Systems and methods for securely transferring selective datasets between terminals

• US 10,389,685 B2
• Filed: 08/17/2017
• Issued: 08/20/2019
• Est. Priority Date: 08/17/2017
• Status: Active Grant

• Current Assignee: Saudi Arabian Oil Company (Government of Saudi Arabia)
• Original Assignee: Saudi Arabian Oil Company (Government of Saudi Arabia)
• Inventors: Alkhabbaz, Fouad M., Al-Zahir, Hussain, Al-Maatoug, Maatoug, Abu Al Saud, Zakarya A.
• Primary Examiner(s): Lynch, Sharon S
• Application Number:
  US15/679,669
• Publication Number:
  US 20190058693A1
• Time in Patent Office: 733 Days
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 69/169 Special adaptations of TCP, UDP or IP for interworking of IP based networks with other networks protocols for interworking, protocol conversion H04L69/08

Abstract

Systems and methods for securely transmitting data between terminals include receiving, by a first communication device, an internet protocol (IP) packet via a first application programming interface (API) running on a first computer, dividing, by a splitting unit in the first communication device, the IP packet into a command portion and a data portion, encoding, by a data encoding unit in the first communication device, the data portion into a text delimited non-IP format, transmitting, by a transmitting unit in the first communication device, the encoded data portion and the command portion, receiving, by a second communication device, the encoded data portion and the command portion, decoding, by a data decoding unit in the second communication device, the encoded data portion into IP format, combining, by a constructor unit in the second communication device, the decoded data portion and the command portion to regenerate the IP packet, and receiving, by a second API running on a second computer, the regenerated IP packet.

Claims

1. A method for securely transmitting data between two terminals connected via a computer network, the method comprising:

receiving, by a first communication device of the two terminals, an internet protocol (IP) packet via a first application programming interface (API) running on a first computer;

dividing, by a splitting unit in the first communication device, the IP packet into a command portion and a data portion, wherein the data portion comprises at least one of a customer name, customer address, fuel type, fuel price and fuel quantity;

encoding, by a data encoding unit in the first communication device, the data portion into a text delimited non-IP format; and

transmitting, by a transmitting unit in the first communication device, the encoded data portion and the command portion to a second communication device from the two terminals;

receiving, by the second communication device, a second IP packet via a second API running on the second computer;

dividing, by a splitting unit in the second communication device, the second IP packet into a command portion and a data portion;

determining, by one or more processors in the second communication device, when the command portion is whitelisted;

encoding, by a command encoding unit in the second communication device, the command portion into a non-IP format when the command portion is whitelisted; and

transmitting, by a transmitting unit in the second communication device, the encoded command portion and the data portion.

2. The method of claim 1, further comprising:

receiving, by a second communication device, the encoded data portion and the command portion;

decoding, by a data decoding unit in the second communication device, the encoded data portion into IP format;

combining, by a constructor unit in the second communication device, the decoded data portion and the command portion to regenerate the IP packet; and

receiving, by a second API running on a second computer, the regenerated IP packet.

3. The method of claim 1, further comprising:

receiving, by the first communication device, the encoded command portion and the data portion;

decoding, by a command decoding unit in the first communication device, the encoded command portion into IP format;

combining, by a constructor unit in the first communication device, the decoded command portion and the data portion to regenerate the second IP packet; and

receiving, by the first API running on the first computer, the regenerated second IP packet.

4. The method of claim 1, wherein the command portion comprises at least one of a source address, destination address, and checksum, for data integrity.

5. The method of claim 1, wherein encoding the command portion comprises 3-bit encoding of the command portion using out of bound digital command circuitry.

6. The method of claim 1, wherein the encoding is selected from the group consisting of dual frequency tone encoding, 4-20 mA encoding, millivolt encoding, and light pulse repetition frequency encoding.

7. A system for securely transmitting data between two terminals connected via a computer network, the system comprising:

a first communication device of the two terminals connected to a first computer on the network, the first communication device comprising memory, a first splitting unit, a first data encoding and decoding unit, a first command encoding and decoding unit, a first constructor unit, and a first transceiver for sending and receiving IP packets over the network; and

a second communication device from the two terminals connected to a second computer on the network, the second communication device comprising a second splitting unit, a second data encoding and decoding unit, a second command encoding and decoding unit, a second constructor unit, and a second transceiver for sending and receiving IP packets over the network, wherein the first communication device is configured to;

receive an internet protocol (IP) packet via a first application programming interface (API) running on the first computer;

divide the IP packet into a command portion and a data portion using the first splitting unit, wherein the data portion comprises at least one of a customer name, customer address, fuel type, fuel price and fuel quantity;

encode the data portion into a text delimited non-IP format using the first data encoding unit; and

transmit the encoded data portion and the command portion using the first transceiver to the second communication device;

wherein the second communication device is further configured to;

receive a second IP packet via a second API running on the second computer;

divide the second IP packet into a command and a data portion using the second splitting unit;

determine, using one or more processors in the second communication device, when the command portion is whitelisted;

encode the command portion into a non-IP format using the second command encoding unit; and

transmit the encoded command portion and the data portion using the second transceiver.

8. The system of claim 7, wherein the second communication device is configured to:

receive the encoded data portion and the command portion;

decode the encoded data portion into IP format using the second decoding unit;

combine the decoded data portion and the command portion to regenerate the IP packet using the second constructor unit; and

transmit the regenerated IP packet to a second API running on the second computer.

9. The system of claim 7, wherein the first communication device is further configured to:

receive the encoded command portion and the data portion;

decode the encoded command portion into IP format using the first decoding unit;

combine the decoded command portion and the data portion to regenerate the second IP packet using the first constructor unit; and

transmit the regenerated second IP packet to the first API running on the first computer.

10. The system of claim 7, wherein the command portion comprises at least one of a source address, destination address, and checksum, for data integrity.

11. The system of claim 7, wherein encoding the command portion comprises 3-bit encoding of the command portion using out of bound digital command circuitry.

12. The system of claim 7, wherein the encoding is selected from the group consisting of dual frequency tone encoding, 4-20 mA encoding, millivolt encoding, and light pulse repetition frequency encoding.

13. A non-transitory computer-readable medium including instructions stored thereon, which when executed by one or more processors operatively coupled to the computer-readable medium, cause the one or more processors to perform operations for securely transmitting data between two terminals connected via a computer network, wherein the operations comprise:

receiving an internet protocol (IP) packet via a first application programming interface (API) running on a first computer of the two terminals;

dividing the IP packet into a command portion and a data portion, wherein the data portion comprises at least one of a customer name, customer address, fuel type, fuel price and fuel quantity;

encoding the data portion into a text delimited non-IP format; and

transmitting the encoded data portion and the command portion to a second computer of the two terminals;

receiving, by the second computer, a second IP packet via a second API running on the second computer;

dividing, by the second computer, the second IP packet into a command portion and a data portion;

determining, by the second computer, when the command portion is whitelisted;

encoding, by the second computer, the command portion into a non-IP format when the command portion is whitelisted; and

transmitting, by the second computer, the encoded command portion and the data portion.

14. The medium of claim 13, further causing the one or more processors to perform operations comprising:

receiving an encoded command portion and a data portion;

decoding the encoded command portion into IP format;

combining the decoded command portion and the data portion to regenerate a second IP packet; and

transmitting the regenerated second IP packet.