjust the time window based on how many endpoints are scheduled to send data packets and size of recently received data packets. In some configurations, the time transfer window is configured to occur randomly for each individual endpoint. The server may configure the time window to be open just long enough to securely upload and download the data packet from the endpoint. As previously described, the server may also require a nonstandard SSH communications port (e.g.,9176) or utilize a rotating port to further harden the system.

Standard ports according to this application are ports that are regularly used for TCP and UDP communications. A list of standard ports appears at the end of the specification. For the purpose of this specification, all ports appearing the list of standard ports are “standard ports.”

Nonstandard ports are ports that are not regularly used for TCP or UDP communications. Nonstandard ports are ports that do not appear in the list of standard ports (such as port number996is not in the list of standard ports). For the purpose of this specification, if a port does not appear in the list of standard ports, it is considered a nonstandard port.

An incongruent port can be a standard port or nonstandard port. It is a port used for a purpose other than what the standards protocol (Internet Assigned Numbers Authority (IANA)) dictates. For example, computers communicate via FTP on port 20. Sending HTTP information over port 20 (HTTP is usually port 80) is use of standard port in an incongruent manner.

FIG.4shows that the endpoint and server may be programmed to execute a secure data transfer algorithm. The identity generator may generate an ID as previously described. The endpoint100may send a data packet at time T on X with ID (330). The network interface208may receive the ID and transmit the entire message including the data packed to the ID verification module. The ID verification module may determine the endpoint is recognized or approved by confirming the identity matches (optionally using pattern matching332) an entry in a whitelist334of approved identities. The ID verification module may determine the endpoint is not recognized/not approved by confirming the identity does match (optionally using pattern matching332) an entry in a whitelist334of approved identities. In other configurations, the ID verification module might confirm that the identity matches an entry in blacklist of disapproved identities, in which case the endpoint is not approved. The server may transmit a reply back to the endpoint indicating that the server has determined the endpoint is not recognized/not authorized (invalid336) to send information to the server and/or receive information from the server. The server may add the identity to the blacklist or execute other intrusion protection algorithms338. In addition, the server may add the identity of an endpoint to the blacklist when the endpoint attempts a connection to the server outside a time-window or using the wrong port. While the server may be disconnected from the network outside the time-window, the switch may still remain active/online. The switch may be configured to transmit the identity of the endpoint connecting outside the time window to the server, allowing the server to add the identity of the endpoint to the blacklist.

A data packet generator321may be configured to generate a data packet. The data packet may contain data collected by an endpoint such as scans, detections, anomalies, software version numbers, operating conditions, etc. The data packet could contain any information that an endpoint might be programmed to collect. A data converter346may convert data from the endpoint into a universal format. Data collected by different model and brand endpoints might format data differently. Examples of different formats include: long form date versus short form date, different table delimiters, different types of white space, different data collections, fields comprising multiple fields in other reports, etc. The data converter346may be programmed to homogenize data from a plurality of different endpoints. The server may store the data in a data storage device348such as a database. A data analyzer350may analyze the homogenized data for patterns of interest, notifications, detections, etc. The data analyzer may comprise a report module352configured to output results from the analysis. Reports may include a display on a monitor including tables and charts, printing a report with a printer, emailing a report, uploading a report to database or shared drive, sending a link to a user to download a copy of the report, etc.

In process flows in which the ID verification module verifies that the identity of the endpoint matches an approved identity in the whitelist, the server may transmit a reply340containing a next contact time U and port Y. These instructions program a scheduling module322in the endpoint to instruct the endpoint to send its next message at time/date U using port Y. The endpoint next sends a second data packet at Time U on Port Y with ID342. The server200may repeat this process by providing the endpoint with a second reply containing a next contact time V on Port Z. Time T, Time U, and Time V may be provided in different formats, and they may include a date and time. Time information may be sent in relative time (e.g., 1 day and 4 hours from now) or at a specific time & data (e.g., send the next packet at 2:00 PM EST, Jul. 17, 2023.)

Scheduled Operational Technology Data Exchange and Device Setup View

FIG.5illustrated a scheduled operational technology data exchange and device setup view. Endpoint500A, endpoint500B, and endpoint500C may comprise an OS hardened to current STIG requirements. Although the system1inFIG.5shows three endpoints, two managed network switches (525A and525B), one firewall and switch550, and one dedicated server575, more or less of each components are possible and contemplated (e.g. three servers). The endpoint may be connected to a locally managed network switch using a network interface in the endpoint. InFIG.5, managed network switch is connected to endpoints500A and500C, while endpoint500B is connected by a second managed network switch525B. Each CT scanner/endpoint may comprise a “scanner zone” (see elements504A/504B). A scanner zone is a filing system for storing scan data in a database. A dedicated interface on the endpoint may be configured utilizing local TCP/IP (v4 or v6) IP address assignment. The operating system of the endpoint may be configured to only allow network traffic to/from IP address of the server and only on the SSH port specified on the sever.

The network interface on the endpoint may have an “up state”, “on state”, and/or “online state.” Similarly, the dedicated network interface may comprise a “down state,” “off state”, or “offline state.”

