METHODS AND SYSTEMS FOR MANAGING CONCURRENT UNSECURED AND CRYPTOGRAPHICALLY SECURE COMMUNICATIONS ACROSS UNSECURED NETWORKS

• US 20120084838A1
• Filed: 05/11/2011
• Published: 04/05/2012
• Est. Priority Date: 01/31/2005
• Status: Active Grant

• Current Assignee: Robert Alan Johnson, Sarah K. Inforzato, Ted Hinaman
• Original Assignee: Unisys Corporation
• Inventors: Inforzato, Sarah K., Johnson, Robert A., Hinaman, Ted
• Granted Patent: US 9,525,666 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32

Abstract

An endpoint, method, and authorization server are disclosed which can be used to allow concurrent secure and clear text communication. An endpoint includes a computing system including a programmable circuit operatively connected to a memory and a communication interface, the communication interface configured to send and receive data packets via a data communications network. The endpoint also includes a filter defined in the memory of the computing system, the filter configured to define one or more access lists, each access list defining a group of access permissions for a community of interest. The community of interest includes one or more users, and an access list from among the one or more access lists defines a set of clear text access permissions associated with a community of interest. The endpoint also includes a driver executable by the programmable circuit, the driver configured to cooperate with the communication interface to send and receive data packets via the data communications network. The driver is also configured to selectively split and encrypt data into a plurality of data packets to be transmitted via the data communications network based at least in part upon the contents of the one or more access lists.

Claims

1. An endpoint comprising:

a computing system including a programmable circuit operatively connected to a memory and a communication interface, the communication interface configured to send and receive data packets via a data communications network;

a filter defined in the memory of the computing system, the filter configured to define one or more access lists, each access list defining a group of access permissions for a community of interest, wherein the community of interest includes one or more users, and wherein an access list from among the one or more access lists defines a set of clear text access permissions associated with a community of interest;

a driver executable by the programmable circuit, the driver configured to cooperate with the communication interface to send and receive data packets via the data communications network, the driver configured to selectively split and encrypt data into a plurality of data packets to be transmitted via the data communications network based at least in part upon the contents of the one or more access lists.

2. The endpoint of claim 1, further comprising virtual private network software stored in the memory and configured to connect to a second endpoint using a dedicated secure tunnel established between the endpoint and the second endpoint, wherein the second endpoint is listed in the access list defining a set of access permissions.

3. The endpoint of claim 1, wherein each access list defines a group of access permissions for a plurality of different communities of interest.

4. The endpoint of claim 1, wherein the driver is configured to pass a data packet containing clear text data to the communication interface only upon determining that a destination defined in the data packet is granted a clear text access permission in at least one of the one or more access lists.

5. The endpoint of claim 1, wherein the set of clear text access permissions includes a list of one or more network destinations incapable of decrypting and combining the split and encrypted data.

6. The endpoint of claim 1, wherein the one or more network destinations include network destinations selected from the group consisting of:

a second endpoint;

a subnet; and

a gateway for a virtual private network.

7. The endpoint of claim 1, wherein the set of clear text access permissions includes a list of one or more endpoints capable of decrypting and combining the split and encrypted data, and wherein the driver is configured to prevent transmission of clear text data from the endpoint to the one or more endpoints.

8. The endpoint of claim 1, wherein the driver is further configured to the driver configured to decrypt and combine data received in one or more data frames at the communication interface to recreate a message for use at the endpoint.

9. The endpoint of claim 8, wherein the driver is further configured to inspect the plurality of data packets, and, upon determining that the received data is from an authorized source, forward the message from the communication interface to one or more applications executing at the endpoint.

10. The endpoint of claim 1, further comprising a monitoring application operable on the programmable circuit and configured to provide administrative access to information regarding the filter and operational status of the driver.

11. A method of authorizing an endpoint for use in a secure network, the method comprising:

transmitting a request from the endpoint to authorize a user of the endpoint for operation on the secure network, the request including an identity of a user of the endpoint;

receiving at the endpoint a set of one or more keys associated with communities of interest, the communities of interest defined to include the user; and

receiving at the endpoint one or more filters defining one or more access lists, wherein an access list from among the one or more access lists defines a set of clear text access permissions associated with a community of interest.

12. The method of claim 11, wherein transmitting the request comprises transmitting user credentials from the endpoint to an authorization server.

receiving from the authorization server a filter configured to define one or more access lists, each access list defining a group of access permissions for a community of interest, and wherein a first access list from among the one or more access lists defines a set of clear text access permissions associated with a community of interest;

transmitting data packets from the endpoint to a network location, the data packets selectively split and encrypted based at least in part upon the contents of the one or more access lists.

13. The method of claim 11, wherein each access list defines a group of access permissions for one of the communities of interest including the user.

14. The method of claim 11, wherein the first access list further defines a set of permissions associated with the community of interest used to require data transmitted to one or more network locations to be split and encrypted prior to transmission.

15. The method of claim 11, wherein the filter received from the authorization server further defines a second access list defining a set of access permissions associated with a second community of interest.

16. The method of claim 11, further comprising forming a first virtual network adapter configured to communicate clear text data and a second virtual network adapter configured to communicate split and encrypted data.

17. The method of claim 11, further comprising forming a virtual private network connection between the endpoint and a network location, wherein the network location is included in the clear text access permissions of the access list.

18. An authorization system integrable into a secure network, the authorization system comprising:

an authorization server including a programmable circuit communicatively connected to a memory;

a provisioning utility executable on the programmable circuit, the provisioning utility including program instructions which, when executed, cause the authorization server to;

in response to a request from an endpoint to authorize a user of the endpoint for operation on the secure network, determine a set of communities of interest associated with the user defined in the provisioning utility;

respond to the request by sending to the endpoint a set of one or more keys, associated with communities of interest, the communities of interest defined to include the user; and

sending to the endpoint one or more filters defining one or more access lists, wherein an access list from among the one or more access lists defines a set of clear text access permissions associated with a community of interest.

19. The authorization system of claim 18, wherein the communities of interest associated with the user are defined in the provisioning utility by an authorization administrator.

20. The authorization system of claim 18, further comprising a communication status application executing at the endpoint, wherein the communication status application provides information to an administrative user regarding use of the one or more filters at the endpoint.

21. The authorization system of claim 18, further comprising a communication status application executing at a gateway appliance configured to route split and encrypted data between the endpoint and the secure network, the communication status application configurable to generate a tunnel status report.