Security protocols on incompatible transports

• US 20060206705A1
• Filed: 03/10/2005
• Published: 09/14/2006
• Est. Priority Date: 03/10/2005
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Khosravi, Hormuzd
• Granted Patent: US 7,743,245 B2
• Time in Patent Office: Days
• US Class Current: 713/151
• CPC Class Codes: H04L 63/16 Implementing security features at a particular protocol layer
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/164 Adaptation or special uses of UDP protocol
• CPC Class Codes: H04L 69/169 Special adaptations of TCP, UDP or IP for interworking of IP based networks with other networks protocols for interworking, protocol conversion H04L69/08
• CPC Class Codes: H04L 69/32 Architecture of open systems interconnection [OSI] 7-layer type protocol stacks, e.g. the interfaces between the data link level and the physical level
• CPC Class Codes: H04L 69/326 in the transport layer [OSI layer 4] H04L69/16 takes precedence

Abstract

“Honest” is a nice word. Sadly, some people in this world are not honest. In an increasingly wired world, dishonest people have found myriad opportunities to illicitly acquire one'"'"'s confidential data, to monitor or interfere with one'"'"'s networking activities, e.g., to monitor what you are doing, downloading, accessing, etc., to eavesdrop on or hijack telephony control and voice data or other protocols on your network, etc. To address such risks, typically a secured communication protocol, e.g., TLS or SSL, is utilized to protect communication. Unfortunately, TLS, SSL, and many other security environments require the underlying communication protocol to be TCP/IP, while some protocols needing communication protection, such as VoIP, RTP, SNMP, etc. only operate on UDP and not TCP/IP. Thus, a network shim or other embodiments disclosed herein may be used to allow such UDP based application programs and protocols to use security environments requiring a TCP/IP type transport.

Claims

1. A method for communicating between a first and a second machine using the User Datagram Protocol (UDP), comprising:

providing a reliability delivery layer (RDL) interface to the UDP;

establishing a UDP connection between the first and the second machine; and

establishing a transport layer security over the RDL interface to the UDP, wherein the transport layer security is incompatible with the UDP.

2. The method of claim 1, wherein the transport layer security operates in accord with a selected one of the Transport Layer Security (TLS) or Secure Sockets Layer (SSL) protocols.

3. The method of claims 1 or 2, wherein the RDL is incorporated into the transport layer security.

4. The method of claim 1, further comprising:

providing an object file for an application program written to utilize the UDP for communicating between the first and the second machine;

providing a link library prepared to utilize networking calls to the transport layer security for engaging in network communication; and

making an executable binary for the application program based at least in part on linking the binary object file with the link library.

5. The method of claim 1, wherein the RDL provides the UDP with data corruption detection/correction, data loss detection/correction and fragmentation/reassembly functionality.

6. The method of claim 5, wherein the RDL further provides the UDP with selected ones of data corruption correction, data loss correction, or data fragmentation reassembly.

7. A method for utilizing a transport layer security compatible with a reliable transport over an incompatible unreliable transport, the method comprising:

providing a reliability delivery layer (RDL) interface to the unreliable transport, the RDL adding selected ones of data corruption detection and data loss detection to the unreliable transport and masking incompatibility of the unreliable transport;

establishing a communication session using the unreliable transport; and

establishing a secure communication session using the transport layer security over the RDL interface.

8. The method of claim 7, further comprising:

executing an application program incompatible with the reliable transport but compatible with the unreliable transport; and

providing a virtual execution environment mapping networking calls to the unreliable transport to calls to the RDL interface.

9. The method of claims 8 or 7, wherein the unreliable transport is the UDP (User Datagram Protocol).

10. The method of claim 7, wherein the transport layer security is a selected one of TLS (Transport Layer Security) or SSL (Secure Sockets Layer).

11. The method of claim 7, wherein the unreliable transport lacks in-sequence data delivery, and wherein the RDL provides in-sequence data delivery to the second transport.

12. The method of claim 7, wherein the RDL comprises a protocol wrapper for the unreliable transport (UTP).

13. A method for utilizing a transport layer security over an incompatible unreliable transport, comprising:

modifying a network application program to substitute selected networking calls in the network application program to the unreliable transport with networking calls to the transport layer security;

installing a reliability delivery layer (RDL) in a network stack above the unreliable transport to masquerade the unreliable transport as a reliable transport compatible with the transport layer security; and

configuring the transport layer security to utilize the RDL.

14. The method of claim 13, wherein modifying the network application program comprises modifying a source code of the network application program to replace networking calls therein with corresponding calls to the transport layer security.

15. The method of claim 13, further comprising:

establishing a secure communication session from the network application program over the RDL masquerading the unreliable transport as compatible with the transport layer security.

16. An article comprising a machine-accessible medium having one or more associated instructions for communicating between a first and a second machine using the User Datagram Protocol (UDP), wherein the one or more instructions, if executed, results in a machine performing:

providing a reliability delivery layer (RDL) interface to the UDP;

establishing a UDP connection between the first and the second machine; and

establishing a transport layer security over the RDL interface to the UDP, wherein the transport layer security is incompatible with the UDP.

17. The article of claim 16, wherein the associated instructions for the transport layer security further include instructions, which if executed, results in the transport layer security operating in accord with a selected one of:

the Transport Layer Security (TLS) or Secure Sockets Layer (SSL) protocols.

18. The article of claim 16, wherein the associated instructions further include instructions, which if executed, results in the machine performing:

providing an object file for an application program written to utilize the UDP for communicating between the first and the second machine;

providing a link library prepared to utilize networking calls to the transport layer security for engaging in network communication; and

making an executable binary for the application program based at least in part on linking the binary object file with the link library.

19. An article comprising a machine-accessible medium having one or more associated instructions for utilizing a transport layer security compatible with a reliable transport over an incompatible unreliable transport, wherein the one or more instructions, if executed, results in a machine performing:

providing a reliability delivery layer (RDL) interface to the unreliable transport, the RDL adding selected ones of data corruption detection and data loss detection to the unreliable transport and masking incompatibility of the unreliable transport;

establishing a communication session using the unreliable transport; and

establishing a secure communication session using the transport layer security over the RDL interface.

20. The article of claim 19, wherein the associated instructions further include instructions, which if executed, results in the machine performing:

executing an application program incompatible with the reliable transport but compatible with the unreliable transport; and

providing a virtual execution environment mapping networking calls to the unreliable transport to calls to the RDL interface.

21. An article comprising a machine-accessible medium having one or more associated instructions for utilizing a transport layer security over an incompatible unreliable transport, wherein the one or more instructions, if executed, results in a machine performing:

modifying a network application program to substitute selected networking calls in the network application program to the unreliable transport with networking calls to the transport layer security;

installing a reliability delivery layer (RDL) in a network stack above the unreliable transport to masquerade the unreliable transport as a reliable transport compatible with the transport layer security; and

configuring the transport layer security to utilize the RDL.

22. The article of claim 21, wherein the associated instructions further include instructions, which if executed, results in the machine performing:

establishing a secure communication session from the network application program over the RDL masquerading the unreliable transport as compatible with the transport layer security.