Patent ID: 7664855

Claim:
A method comprising: intercepting a client service request from a client to a server, at an intrusion prevention device (IPD) positioned between the client and a firewall device, wherein the client service request comprises a client synchronization (SYN) data packet that specifies a network address of the client and requests a network service from the server using a specified port; regardless of whether the specified port is open, generating, with the IPD, a synchronization-acknowledgement (SYN-ACK) data packet that includes an initial sequence number for a connection with the client, wherein generating the SYN-ACK comprises performing a one-way hash to encrypt a set of data values and setting the initial sequence number of the SYN-ACK to include the encrypted set of data values, the set of data values including the network address and the port specified in the SYN data packet intercepted from the client a network address and a port of the IPD that intercepted the SYN data packet and a secret number; transmitting the SYN-ACK data packet from the IPD to the client; receiving, with the IPD, a client acknowledgement (ACK) data packet from the client; with the IPD, encrypting a set of data values that includes the secret number and contents of the ACK data packet; comparing the encrypted set of data values included within the SYN-ACK by the IPD with the encrypted set of data values computed from the contents of the ACK data packet to determine whether the ACK data packet is received in response to the previously sent SYN-ACK data packet; establishing a network connection between the IPD and the server through the firewall when the ACK data packet was received in response to the SYN-ACK data packet previously sent to the client by the IPD; and transmitting data packets between the client and the server through the IPD when the network connection between the IPD and the server is successfully established using the specified port wherein transmitting data packets comprises modifying sequence numbers of the data packets with the IPD to conform to sequence numbers of the network connection between the IPD and the server and sequence numbers of the network connection between the IPD and the client.