Policy-driven kernel-based security implementation

• US 7,246,233 B2
• Filed: 12/05/2001
• Issued: 07/17/2007
• Est. Priority Date: 12/05/2001
• Status: Active Grant

• Current Assignee: Trend Micro Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Brabson, Roy F., Overby, Jr., Linwood Hugh
• Primary Examiner(s): Barron, Jr., Gilberto
• Assistant Examiner(s): Sandoval, Kristin D.
• Application Number:
  US10/007,446
• Publication Number:
  US 20030105951A1
• Time in Patent Office: 2,050 Days
• Field of Search: None
• US Class Current: 713/164
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/166 at the transport layer

Abstract

Improvements in security processing are disclosed which enable security processing to be transparent to the application. Security processing (such as Secure Sockets Layer, or “SSL”, or Transport Layer Security, or “TLS”) is performed in (or controlled by) the stack. A decision to enable security processing on a connection can be based on configuration data or security policy, and can also be controlled using explicit enablement directives. Directives may also be provided for allowing applications to communicate with the security processing in the stack for other purposes. Functions within the protocol stack that need access to clear text can now be supported without loss of security processing capability. No modifications to application code, or in some cases only minor modifications (such as inclusion of code to invoke directives), are required to provide this security processing. Improved offloading of security processing is also disclosed, which provides processing efficiencies over prior art offloading techniques.

Claims

1. A method of improving security processing in a computing network, comprising:

providing security processing in an operating system kernel;

providing first and second application programs which make use of the operating system kernel during execution;

providing security policy information that is usable for more than one executing application program;

executing the first application program;

selectably encrypting at least one remote communication of the executing first application program using the provided security processing in the operating system kernel, under conditions specified by the security policy information;

executing the second application program; and

selectably encrypting at least one remote communication of the executing second application program using the provided security processing in the operating system kernel, under conditions specified by the security policy information.

2. The method according to claim 1, wherein the security policy information is stored in a security repository.

3. The method according to claim 1, wherein the conditions comprise network addresses.

4. The method according to claim 3, wherein the network addresses specify at least one of server addresses and destination addresses.

5. The method according to claim 3, wherein the network addresses comprise at least one of ranges of source addresses and ranges of destination addresses.

6. The method according to claim 1, wherein the conditions comprise at least one of port numbers and port number ranges.

7. The method according to claim 1, wherein the conditions comprise at least one job name.

8. The method according to claim 1, wherein the conditions comprise at least one client identifier.

9. The method according to claim 1, further comprising checking the security policy information when the first application program establishes a connection, and wherein the communications on that connection are encrypted.

10. The method according to claim 1, wherein communications from the first application program are encrypted even though the first application program has no code for security processing.

11. The method according to claim 1, wherein the first application program invokes at least one security directive, and further comprising executing, during execution of the first application program, at least one of the invoked security directives.

12. The method according to claim 1, wherein, when a result of evaluating the security policy information so indicates, communications on only some sockets of a port are encrypted.

13. The method according to claim 1, wherein the provided security processing operates in a Transmission Control Protocol layer of the operating system kernel.

14. The method according to claim 1, wherein the provided security processing implements Secure Sockets Layer.

15. The method according to claim 1, wherein the provided security processing implements Transport Layer Security.

16. A system for improving security processing in a computing network, comprising:

means for performing security processing in an operating system kernel;

security policy information that is usable for more than one executing application program specifying at least one condition under which the means for performing security processing is to be activated;

means for executing first and second application programs which make use of the operating system kernel during execution;

means for selectably encrypting, according to the conditions specified by the security policy information, at least one remote communication of the executing first application program and at least one remote communication of the executing second application program using the means for performing security processing.

17. A computer program product for improving security processing in a computing network, the computer program product comprising:

a computer usable medium having computer readable program code embodied therein, the computer usable medium comprising;

computer-readable program code configured to perform security processing in an operating system kernel;

computer-readable program code configured to access security policy information that is usable for more than one executing application program, the security policy information specifying at least one condition under which the computer-readable program code configured to perform security processing is to be activated;

computer-readable program code configured to execute first and second application programs which make use of the operating system kernel during execution; and

computer-readable program code configured to selectably encrypt, according to the conditions specified by the security policy information, at least one remote communication of the executing first application program and at least one remote communication of the executing second application program using the computer-readable program code configured to perform security processing.