International Business Machines Corporation

Ramachandran Unnikrishnan

Gerald Francis McBrearty

Shawn Patrick Mullen

Johnny Meng-Han Shieh

Denise Marie Genty

John Paul Dodson

James Stanley Tesauro

Robert Kimberlin Foster

Minh Nguyen

Christine Iju Wang

A method, apparatus, and computer instructions for providing addresses to clients. A request is received from a client for an address. A determination is made as to whether authentication information is present in the request. A verification process is performed using the authentication information if the authentication information is presenting the request. A determination is made as to whether the authentication information is authenticated. A privileged address is provided to the client in response to the authentication information being authenticated.

Method and apparatus for authenticated network address allocation

A system and method for protecting data transmitted across a private network is disclosed. A secure channel is established so that the client computer can securely transmit a password to the server computer. Once the password has been transmitted, future transmissions use the password to encrypt data by the sending computer and decipher the data at the receiving computer. In one embodiment, passwords expire after a certain amount of time and are thereafter renegotiated. In another embodiment, the password is successively modified by a counter value further preventing unauthorized persons from discovering the password used to encrypt the data. By using passwords rather than public-key encryption methods, less system resources are required to maintain data confidentiality. An information handling system securely transmitting data within a private network as well as a computer program product programmed to perform the encryption processing are further disclosed.

System and method for securing data on private networks

A method and system for enabling secure IPsec tunnels within NAT without compromising security. A local network is configured with a gateway machine connected to the Internet and having an IPsec ID for interfacing with the Internet and a local IP/interface address for interfacing with the local network. Client machines are connected to the gateway machine and communicate with the Internet via the gateway and network address translation (NAT) techniques. Each client machine is configured with a local IP/interface address. The client machines are also provided with an alias of the IPsec ID for the gateway machine. When an IPsec request is received by the gateway machine to establish a tunnel (secure communication) with one of the clients, the gateway machine forwards the packet to the particular client using NAT. The client machine receives the request and since it has an alias of the gateway's IPsec ID, the client machine will confirm that it has one of the IPsec IDs in the packet. The client machine sends the reply packet back to the gateway machine, which then forwards it to the requesting machine over the Internet. The requesting machine receives the packet and a confirmation that it has reached its intended recipient and opens the secure IKE tunnel with the particular client via the gateway machine. In this manner authentication of the IKE tunnel and establishment of a secure IPsec session is completed with a client machine that is accessible only via a gateway implementing NAT.

Secure IPsec tunnels with a background system accessible via a gateway implementing NAT

Disclosed is a system and method for enhancing the security and reliability of virtual private network (VPN) connections by manually exchanging secondary configuration information. If a compromise is detected on a main VPN tunnel, a new VPN tunnel can be created by the system administrators using the secondary configuration, stymieing attempted security violations and providing nearly continuous service to the users. A compromise may be indicative of a security breach or other problem with the VPN. The main VPN tunnel may be abandoned or fed with false data to confuse would-be intruders if the compromise is a security compromise.

Manual virtual private network internet snoop avoider

A method and system for an algorithm-based network snoop avoider is provided. A first data processing system and a second data processing system communicate on a physical network by transmitting data packets on the network using a virtual private network (VPN). Data packets are transmitted through a first VPN tunnel between the first data processing system with a first network address terminating a first end of the VPN tunnel and the second data processing system with a second network address terminating a second end of the first VPN tunnel. The VPN is automatically reconfigured to use alternate addresses on the network for the tunnel endpoints by automatically determining, in accordance with a predetermined algorithm, a third network address and a fourth network address and by automatically assigning the third network address to the first data processing system and the fourth network address to the second data processing system. Data packets may then be transmitted through a second VPN tunnel in which a first end of the second VPN tunnel is terminated by the first data processing system using the third network address and a second end of the second VPN tunnel is terminated by the second data processing system using the fourth network address. The data packets may be transmitted using Internet Protocol (IP), and a portion of the network may include the Internet.

Method and system for algorithm-based address-evading network snoop avoider

Disclosed is a system and method for enhancing the security of virtual private network (VPN) connections by automatic pre-negotiation of a secondary configuration. If snooping or other security breaches are detected, the VPN tunnel is modified automatically to the secondary pre-arranged configuration, stymieing attempted security violations.

Growing community of inventors

Austin, TX, United States of America

Ramachandran Unnikrishnan