A security key module may generate a unique public/private key pair for the SCP for each CT scanner with the public key587being placed on the server and the private key on the individual CT scanner502A (for endpoint500A) and private key502B (for endpoint500B). The private keys (502A and502B) may be different from one another. A private key may be placed on the individual CT scanner manually by loading the private encryption key onto the CT via a USB device (or portal storage device)—not via a network.

A managed network switch525may have a managed network interface. The network switch may comprise a managed network interface. The network interface may be comprise an online (up state) and offline state (down state). The endpoint may comprise subnet. A security operations center (SOC) may monitor the IP of the CT scanner. The security operations center may comprise an identity and access control policy platform configured to enforce compliance, enhance infrastructure security, and streamline service operations. The SOC may run CISCO ISE (Cisco Identity Services Engine) against the subnets for example.

A firewall & switch550may be configured to limit the connection from the CT scanner to the DS. The firewall & switch may be configured to provide redundancy, block chain control of network encryption keys, and support native IPv6. The firewall & switch may be configured to perform deep packet inspection and active reporting to a SOC for monitoring.

A server575may be set up in a data center environment behind a dedicated firewall where the VPN connection from the endpoint is terminated. A “dedicated” server is a server specifically configured to exchange information with an endpoint as described in the current application. The server may be hardened to current STIG requirements. The server may have IPTables configured to only accept connections from the IP addresses assigned to each specific endpoint and the SSH port. The server may comprise an ID verification module configured to restrict communications to only between the server and the individual previously approved endpoint. The sever may be plugged into or connected to a locally managed network switch using a dedicated network interface on the sever. The network interface on the sever may be configured utilizing local TCP/IP (v4 or v6) IP address assignment. The network interface may comprise an up state and a down state. A separate file system may be established on the server for each endpoints. The file system may be configured to function as a “quarantine zone577” for each endpoint. Each endpoint may be able to securely copy data or files to the quarantine zone. A separate file system may be configured so that the server functions as a “distribution zone579.” The endpoints may be configured securely copy file from the server distribution zone. The distribution zone and quarantine zone may be separate file systems and the distribution zone may be limited to read only. Files placed in the distribution zone may be encrypted and digitally signed. The server may comprise a separate file system that functions as a “quarantined red zone.” Endpoints may be configured to securely copy files from the quarantined red zone. The file system of the quarantined red zone may be separate from the “quarantine zone” and may be limited to read only. Files placed in the quarantine zone file system may be encrypted via an encryption module. Files place in the quarantine zone file system may be digitally signed. The server may comprise a SSH server. The SSH might be configured to use a nonstandard port. A security key module may generate a unique public/private key pair for the SCP for each endpoint. The security key module may place the public key on the server and the private key on the individual endpoint.

The quarantine zone is a location on the server to initially receive files from the endpoint. The server may scan files for malware in this location. If no malware is detected by server, the sever may move the file to a next location for further processing. If the file contains malware (or is suspected to contain malware), the server may be configured to move the file to the red quarantine zone (e.g., a permanent quarantine). The server may perform cyber forensic analysis on files in the red quarantine zone and/or permanently remove/delete from the data storage of the server. Through this process, the server is configured to avoid keeping harmful files in the drop zone (quarantine zone), while still be capable of placing new files from the end points in the quarantine zone for malware scanning.

Scheduled OT Data Exchange

FIG.6illustrates a process flow for securely exchanging information between a dedicated server575and CT scanner/endpoint(s)500A-500C. The steps may be performed in the sequence presented, steps may be implemented at the same time, or they may be performed in alternate order.

Step 1) The server may create a program task or a “cron job” in the DS server. Cron is a utility program that lets users input commands for scheduling tasks repeatedly at a specific time. Tasks scheduled in cron are called cron jobs. Users can determine what kind of task they want to automate and when it should be executed. Cron is a daemon—a background process executing non-interactive jobs. Microsoft Windows contains background processes called Services that work similarly to the cron daemon. A cron file is a simple text file that contains commands to run periodically at a specific time. With cron jobs, users can automate system maintenance, disk space monitoring, and schedule backups.

The server may comprise a dedicated network interface configured to send and receive information from the firewall and switch550. The server program task may set the dedicated network interface into an “up state” for a predetermined amount of time and specific time window. E.g., for 3 hours between 0100 and 0400. After the time window has lapsed, the program task may be set the dedicated interface to a “down state.” As shown, the dedicated server575may comprise dedicated interface675with an online/offline mode677.

Step 2) The CT Scanner/Endpoint may also be configured to create a program task on each CT scanner. The CT Scanner/Endpoint may also comprise a dedicated network interface. The endpoint program task may be configured to run every 24 hours during a random time between the pre-determined times as configured on the server less the necessary amount of time for the SCP commands to execute and as seeded by the random number generator of the endpoint. E.g., if SCP will take 10 min to run, the program task might start at 0315 on the endpoint. For example, the program task might be configured to run between 0100 and 0400 and end before 0400 when the endpoint interface will change to a “down” state. In this way, a “transfer window” is created for a period of time when the server is online and available to transfer files between the individual endpoints.

Step 3) Once the endpoint program task has changed the dedicated interface to the “up state”, the endpoint may be configured to establish an encrypted VPN between the CT scanner and the DS.

