Methods for internet communication security

• US 10,374,803 B2
• Filed: 10/05/2018
• Issued: 08/06/2019
• Est. Priority Date: 10/06/2017
• Status: Active Grant

• Current Assignee: StealthPath, Inc.
• Original Assignee: StealthPath, Inc.
• Inventors: Clark, Mike, Gordon, Andrew, Clark, Matt
• Primary Examiner(s): Goodchild, William J.
• Application Number:
  US16/153,409
• Publication Number:
  US 20190109714A1
• Time in Patent Office: 305 Days
• Field of Search: None
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 45/745 Address table lookup; Address filtering
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 67/565 Conversion or adaptation of application format or content adding application control or application functional data H04L67/561
• CPC Class Codes: H04L 69/08 Protocols for interworking; Protocol conversion
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key

Abstract

The present disclosure relates to network security software cooperatively configured on plural nodes to authenticate and authorize devices, applications, users, and data protocol in network communications by exchanging nonpublic identification codes, application identifiers, and data type identifiers via pre-established communication pathways and comparing against pre-established values to provide authorized communication and prevent compromised nodes from spreading malware to other nodes.

Claims

1. A product for authorizing network communications in a hypervisor, the product comprising a non-transitory computer-readable storage medium having computer-readable program code embodied therein, the computer-readable program code executable in a hypervisor to perform communication management operations, the communication management operations comprising:

i) intercepting a first network packet in the hypervisor, the first network packet comprising a first higher-than-OSI layer three portion;

ii) decrypting, with a single-use cryptographic key, at least a portion of the first higher-than-OSI layer three portion to obtain one or more first packet parameters;

iii) authorizing the first network packet in the hypervisor, comprising;

comparing the one or more first packet parameters with one or more first expected values; and

iv) passing the authorized first network packet to a virtual device.

2. The product of claim 1, wherein the communication management operations further comprise:

i) detecting negotiation of a secure communication pathway between a first remote node and the virtual device, the negotiation comprising a series of network packet communications between the first remote node and the virtual device;

ii) aligning a series of cryptographic keys utilized in the hypervisor with a series of cryptographic keys utilized in the virtual device;

iii) monitoring the series of network packet communications; and

iv) confirming success of the negotiation prior to the passing the authorized first network packet.

3. The product of claim 2, wherein the monitoring comprises:

a) detecting a nonpublic first identification code sent from the virtual device to a software port on the first remote node via a pre-established communication pathway;

followed by

b) further detecting a nonpublic second identification code sent from the remote node; and

c) comparing the nonpublic second identification code with a pre-established value for the first remote node.

4. The product of claim 3, wherein the communication management operations comprise:

determining the pre-established value for the first remote node from a software port number assigned to the software port.

5. The product of claim 3, wherein the monitoring comprises:

a) detecting a first application identification code for a first user-application sent from the virtual device to the first remote node via the pre-established communication pathway;

followed by

b) detecting a second application identification code for a second user-application sent from the first remote node; and

c) comparing the second application identification code with a pre-established value for the second user-application.

6. The product of claim 5, wherein the communication management operations comprise:

determining the pre-established value for the first remote node from the software port number.

7. The product of claim 1, wherein the communication management operations comprise:

determining the one or more first expected values from a one-to-one correspondence with an n-tuple comprising the one or more first expected values, a destination port number of the first network packet, and a destination network address of the first network packet.

8. The product of claim 7, wherein the one or more first packet parameters comprise a source application identification code, the source application identification code referencing a source application program for the first network packet.

9. The product of claim 8, wherein the one or more first packet parameters comprise a data model identification code.

10. The product of claim 9, wherein the communication management operations comprise:

confirming at least a portion of a payload of the first network packet conforms to a data range, the data range determined from the data model identification code.

11. The product of claim 9, wherein the communication management operations comprise:

confirming at least a portion of the payload of the first network packet conforms to a command type restriction, the command type restriction determined from the data model identification code.

12. The product of claim 9, wherein the communication management operations comprise:

translating a first payload of the first network packet from a first pre-established format to a second pre-established format, the first pre-established format and the second pre-established format determined from the data model identification code and/or the destination port number.

13. The product of claim 7, wherein the communication management operations comprise:

obtaining the one-to-one correspondence from an encrypted file loaded into memory of the hypervisor.

14. The product of claim 7, wherein the communication management operations comprise:

obtaining the one-to-one correspondence from the virtual device via at least one encrypted communication pathway.

15. The product of claim 1, wherein the communication management operations further comprise:

i) intercepting a second network packet in the hypervisor, the second network packet ingressed from the virtual device, the second network packet comprising a second higher-than-OSI layer three portion;

ii) decrypting, with a single-use cryptographic key, at least a portion of the second higher-than-OSI layer three portion to obtain at least one packet parameter;

iii) authorizing the second network packet in the hypervisor, comprising;

comparing the one or more second packet parameters with one or more second expected values; and

iv) passing the authorized second network packet to a remote second node.

16. The product of claim 1, wherein the virtual device is a virtual machine.

17. The product of claim 1, wherein the virtual device is a container.

18. The product of claim 1, wherein the communication management operations comprise:

obtaining the at least one packet parameter from a payload of the first network packet.

19. The product of claim 1, wherein the first remote node is a bare metal device.

20. The product of claim 1, wherein the first remote node is a further virtual device.

21. The product of claim 1, wherein the hypervisor provides at least one virtual interface to the virtual device.

22. The product of claim 1, wherein the communication management operations are configured for a Type 1 hypervisor.

23. The product of claim 1, wherein the communication management operations are configured for a Type 2 hypervisor.

24. The product of claim 1, wherein the communication management operations are transparent to the virtual device and all computer programs running on the virtual device.