Secure network architecture method and apparatus

• US 20010052080A1
• Filed: 12/20/2000
• Published: 12/13/2001
• Est. Priority Date: 10/24/1997
• Status: Active Grant

• Current Assignee: III Holdings 1, LLC
• Original Assignee: Richard G Dusenbury Jr.
• Inventors: Dusenbury, Richard G. Jr.
• Granted Patent: US 7,225,463 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: H04L 63/0421 Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity

Abstract

A secure network architecture method and apparatus that provides security at all levels of the network. The system and method of the present invention provides communications profiles for all network resources that uniquely identify the individual network resources and provide for absolute object identity. Communications over the network are managed at all levels by the network resources themselves by virtue of individual communications profiles that are policed by arbitrators and network resources alike.

Claims

1. A system for providing security in a network comprising a plurality of network resources each having a communication profile and a unique identifier, each network resource being connected to communicate with another network resource only if permitted by the communication profile of each network resource.

2. The system of

claim 1

, further comprising a central directory communicating with said network resources to establish said communication profile and unique identifier for each of said network resources.

3. The system of

claim 2

, wherein said central directory includes a database of cryptographic elements for distribution to network resources.

4. The system of

claim 3

, further including means for supplying cryptographic elements from a unique random number generator to said central directory.

5. The system of

claim 4

, wherein the unique random number generator includes means for checking a newly generated number against a database of previously generated numbers and if the new number has not been previously generated, stores the new number for later use.

6. The system of

claim 2

, wherein said network resources include at least one arbitrator with its own communication profile and unique identifier, said arbitrator receiving communications destined for network resources and transmitting the communications to the network resources.

7. The system of

claim 6

, wherein said arbitrator includes means for metering usage of the network resources.

8. The system of

claim 6

, wherein said arbitrator includes means for testing the communication profile of network resources to determine if a communication is authorized.

9. The system of

claim 8

, wherein the arbitrator further comprises storage means in which is stored the most frequently needed communication profiles of network resources to which the arbitrator can transmit communications and in which is further stored the most frequently needed communication profiles of network resources from which the arbitrator can receive communications.

10. The system of

claim 6

, wherein each said network resource includes means for testing a received communication by checking the type of communication against at least one communication profile.

11. The system of

claim 6

, wherein the arbitrator includes means for providing a cryptographic element to a transmitting network resource.

12. The system of

claim 11

, wherein the arbitrator includes means for receiving cryptographic elements from the central directory in response to a request from the arbitrator.

13. The system of

claim 11

, wherein the arbitrator includes means for receiving cryptographic elements from another arbitrator.

14. The system of

claim 1

, wherein said plurality of network resources includes at least one cellular telephone.

15. The system of

claim 14

, further including an analog authorization module connected to said cellular telephone and communicating with an authentication network resource.

16. The system of

claim 1

, wherein the network resources include a plurality of workstations.

17. The system of

claim 16

, wherein each workstation includes means to check communications to be transmitted from the workstation and to permit the transmission to occur only if it is permitted by at least one workstation'"'"'s communication profile.

18. The system of

claim 16

, wherein each workstation includes means to check communication to be received and permits reception to occur only if reception of said communication is permitted by at least one workstation'"'"'s communication profile.

19. The system of

claim 16

, wherein each workstation includes means to request cryptographic elements from an arbitrator.

20. The system of

claim 19

, wherein the cryptographic element is a bit ring.

21. The system of

claim 1

, wherein at least one of said plurality of network resources is a container consisting of media resources.

22. The system of claim of

claim 1

, wherein each of said plurality of network resources is a container which includes digital information.

23. The system of claim of

claim 22

, wherein the information is encrypted.

24. The system of claim of

claim 23

, wherein the container includes an Unpredictable Error Detection and Correction Code, whereby any modification to the container information is detectable.

25. The system of claim of

claim 22

, wherein the container information includes audio/visual data.

26. The system of claim of

claim 22

, wherein the container information comprises access privileges to other network resources.

27. The system of

claim 1

, wherein the network is selected from the group consisting of cellular networks, media distribution networks, computer networks and any combination thereof, and wherein said network resources are connectable to the selected network.

28. The system of

claim 6

, wherein the arbitrator includes software for monitoring communications from a transmitting network resource, checking said communication against the communication profile of the transmitting network resource and permitting further transmission of the communication only if permitted by the communication profile of the transmitting network resource.

29. The system of

claim 6

, wherein the arbitrator includes software for monitoring communications from a transmitting network resource, checking the communication against the communication profile of a receiving network resource, and permitting the communication to be further transmitted only if it is of the type permitted by the communication profile of the receiving network resource.