Step 4) The endpoint may be configured to transfer information on a nonstandard port. A security key module585may be configured to setup a public/private key pair. The security key module585may install the private key on the CT Scanner500and the public key on the Dedicated Server. Once the encrypted VPN is established, the CT scanner may execute the SCP command on a nonstandard port with the previously installed public/private key pair to copy the files in the “distribution zone” (e.g., the DHS CA CRL) from the DS to the CT scanner.

Step 5) Once the CT Scanner has copied files from the “distribution zone” of the server, the CT scanner may execute a SCP command on the nonstandard port defined with the previously installed public/private key pair to copy any necessary files up to the server “quarantine zone” for that specific endpoint. The endpoint may encrypt these files before they are uploaded.

Step 6) The CT Scanner may be configured to send the files via SCP to the server. The program task on the individual endpoint may be configured to place the dedicated network interface into a “down state.” The program task may check the downloaded files for required signatures. If the program task determines the signatures are valid, then the endpoint may be configured to decrypt the files and place the files into a designed endpoint file systems for future processing.

Step 7) If the individual endpoint is unable to connect to the server or execute the SCP commands for any reason, the endpoint may be configured to generate an error message to store in a local log file. A trouble shooting module may be configured to analyze the error message/log file to determine a source of the connection problem/SCP command failure. As an exemplary method, the endpoint may fail to connect to the server; the endpoint may generate an error message; the endpoint may log the error message into a local log file; the endpoint may execute a trouble shooting module to analyze a source the error message; and the trouble shooting module may restoring the connection between the endpoint and the server.

Step 8) The program task of the endpoint may be configured to re-schedule itself to: a) run based on a random time or retry the program task if the task failed on the same day.

Step 9) For files uploaded from the individual endpoint to the server, a separate program task may be configured to execute after the “transfer window” has closed. The separate cron program task may be configured to process files that have been uploaded to the “quarantine zone” of the server. The files may be scanned and scrubbed/cleaned and determined to be malware free before being the program task will move the files to another file system on the server or other server for additional processing.

Step 10) When the virus scanner determines that the uploaded file(s) are not malware free, the virus scanner may be moved the files to another quarantine file system for forensic analysis. The virus scanner may generate an error log message indicating that a file with malware was identified. The virus scanner may update the IPTables to disallow that specific endpoint from connecting to the server again until the malware issue has been resolved.

Endpoint and Server Information Process Flow

FIG.7shows a method of securely exchanging information between a server575and an endpoint500A. As discussed with reference to the previous figures, the server may comprise a processor, memory, storage media, a network interface, and non-transitory software instructions configured to executed by the processor. The endpoint may comprise a processor, memory, storage media, a network interface and non-transitory software instructions configured to executed by the processor. The processor of the server may create a program task in the memory of the server.

The program task in the server may switch (7A) the network interface of the server into an online mode. The server may receive (7B) a data packet from the endpoint when the network interface of the server is in online mode; the data packet may contain an ID and instructions.

The server may verify (7C) the ID matches an ID from a list of approved IDs. The server may store instructions from the data packet in a quarantine zone (7D). A malware checker (a system or software configured to scan files for harmful files) scanning (7E) the file for malware. The server may process instructions (7F) in the file. The server may transmit (7G) a file back to the endpoint based on the instructions in the data packet. As shown, the server may transmit the file back to the endpoint through a firewall and switch550.

A program task in the endpoint may switch (7H) the network interface of the endpoint into an online mode. The endpoint may receive (7I) the transmitted file when the network interface of the server is in online mode. The endpoint may process instructions (7J) within the transmitted file. The transmitted file may contain a nonstandard port number, a future time window, and a request for scan information.

The program task of server may turn off (7K) the network interface after the server transmits the file back to the endpoint. The program task of the server may turn back on the network interface at a beginning of the future time window. The endpoint may send (7L) scan information to the server using a nonstandard port number, within a time specified by the future time window. A data analysis engine in the server may perform data analysis (7M) on the scan information may determine patterns of scan information. The server may receive scan information from a second endpoint (7O) and third endpoint (7P). The server may perform data analysis on the scan information from the endpoint, second endpoint, and third endpoint to determine patterns of scan information.

Hardware Configurations

The server, hub, and endpoint may include a hardware processor communicatively coupled to an instruction memory and to a data memory by a bus. The instruction memory can be configured to store, on at least a non-transitory computer readable medium as described in greater detail below, executable program code. The hardware processor may include multiple hardware processors and/or multiple processor cores. The hardware processor may include cooperation with hardware processors from different devices. The server, hub, and endpoint may execute one or more basic instructions included in the executable program code. The server, hub, and endpoint can include a network interface communicatively connected to the bus, for interfacing to a wide area network (WAN), e.g., the Internet or a private area network. Also communicatively connected to the bus can be a GUI. The server, hub, and endpoint may also include a mass storage, which can be accessible to the hardware processor via the bus.

The relationship between the executable program code and the hardware processor is structural; the executable program code is provided to the hardware processor by imparting various voltages at certain times across certain electrical connections, in accordance with binary values in the executable program code, to cause the hardware processor to perform some action, as now explained in more detail.

A hardware processor may be thought of as a complex electrical circuit that is configured to perform a predefined set of basic operations in response to receiving a corresponding basic instruction selected from a predefined native instruction set of codes.

