Host Computer Port Service Conditional Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing client-server computing and network systems expose information about hosted services by running on well-known ports, making them vulnerable to attacks and potentially violating network policies, and lack effective methods to differentiate service access based on client authentication and authorization.
Innovation Solution
A host computer system that conditionally provides services at a given port number based on client authentication and authorization, using a TLS handshake to determine whether to offer restricted services to trusted clients while keeping them hidden from untrusted clients, thereby reducing exposed information and improving network security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If services are run on well-known port numbers, then service accessibility and standard compliance are improved, but information exposure and vulnerability to attacks increase
Solution Approach 1:
The patent applies local quality by making the port service dynamic rather than static. The same port number can provide different services to different clients based on their authentication status. Unauthenticated clients receive service A while authenticated clients receive service B, creating localized service quality variations that reduce information exposure while maintaining accessibility.
Solution Approach 2:
The patent changes the service parameter dynamically based on client authentication state. Instead of a fixed service-port mapping, the system modifies which service is provided at a given port depending on the client's credentials, thereby changing the effective service parameter to balance accessibility and security.
2Productivity
If multiple services are provided on the same port, then device efficiency is improved, but service differentiation and access control complexity increase
Solution Approach 1:
The patent implements multi-functionality by enabling a single port to handle multiple services through TLS handshake-based differentiation. The port universally serves both unauthenticated and authenticated clients with different services, improving device efficiency while using the TLS protocol to manage the complexity of service differentiation.
Solution Approach 2:
The TLS handshake acts as an intermediary mechanism that enables service differentiation without requiring complex access control logic. The handshake process mediates between the client and the services, determining which service to provide based on authentication results, thereby reducing direct access control complexity.
3Difficulty of detecting and measuring
If service information is exposed to all clients, then service discoverability is improved, but security and policy compliance deteriorate
Solution Approach 1:
The patent applies preliminary anti-action by using the TLS handshake to preemptively identify and differentiate clients before service provision. This preliminary authentication action prevents unauthenticated clients from discovering or accessing services they should not have access to, countering potential security issues before they arise.
Solution Approach 2:
The patent makes service discoverability dynamic rather than static. Services are not permanently exposed or hidden but are dynamically revealed or concealed based on the client's authentication status during the TLS handshake, allowing service information to adapt to each client's credentials.
Data Source
AI summary
Typically, clients request a service from a computer hosting multiple services by specifying a destination port number associated with the desired service. In embodiments, the functionality of such a host computer is enhanced by having it condition client access to services available at a particular port number based on client authentication and/or authorization. A host computer can change the service(s) available at a given port number on a client by client basis, enabling access to service(s) for trusted clients unavailable to untrusted clients. Preferably, client trust is based on client authentication via a certificate and a valid, signed transport layer security (TLS) handshake (or similar mechanism in other protocol contexts). In some embodiments, an authorization step can be added following authentication. The systems and methods disclosed herein find wide uses in bundling services on ports, as well as protecting access to services from untrusted and/or malicious clients, among others.