31. The method of

claim 29

, further including transmitting communications from a network resource only if permitted by the network resource'"'"'s communication profile.

32. The method of

claim 29

, further including receiving communications by a network resource only if permitted by the network resource'"'"'s communication profile.

33. The method of

claim 32

, further including transmitting communications from a network resource only if permitted by the network resource'"'"'s communication profile.

34. The method of

claim 33

, further including connecting said plurality of network resources to a network selected from the group comprising cellular networks, media distribution networks, computer networks and any combinations thereof.

30. A method for establishing secure communication comprising:

establishing a communications profile and a unique identifier on a plurality of network resources on the network.

35. The method of

claim 30

, further including establishing in at least one of said network resources, information about the communication profiles of other network resources to provide an arbitrator.

36. The method of

claim 35

, further comprising:

receiving at the arbitrator a communication transmitted by a transmitting network resource and destined for a destination network resource; and

re-transmitting the communication to the destination network resource.

37. The method of

claim 36

, further comprising:

checking the received communication against the communication profile of the arbitrator;

accepting the communication for re-transmission if the communication profile of the arbitrator allows it to be received; and

rejecting the communication for re-transmission if the communication profile of the arbitrator does not allow it to be received by the arbitrator.

38. The method of

claim 35

, further comprising:

checking the communication profile of a destination network resource;

rejecting re-transmission of the communication to a destination network resource if the communication is not allowed by the destination network resource communication profile; and

allowing re-transmission of the communication to the destination network resource if the communication is allowed by the destination network resource communication profile.

39. The method of

claim 30

, wherein establishing a communication profile and unique identifier on each of a plurality of network resources includes establishing a plurality of workstations each with its own communication profile.

40. The method of

claim 39

, further comprising transmitting communications from a workstation only if permitted by said workstation'"'"'s communication profile.

41. The method of

claim 39

, further comprising receiving communications at a workstation only if permitted by said workstation'"'"'s communication profile.

42. The method of

claim 41

, further comprising permitting transmission of communications by a workstation only if the communication is permitted by said workstation'"'"'s communication profile.

43. The method of

claim 35

, further comprising transferring cryptographic elements from the arbitrator to a network resources when said cryptographic elements are needed for communications.

44. The method of

claim 43

, further comprising transferring cryptographic elements from a central directory to said arbitrator.

45. The method of

claim 35

, further comprising storing in a central directory, unique random numbers from a unique random number generator for use in producing said communication profiles and unique identifiers for said network resources.

46. The method of

claim 45

, further including generating in said central directory the communication profile for said arbitrator.

47. The method of

claim 30

, further comprising encrypting information in said network resources.

48. The method of

claim 47

, further including preventing undetected modification of encrypted information in the network resources.

49. The method of

claim 30

, further including providing access privileges to said network resources.

50. The method of

claim 35

, further including:

receiving at said arbitrator a communication from a transmitting network resource;

encrypting the communication at said arbitrator and re-transmitting the encrypted communication to a network distribution resource, the network distribution resource broadcasting the encrypted communication; and

the arbitrator providing to a network resource a means to decrypt the encrypted communication broadcast from the network distribution resource.

83. The method of

claim 30

, further including preventing undetected modification of unencrypted information exchanged by network resources.

51. Apparatus for guaranteeing absolute object identity comprising:

a generator generating unique random numbers;

a central directory connected to the generator to receive the unique random numbers from the generator, the central directory including means to provide a loader applet which incorporates at least one of the unique random numbers;

at least one arbitrator connected to the central directory to receive the loader applet; and

at least one network resource communicating with said at least one arbitrator to receive said loader applet.

52. The apparatus of

claim 51

, wherein said at least one network resource includes a transmitting network resource and a receiving network resource.

53. The apparatus of

claim 52

, wherein each of the network resources has its own unique object identity.

54. The apparatus of

claim 53

, wherein said at least one arbitrator includes means to provide a cryptographic element to a transmitting network resource in advance of the transmitting network resource transmitting any sensitive communication.

55. The apparatus of

claim 54

, wherein said at least one arbitrator is connected to receive cryptographic elements from the central directory in response to a request from said arbitrator.

56. The apparatus of

claim 54

, wherein said at least one arbitrator is connected to receive cryptographic elements from another arbitrator for subsequent transmission to a transmitting network resource.

57. The apparatus of

claim 54

, wherein said cryptographic element is a bit ring.