The predefined native instruction set of codes is specific to the hardware processor; the design of the processor defines the collection of basic instructions to which the processor will respond, and this collection forms the predefined native instruction set of codes.

A basic instruction may be represented numerically as a series of binary values, in which case it may be referred to as a machine code. The series of binary values may be represented electrically, as inputs to the hardware processor, via electrical connections, using voltages that represent either a binary zero or a binary one. The hardware processor interprets the voltages as binary values.

Executable program code may therefore be understood to be a set of machine codes selected from the predefined native instruction set of codes. A given set of machine codes may be understood, generally, to constitute a module. A set of one or more modules may be understood to constitute an application program or “app.” An app may interact with the hardware processor directly or indirectly via an operating system. An app may be part of an operating system.

Computer Program Product

A computer program product is an article of manufacture that has a computer-readable medium with executable program code that is adapted to enable a processing system to perform various operations and actions.

A computer-readable medium may be transitory or non-transitory.

A transitory computer-readable medium may be thought of as a conduit by which executable program code may be provided to a computer system, a short-term storage that may not use the data it holds other than to pass it on.

The buffers of transmitters and receivers that briefly store only portions of executable program code when being downloaded over the Internet is one example of a transitory computer-readable medium. A carrier signal or radio frequency signal, in transit, that conveys portions of executable program code over the air or through cabling such as fiber-optic cabling provides another example of a transitory computer-readable medium. Transitory computer-readable media convey parts of executable program code on the move, typically holding it long enough to just pass it on.

Non-transitory computer-readable media may be understood as a storage for the executable program code. Whereas a transitory computer-readable medium holds executable program code on the move, a non-transitory computer-readable medium is meant to hold executable program code at rest. Non-transitory computer-readable media may hold the software in its entirety, and for longer duration, compared to transitory computer-readable media that holds only a portion of the software and for a relatively short time. The term, “non-transitory computer-readable medium,” specifically excludes communication signals such as radio frequency signals in transit.

The following forms of storage exemplify non-transitory computer-readable media: removable storage such as a universal serial bus (USB) disk, a USB stick, a flash disk, a flash drive, a thumb drive, an external solid-state storage device (SSD), a compact flash card, a secure digital (SD) card, a diskette, a tape, a compact disc, an optical disc; secondary storage such as an internal hard drive, an internal SSD, internal flash memory, internal non-volatile memory, internal dynamic random-access memory (DRAM), read-only memory (ROM), random-access memory (RAM), and the like; and the primary storage of a computer system.

Different terms may be used to express the relationship between executable program code and non-transitory computer-readable media. Executable program code may be written on a disc, embodied in an application-specific integrated circuit, stored in a memory chip, or loaded in a cache memory, for example. Herein, the executable program code may be said, generally, to be “in” or “on” a computer-readable media. Conversely, the computer-readable media may be said to store, to include, to hold, or to have the executable program code.

Creation of Executable Program Code

Software source code may be understood to be a human-readable, high-level representation of logical operations. Statements written in the C programming language provide an example of software source code.

Software source code, while sometimes colloquially described as a program or as code, is different from executable program code. Software source code may be processed, through compilation for example, to yield executable program code. The process that yields the executable program code varies with the hardware processor; software source code meant to yield executable program code to run on one hardware processor made by one manufacturer, for example, will be processed differently than for another hardware processor made by another manufacturer.

The process of transforming software source code into executable program code is known to those familiar with this technical field as compilation or interpretation and is not the subject of this application.

User Interface

A computer system may include a user interface controller under control of the processing system that displays a user interface in accordance with a user interface module, i.e., a set of machine codes stored in the memory and selected from the predefined native instruction set of codes of the hardware processor, adapted to operate with the user interface controller to implement a user interface on a display device. Examples of a display device include a television, a projector, a computer display, a laptop display, a tablet display, a smartphone display, a smart television display, or the like.

The user interface may facilitate the collection of inputs from a user. The user interface may be graphical user interface with one or more user interface objects such as display objects and user activatable objects. The user interface may also have a touch interface that detects input when a user touches a display device.

A display object of a user interface may display information to the user. A user activatable object may allow the user to take some action. A display object and a user activatable object may be separate, collocated, overlapping, or nested one within another. Examples of display objects include lines, borders, text, images, or the like. Examples of user activatable objects include menus, buttons, toolbars, input boxes, widgets, and the like.

Communications

The various networks are illustrated throughout the drawings and described in other locations throughout this disclosure, can comprise any suitable type of network such as the Internet or a wide variety of other types of networks and combinations thereof. For example, the network may include a wide area network (WAN), a local area network (LAN), a wireless network, an intranet, the Internet, a combination thereof, and so on. Further, although a single network is shown, a network can be configured to include multiple networks.

CONCLUSION

For any computer-implemented embodiment, “means plus function” elements will use the term “means;” the terms “logic” and “module” have the meaning ascribed to them above and are not to be construed as generic means. An interpretation under 35 U.S.C. § 112(f) is desired only where this description and/or the claims use specific terminology historically recognized to invoke the benefit of interpretation, such as “means,” and the structure corresponding to a recited function, to include the equivalents thereof, as permitted to the fullest extent of the law and this written description, may include the disclosure, the accompanying claims, and the drawings, as they would be understood by one of skill in the art.

