SECURE DEVICE AND PROXY FOR SECURE OPERATION OF A HOST DATA PROCESSING SYSTEM

• US 20170041295A1
• Filed: 10/18/2016
• Published: 02/09/2017
• Est. Priority Date: 10/10/2014
• Status: Active Grant

• Current Assignee: Zanguli LLC
• Original Assignee: Zanguli LLC
• Inventors: Mobini, Behrooz
• Granted Patent: US 9,819,646 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network
• CPC Class Codes: H04L 67/2876 Pairs of inter-processing entities at each side of the network, e.g. split proxies
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416

Abstract

Secure device and proxy operation include generating, using a processor, a first proxy and a first proxy companion paired with the first proxy and providing the first proxy to a host data processing system for installation therein. The first proxy in the host data processing system and the first proxy companion communicate. A proxy change event for the host data processing system is detected. Responsive to the detecting, a second proxy and a second proxy companion paired with the second proxy are generated. The second proxy is provided to the host data processing system for installation therein.

Claims

1. A method comprising:

generating, using a processor, a first proxy and a first proxy companion paired with the first proxy;

providing the first proxy to a host data processing system for installation therein;

wherein the first proxy in the host data processing system and the first proxy companion communicate;

detecting a proxy change event for the host data processing system; and

responsive to the detecting, generating a second proxy and a second proxy companion paired with the second proxy and providing the second proxy to the host data processing system for installation therein.

2. The method of claim 1, wherein the second proxy is structurally different from the first proxy and functionally equivalent to the first proxy.

3. The method of claim 2, wherein the second proxy has a portion of program code program code that is functionally equivalent to a corresponding portion of program code in the first proxy that is located at different relative memory location than in the first proxy.

4. The method of claim 2, wherein the second proxy uses a different communication protocol than the first proxy.

5. The method of claim 1, further comprising:

instructing the host data processing system to deactivate the first proxy.

6. The method of claim 1, further comprising:

receiving a health status message from the first proxy within the host data processing system; and

comparing the health status message with at least one health status criterion.

7. The method of claim 6, further comprising:

allowing the first proxy companion to instruct the first proxy to cause the host data processing system to perform an operation responsive to determining that the health status message meets the at least one health criterion.

8. The method of claim 6, wherein detecting a proxy change event comprises:

determining that the health status message does not meet the at least one health criterion.

9. The method of claim 1, further comprising:

the first proxy companion instructing the first proxy to cause the host data processing system to perform an operation specified by a user application.

10. The method of claim 1, further comprising:

receiving identifying information for the host data processing system from the first proxy;

comparing the identifying information with a list of compromised host data processing systems; and

responsive to matching the identifying information with an entry in the list, implementing at least one countermeasure.

11. The method of claim 10, wherein implementing the at least one countermeasure comprises:

increasing a frequency of health check messages between the first proxy and the first proxy companion.

12. The method of claim 10, wherein implementing the at least one countermeasure comprises:

increasing a complexity of content of health check messages between the first proxy and the first proxy companion.

13. The method of claim 10, wherein implementing the at least one countermeasure comprises:

decreasing allowed time between for receipt of a health check message from the proxy.

14. The method of claim 1, wherein:

the proxy comprises a proxy framework and a core module; and

generating a second proxy and a second proxy companion paired with the second proxy and providing the second proxy to the host data processing system for installation therein further comprises;

generating a new core module;

providing the new core module to the host;

unlinking and unloading the core module; and

loading and linking the new core module.

15. The method of claim 14, wherein generating a second proxy and a second proxy companion paired with the second proxy and providing the second proxy to the host data processing system for installation therein further comprises:

discontinuing data transfer between the proxy companion and the proxy and between the proxy and a peripheral device of the host data processing system until the new core module is loaded and linked;

storing intermediate data from the core module within the core framework; and

restoring the intermediate data to the new core module responsive to loading and linking the new core module.

16. The method of claim 15, further comprising:

discontinuing data transfer between the proxy and a remote data processing system.

17. A system comprising:

a memory;

a processor coupled to the memory;

an input/output device coupled to the processor;

wherein the processor is programmed to initiate executable operations comprising;

generating a first proxy and a first proxy companion paired with the first proxy;

providing the first proxy to a host data processing system for installation therein using the input/output device;

wherein the first proxy in the host data processing system and the first proxy companion communicate;

detecting a proxy change event for the host data processing system; and

responsive to the detecting, generating a second proxy and a second proxy companion paired with the second proxy and providing the second proxy to the host data processing system for installation therein using the input/output device.

18. The system of claim 17, wherein the second proxy is structurally different from the first proxy and functionally equivalent to the first proxy.

19. A computer program product comprising a computer readable storage medium having program code stored thereon, the program code executable by a processor to perform a method comprising:

generating, using the processor, a first proxy and a first proxy companion paired with the first proxy;

providing, using the processor, the first proxy to a host data processing system for installation therein;

wherein the first proxy in the host data processing system and the first proxy companion communicate;

detecting, using the processor, a proxy change event for the host data processing system; and

responsive to the detecting, generating, using the processor, a second proxy and a second proxy companion paired with the second proxy and providing, using the processor, the second proxy to the host data processing system for installation therein.

20. The computer program product of claim 19, wherein the second proxy is structurally different from the first proxy and functionally equivalent to the first proxy.