Enterprise data protection management for providing secure communication in a network

• US 20080072281A1
• Filed: 09/11/2007
• Published: 03/20/2008
• Est. Priority Date: 09/14/2006
• Status: Abandoned Application

• Current Assignee: Certes Networks, Inc.
• Original Assignee: Certes Networks, Inc.
• Inventors: Willis, Ronald, Starrett, Charles
• Application Number:
  US11/900,260
• Publication Number:
  US 20080072281A1
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

System and methods for providing an intelligent overlay for providing dynamic control policies, keys and management of same for secure communication of information, data and/or communication over a network without requiring any change in the network hardware or infrastructure and requiring a minimum number of policies and SAs to create a full mesh, wherein the number of policies is less than N(N−1) and number of SAs is less than 2N(N−1), where N is the number of end points on the network.

Claims

1. A system for providing secure networks comprising:

a communication network having a network infrastructure; and

an intelligent software overlay operating on a server in connection to the network for providing security for the network;

wherein the intelligent software overlay further includes;

a management and policy (MAP) server coupled to the network for communication with at least one key authority point (KAP), wherein the MAP includes at least one policy for providing secure association (SA) within the network;

wherein the at least one KAP is operable to generate and manage keys provided to a multiplicity of policy end points (PEPs) through an open API;

and wherein the intelligent overlay to the network is independent of the network infrastructure and requires a minimum number of policies and SAs to create a full mesh, wherein the number of policies is less than N(N−

1) and number of SAs is less than 2N(N−

1), where N is the number of end points,

thereby providing a secure, flexible network security solution.

2. The system of claim 1, wherein the intelligent overlay is dynamically modifiable to reconfigure secure PEP interactivity without-requiring change to the network infrastructure.

3. The system of claim 1, wherein the system is scalable without increasing the number of policies and SAs required to create a full mesh.

4. The system of claim 1, wherein the number of policies is between 1 and less than N(N−

1), and the corresponding number of SAs is between 2 and less than 2N(N−

1).

5. A method for providing secure interactivity between points on a network comprising the steps of:

providing a communication network having a network infrastructure between a multiplicity of policy end points (PEPs);

providing an intelligent software overlay that is independent of the network infrastructure, the software overlay operating on a server in connection to the network for providing security for the network;

wherein the intelligent software overlay further includes;

a management and policy (MAP) server coupled to the network for communication with at least one key authority point (KAP);

the MAP establishing and managing at least one policy for providing secure association (SA) between PEPs within the network;

the KAP generating and managing keys and providing them to the PEPs through an open API;

and the PEPs having secure exchange over the network using the keys provided by the KAP;

wherein the intelligent overlay to the network is independent of the network infrastructure and requires a minimum number of policies and SAs to create a full mesh, wherein the number of policies is less than N(N−

1) and number of SAs is less than 2N(N−

1), where N is the number of end points.