To the extent the subject matter has been described in language specific to structural features or methodological steps, it will be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or steps described. Rather, the specific features and steps are disclosed as example forms of implementing the claimed subject matter. To the extent headings appear in this description, they are for the convenience of the reader, not as limitations or restrictions of the systems, techniques, approaches, methods, or devices to those appearing in any section. Rather, the teachings and disclosures herein can be combined or rearranged with other portions of this disclosure and the knowledge of one of ordinary skill in the art. This disclosure generally encompasses and includes such variation. The indication of any elements or steps as “optional” does not indicate that all other or any other elements or steps are mandatory. The claims define the invention and form part of the specification. Limitations from the written description are not to be read into the claims.

Certain attributes, functions, steps of methods, or sub-steps of methods described herein may be associated with physical structures or components, such as a module of a physical device that, in implementations in accordance with this disclosure, make use of instructions (e.g., computer executable instructions) that may be embodied in hardware, such as an application-specific integrated circuit, or that may cause a computer (e.g., a general-purpose computer) executing the instructions to have defined characteristics. There may be a combination of hardware and software such as processor implementing firmware, software, and so forth, to function as a special purpose computer with the ascribed characteristics. For example, in embodiments a module may comprise a functional hardware unit (such as a self-contained hardware or software or a combination thereof) designed to interface the other components of a system such as through use of an application programming interface (API). In embodiments, structures for a module a module can be according to the module's function or set of functions, e.g., in accordance with a described algorithm. This disclosure may use nomenclature that associates a component or module with a function, purpose, step, or sub-step to identify the corresponding structure which, in instances, includes hardware and/or software that function for a specific purpose.

Titles and heading used throughout the specification are provided for navigational purposes only. They should not be considered as limiting or defining of the subject matter disclosed. Paragraphs and sections relevant to one figure or embodiment may be equally relevant to another figure.

While certain implementations have been described, these implementations have been presented by way of example only and are not intended to limit the scope of this disclosure. The novel devices, systems and methods described herein may be embodied in a variety of other forms; furthermore, various omissions, substitutions, and changes in the form of the devices, systems and methods described herein may be made without departing from the spirit of this disclosure.

Table of AcronymsAcronymDefinitionAITAdvanced Imaging TechnologyCACertificate AuthorityCDMContinuous Data MonitoringCISCOCisco SystemsCPUCentral Processing UnitCRLCertificate Revocation ListCTComputerized TomographyDICOSDigital Imaging and Communication in SecurityDHSDepartment of Homeland SecurityDSDedicated ServerETLExtract Transform LoadFDRSField Data Recording ServiceGMTGreenwich Mean TimeICAFIntegrated Checkpoint Architecture FrameworkIPInternet ProtocolISEIdentity Services EngineOEMOriginal Equipment ManufacturerOSOperating SystemOTOperation TechnologyMACMedia Access ControlPIVPersonal Identity VerificationSCPSecure Copy ProtocolSOCSecurity Operations CenterSSHSecure Socket ShellSTIGSecurity Technical Implementation GuidesTCP/IP ProtocolTransmission Control Protocol/Internet ProtocolTIPThreat Image ProjectionTSATransportation Security AdministrationTSETransportation Security EquipmentUSBUniversal Serial BusVPNVirtual Private Network