58. The apparatus of

claim 53

, wherein each network resource includes means to request cryptographic elements from an arbitrator when communications to be transmitted are to be encrypted.

59. The apparatus of

claim 52

, wherein said central directory further includes a database of cryptographic elements for distribution to network resources.

60. The apparatus of

claim 51

, wherein said at least one network resource comprises at least one container comprising information.

61. The apparatus of

claim 60

, wherein said information is encrypted.

62. The apparatus of

claim 61

, wherein said encrypted information can be decrypted only if unmodified.

63. A method for establishing absolute object identity comprising:

generating unique random numbers;

transmitting the unique random numbers to a central directory;

creating in said central directory communication profiles incorporating said unique random numbers;

providing said communication profiles to at least one arbitrator; and

transferring different communication profiles from said arbitrator to each of a plurality of network resources for establishing a unique identity for each network resource.

64. The method of

claim 63

, further comprising:

supplying cryptographic elements from the arbitrator to a network resource when communications from the network resource are to be encrypted.

65. The method of

claim 64

, further comprising:

supplying a cryptographic element to said arbitrator from a central directory in response to a request for a cryptographic element from a network resource.

66. The method of

claim 63

, further comprising:

supplying cryptographic elements from the central directory to the arbitrator in response to a request from the arbitrator.

67. The method of

claim 63

, further comprising:

supplying unique random numbers from a unique random number generator to said central directory; and

generating bit rings from the unique random numbers received by the central directory.

68. A method for creating absolute object identity for objects on a network comprising:

creating a plurality of unique numbers;

conveying the unique numbers to a central directory;

creating in the central directory plurality communication profiles, each based in part on a corresponding unique number, each communication profile comprising at least a receive profile, a transmit profile, and unique identifier; and

supplying an individual communication profile to each of a plurality of network resources on the network.

69. The method of

claim 68

, further comprising:

transmitting communications from a transmitting network resource only if permitted by the transmitting network resource'"'"'s communication profile; and

receiving communications by a receiving network resource only if permitted by the receiving resource'"'"'s communication profile.

70. The method of

claim 69

, wherein receiving communications by a receiving network resource includes:

transferring communications transmitted by a transmitting network resource to a network resource serving as an arbitrator; and

re-transmitting the communications from the arbitrator to a destination network resource.

71. The method of

claim 70

, further comprising:

checking communications received by the arbitrator against the communication profile of the arbitrator;

accepting the communication for re-transmission if its reception is permitted by the arbitrator communication profile; and

rejecting the communication for further re-transmission if its reception is not permitted by the arbitrator communication profile.

72. The method of

claim 71

, further comprising:

storing in the arbitrator the most frequently needed communication profiles of network resources with which communication is permitted.

73. The method of

claim 72

, further comprising:

checking the communication profile of the receiving network resource stored in the arbitrator;

rejecting re-transmission of the communication to the destination network resource if the communication is not permitted by the receiving network resource; and

allowing re-transmission of the communication to the destination network resource if the communication is permitted by the destination network resource communication profile.

74. A system for controlling communication between network resources, comprising:

a plurality of arbitrators;

a plurality of network resources in communication with each of said arbitrators, each arbitrator and each of said network resources incorporating a corresponding communication profile for controlling receipt and transmission of communications; and

a central directory connected to each of said arbitrators for supplying said corresponding communication profiles to said arbitrators and said network resources.

75. The system of

claim 74

, further including a generator supplying unique random numbers to said central directory for providing a guaranteed unique identifier with each of said communication profiles to ensure absolute object identity for each of said arbitrators and network resources.

76. The system of

claim 75

, wherein said central director includes a database of cryptographic elements for distribution to arbitrators and network resources for encryption of communications between network resources.

77. The system of

claim 75

, wherein each of said arbitrators is connected to a corresponding set of network resources, and wherein said arbitrators are interconnected to permit communication between network resources through corresponding arbitrators.

78. The system of

claim 77

, wherein each of said arbitrators includes the most frequently needed communication profiles of its corresponding network resources.

79. The system of

claim 78

, wherein each communication profile includes a transmit profile and a receive profile to regulate the transmission and reception, respectively, of communications by each of said arbitrators and each of said network resources.

80. The system of

claim 79

, wherein at least one of said network resources is a cellular telephone, connectable to a cellular telephone network.

81. The system of

claim 79

, wherein at least one of said network resources is connectable to a media distribution network through or corresponding arbitrator.

82. The system of

claim 79

, wherein at least one of said network resources is a computer connectable to a network through a corresponding arbitrator.