Table of Standard PortsPortTCPUDPDescription0ReservedIn programming APIs (not in communication between hosts),requests a system-allocated (dynamic) port1YesAssignedTCP Port Service Multiplexer (TCPMUX). Historic. Both TCP and UDPhave been assigned to TCPMUX by IANA, but by design only TCP isspecified.2Assignedcompressnet (Management Utility)3Assignedcompressnet (Compression Process)5AssignedRemote Job Entry was historically using socket 5 in its old socketform, while MIB PIM has identified it as TCP/5 and IANA hasassigned both TCP and UDP 5 to it.7YesEcho Protocol9YesDiscard ProtocolNoUnofficialWake-on-LAN11YesActive Users (systat service)13YesDaytime Protocol15UnofficialNoPreviously netstat service17YesQuote of the Day (QOTD)18YesMessage Send Protocol19YesCharacter Generator Protocol (CHARGEN)20YesAssignedFile Transfer Protocol (FTP) data transfer21YesAssignedFile Transfer Protocol (FTP) control (command)22YesAssignedSecure Shell (SSH), secure logins, file transfers (scp, sftp) and portforwarding23YesAssignedTelnet protocol-unencrypted text communications25YesAssignedSimple Mail Transfer Protocol (SMTP), used for email routingbetween mail servers27Assignednsw-fe (NSW User System FE)28UnofficialPalo Alto Networks' Panorama High Availability (HA) sync encryptedport.29Assignedmsg-icp (MSG ICP)31Assignedmsg-auth (MSG Authentication)33Assigneddsp (Display Support Protocol)37YesTime Protocol38Assignedrap (Route Access Protocol)39Assignedrlp (Resource Location Protocol)41Assignedgraphics (Graphics)42AssignedYesHost Name Server Protocol43YesAssignedWHOIS protocol44Assignedmpm-flags (MPM FLAGS Protocol)45Assignedmpm (Message Processing Module)46Assignedmpm-snd (MPM)47Reserved48Assignedauditd (Digital Audit Daemon)49YesTACACS Login Host protocol. TACACS+, still in draft which is animproved but distinct version of TACACS, only uses TCP 49.50Assignedre-mail-ck (Remote Mail Checking Protocol)51ReservedHistorically used for Interface Message Processor logical addressmanagement, entry has been removed by IANA on 2013 May 2552AssignedXerox Network Systems (XNS) Time Protocol. Despite this port beingassigned by IANA, the service is meant to work on SPP (ancestor ofIPX/SPX), instead of TCP/IP.53YesDomain Name System (DNS)54AssignedXerox Network Systems (XNS) Clearinghouse (Name Server). Despitethis port being assigned by IANA, the service is meant to work onSPP (ancestor of IPX/SPX), instead of TCP/IP.55Assignedisi-gl (ISI Graphics Language)56AssignedXerox Network Systems (XNS) Authentication Protocol. Despite thisport being assigned by IANA, the service is meant to work on SPP(ancestor of IPX/SPX), instead of TCP/IP.58AssignedXerox Network Systems (XNS) Mail. Despite this port being assignedby IANA, the service is meant to work on SPP (ancestor of IPX/SPX),instead of TCP/IP.61ReservedHistorically assigned to the NIFTP-Based Mail protocol, but wasnever documented in the related IEN. The port number entry wasremoved from IANA's registry on 2017 May 18.62Assignedacas (ACA Services)63Assignedwhoispp (whois++)64Assignedcovia (Communications Integrator (CI))65Assignedtacacs-ds (TACACS-Database Service)66Assignedsql-net (Oracle SQL*NET)67AssignedYesBootstrap Protocol (BOOTP) server; also used by Dynamic HostConfiguration Protocol (DHCP)68AssignedYesBootstrap Protocol (BOOTP) client; also used by Dynamic HostConfiguration Protocol (DHCP)69AssignedYesTrivial File Transfer Protocol (TFTP)70YesAssignedGopher protocol71-74YesNETRJS protocol76Assigneddeos (Distributed External Object Store)78Assignedvettcp (vettcp)79YesAssignedFinger protocol80YesHypertext Transfer Protocol (HTTP) uses TCP in versions 1.x and 2.HTTP/3 uses QUIC, a transport protocol on top of UDP.81UnofficialTorPark onion routing82Assignedxfer (XFER Utility)82UnofficialTorPark control83Assignedmit-ml-dev (MIT ML Device)84Assignedctf (Common Trace Facility)85Assignedmit-ml-dev (MIT ML Device)86Assignedmfcobol (Micro Focus Cobol)88YesKerberos authentication system89Assignedsu-mit-tg (SU/MIT Telnet Gateway)90Assigneddnsix (DNSIX Security Attribute Token Map)90UnofficialPointCast (dotcom)91Assignedmit-dov (MIT Dover Spooler)92Assignednpp (Network Printing Protocol)93Assigneddcp (Device Control Protocol)94Assignedobjcall (Tivoli Object Dispatcher)95YesAssignedSUPDUP, terminal-independent remote login96Assigneddixie (DIXIE Protocol Specification)97Assignedswift-rvf (Swift Remote Virtual File Protocol)98Assignedtacnews (TAC News)99Assignedmetagram (Metagram Relay)101YesAssignedNIC host name102YesAssignedISO Transport Service Access Point (TSAP) Class 0 protocol;104YesDigital Imaging and Communications in Medicine (DICOM; also port11112)105YesCCSO Nameserver106UnofficialNomacOS Server, (macOS) password server107YesRemote User Telnet Service (RTelnet)108YesIBM Systems Network Architecture (SNA) gateway access server109YesAssignedPost Office Protocol, version 2 (POP2)110YesAssignedPost Office Protocol, version 3 (POP3)111YesOpen Network Computing Remote Procedure Call (ONC RPC,sometimes referred to as Sun RPC)113YesNoIdent, authentication service/identification protocol, used by IRCservers to identify usersYesAssignedAuthentication Service (auth), the predecessor to identificationprotocol. Used to determine a user's identity of a particular TCPconnection.115YesAssignedSimple File Transfer Protocol117YesUUCP Mapping Project (path service)118YesStructured Query Language (SQL) Services119YesAssignedNetwork News Transfer Protocol (NNTP), retrieval of newsgroupmessages123AssignedYesNetwork Time Protocol (NTP), used for time synchronization126YesFormerly Unisys Unitary Login, renamed by Unisys to NXEdit. Usedby Unisys Programmer's Workbench for Clearpath MCP, an IDE forUnisys MCP software development135YesDCE endpoint resolutionYesMicrosoft EPMAP (End Point Mapper), also known as DCE/RPCLocator service, used to remotely manage services including DHCPserver, DNS server and WINS. Also used by DCOM137YesNetBIOS Name Service, used for name registration and resolution138AssignedYesNetBIOS Datagram Service139YesAssignedNetBIOS Session Service143YesAssignedInternet Message Access Protocol (IMAP), management ofelectronic mail messages on a server151AssignedHEMS152YesBackground File Transfer Program (BFTP)153YesSimple Gateway Monitoring Protocol (SGMP), a protocol for remoteinspection and alteration of gateway management information156YesStructured Query Language (SQL) Service158YesDistributed Mail System Protocol (DMSP, sometimes referred to asPcmail)161AssignedYesSimple Network Management Protocol (SNMP)162YesSimple Network Management Protocol Trap (SNMPTRAP)165AssignedXerox169AssignedSEND170YesNetwork PostScript print server177YesX Display Manager Control Protocol (XDMCP), used for remotelogins to an X Display Manager server179YesAssignedBorder Gateway Protocol (BGP), used to exchange routing andreachability information among autonomous systems (AS) on theInternet180Assignedris194YesInternet Relay Chat (IRC)199YesSNMP Unix Multiplexer (SMUX)201YesAppleTalk Routing Maintenance209YesAssignedQuick Mail Transfer Protocol210YesANSI Z39.50213YesInternetwork Packet Exchange (IPX)218YesMessage posting protocol (MPP)220YesInternet Message Access Protocol (IMAP), version 3225-241Reserved249-255Reserved259YesEfficient Short Remote Operations (ESRO)262YesArcisdms264YesBorder Gateway Multicast Protocol (BGMP)280Yeshttp-mgmt300UnofficialThinLinc Web Access308YesNovastor Online Backup311YesAssignedmacOS Server Admin (officially AppleShare IP Web administration)312UnofficialNomacOS Xsan administration318YesPKIX Time Stamp Protocol (TSP)319YesPrecision Time Protocol (PTP) event messages320YesPrecision Time Protocol (PTP) general messages350YesMapping of Airline Traffic over Internet Protocol (MATIP) type A351YesMATIP type B356Yescloanto-net-1 (used by Cloanto Amiga Explorer and VMs)366YesOn-Demand Mail Relay (ODMR)369YesRpc2portmap370Yescodaauth2, Coda authentication serverYessecurecast1, outgoing packets to NAI's SecureCast serversAs of 2000371YesClearCase albd376YesAmiga Envoy Network Inquiry Protocol383YesHP data alarm manager384YesA Remote Network Server System387YesAURP (AppleTalk Update-based Routing Protocol)388YesAssignedUnidata LDM near real-time data distribution protocol389YesAssignedLightweight Directory Access Protocol (LDAP)399YesDigital Equipment Corporation DECnet+ (Phase V) over TCP/IP(RFC1859)401YesUninterruptible power supply (UPS)427YesService Location Protocol (SLP)433YesNNTP, part of Network News Transfer Protocol434YesMobile IP Agent (RFC 5944)443YesHypertext Transfer Protocol Secure (HTTPS) uses TCP in versions 1.xand 2. HTTP/3 uses QUIC, a transport protocol on top of UDP.444YesSimple Network Paging Protocol (SNPP), RFC 1568445YesMicrosoft-DS (Directory Services) Active Directory, Windows sharesYesAssignedMicrosoft-DS (Directory Services) SMB file sharing464YesKerberos Change/Set password465YesNoSMTP over implicit SSL (obsolete)YesNoURL Rendezvous Directory for Cisco SSM (primary usageassignment)YesNoAuthenticated SMTP over TLS/SSL (SMTPS) (alternative usageassignment)475Yestcpnethaspsrv, Aladdin Knowledge Systems Hasp services476-490UnofficialCentro Software ERP ports491UnofficialGO-Global remote access and application publishing software497YesRetrospect500AssignedYesInternet Security Association and Key Management Protocol(ISAKMP)/Internet Key Exchange (IKE)502YesModbus Protocol504YesCitadel, multiservice protocol for dedicated clients for the Citadelgroupware system510YesFirstClass Protocol (FCP), used by FirstClass client/server groupwaresystem512YesRexec, Remote Process ExecutionYescomsat, together with biff513YesrloginYesWho514UnofficialRemote Shell, used to execute non-interactive commands on aremote system (Remote Shell, rsh, remsh)NoYesSyslog, used for system logging515YesAssignedLine Printer Daemon (LPD), print service517YesTalk518YesNTalk520Yesefs, extended file name serverYesRouting Information Protocol (RIP)521YesRouting Information Protocol Next Generation (RIPng)524YesNetWare Core Protocol (NCP) is used for a variety things such asaccess to primary NetWare server resources, Time Synchronization,etc.525YesTimed, Timeserver530YesRemote procedure call (RPC)532YesAssignednetnews533Yesnetwall, for emergency broadcasts540YesUnix-to-Unix Copy Protocol (UUCP)542Yescommerce (Commerce Applications)543Yesklogin, Kerberos login544Yeskshell, Kerberos Remote shell546YesDHCPv6 client547YesDHCPv6 server548YesAssignedApple Filing Protocol (AFP) over TCP550Yesnew-rwho, new-who554YesReal Time Streaming Protocol (RTSP)556YesRemotefs, RFS, rfs_server560Yesrmonitor, Remote Monitor561Yesmonitor563YesNNTP over TLS/SSL (NNTPS)564Unofficial9P (Plan 9)585NoPreviously assigned for use of Internet Message Access Protocolover TLS/SSL (IMAPS), now deregistered in favour of port 993.587YesAssignedemail message submission (SMTP)591YesFileMaker 6.0 (and later) Web Sharing (HTTP Alternate, also see port80)593YesHTTP RPC Ep Map, Remote procedure call over Hypertext TransferProtocol, often used by Distributed Component Object Modelservices and Microsoft Exchange Server601YesReliable Syslog Service - used for system logging604YesTUNNEL profile, a protocol for BEEP peers to form an applicationlayer tunnel623YesASF Remote Management and Control Protocol (ASF-RMCP) & IPMIRemote Management Protocol625UnofficialNoOpen Directory Proxy (ODProxy)631YesInternet Printing Protocol (IPP)UnofficialCommon Unix Printing System (CUPS) administration console(extension to IPP)635YesRLZ DBase636YesAssignedLightweight Directory Access Protocol over TLS/SSL (LDAPS)639YesMulticast Source Discovery Protocol, MSDP641YesSupportSoft Nexus Remote Command (control/listening), a proxygateway connecting remote control traffic643YesSANity646YesLabel Distribution Protocol (LDP), a routing protocol used in MPLSnetworks647YesDHCP Failover protocol648YesRegistry Registrar Protocol (RRP)651YesIEEE-MMS653YesSupportSoft Nexus Remote Command (data), a proxy gatewayconnecting remote control traffic654YesMedia Management System (MMS) Media Management Protocol(MMP)655YesTinc VPN daemon657YesIBM RMC (Remote monitoring and Control) protocol, used bySystem p5 AIX Integrated Virtualization Manager (IVM) andHardware Management Console to connect managed logicalpartitions (LPAR) to enable dynamic partition reconfiguration660YesAssignedmacOS Server administration, version 10.4 and earlier666YesDoom, the first online first-person shooterUnofficialairserv-ng, aircrack-ng's server for remote-controlling wirelessdevices674YesApplication Configuration Access Protocol (ACAP)688YesREALM-RUSD (ApplianceWare Server Appliance ManagementProtocol)690YesVelneo Application Transfer Protocol (VATP)691YesMS Exchange Routing694YesLinux-HA high-availability heartbeat695YesIEEE Media Management System over SSL (IEEE-MMS-SSL)698YesOptimized Link State Routing (OLSR)700YesExtensible Provisioning Protocol (EPP), a protocol forcommunication between domain name registries and registrars(RFC 5734)701YesLink Management Protocol (LMP), a protocol that runs between apair of nodes and is used to manage traffic engineering (TE) links702YesIRIS (Internet Registry Information Service) over BEEP (BlocksExtensible Exchange Protocol) (RFC 3983)706YesSecure Internet Live Conferencing (SILC)711YesCisco Tag Distribution Protocol-being replaced by the MPLS LabelDistribution Protocol712YesTopology Broadcast based on Reverse-Path Forwarding routingprotocol (TBRPF; RFC 3684)749YesKerberos administration750Yeskerberos-iv, Kerberos version IV751Unofficialkerberos_master, Kerberos authentication752Unofficialpasswd_server, Kerberos password (kpasswd) server753YesReverse Routing Header (RRH)Unofficialuserreg_server, Kerberos userreg server754Yestell sendUnofficialkrb5_prop, Kerberos v5 slave propagation760Unofficialkrbupdate, Kerberos registration782UnofficialConserver serial-console management server783UnofficialSpamAssassin spamd daemon800Yesmdbs-daemon802YesMODBUS/TCP Security808UnofficialMicrosoft Net.TCP Port Sharing Service829YesAssignedCertificate Management Protocol830YesNETCONF over SSH831YesNETCONF over BEEP832YesNETCONF for SOAP over HTTPS833YesNETCONF for SOAP over BEEP843UnofficialAdobe Flash847YesDHCP Failover protocol848YesGroup Domain Of Interpretation (GDOI) protocol853YesDNS over TLS (RFC 7858)YesDNS over QUIC or DNS over DTLS860YesiSCSI (RFC 3720)861YesOWAMP control (RFC 4656)862YesTWAMP control (RFC 5357)873Yesrsync file synchronization protocol888Unofficialcddbp, CD DataBase (CDDB) protocol (CDDBP)UnofficialIBM Endpoint Manager Remote Control897UnofficialBrocade SMI-S RPC898UnofficialBrocade SMI-S RPC SSL902UnofficialVMware ESXi903UnofficialVMware ESXi953YesReservedBIND remote name daemon control (RNDC)981UnofficialRemote HTTPS management for firewall devices running embeddedCheck Point VPN-1 software987UnofficialSony PlayStation Wake On LanUnofficialMicrosoft Remote Web Workplace, a feature of Windows SmallBusiness Server988UnofficialLustre (file system) Protocol (data).989YesFTPS Protocol (data), FTP over TLS/SSL990YesFTPS Protocol (control), FTP over TLS/SSL991YesNetnews Administration System (NAS)992YesTelnet protocol over TLS/SSL993YesAssignedInternet Message Access Protocol over TLS/SSL (IMAPS)994ReservedPreviously assigned to Internet Relay Chat over TLS/SSL (IRCS), butwas not used in common practice.995YesPost Office Protocol 3 over TLS/SSL (POP3S)1010UnofficialThinLinc web-based administration interface1011-1020Reserved1023ReservedUnofficialz/OS Network File System (NFS) (potentially ports 991-1023)