Trusted flow and operation control method

• US 7,343,619 B2
• Filed: 08/14/2002
• Issued: 03/11/2008
• Est. Priority Date: 03/16/2002
• Status: Active Grant

• Current Assignee: Attestwave LLC (Jeffrey M. Gross)
• Original Assignee: Trustedflow Systems, Inc.
• Inventors: Sitrick, David Howard, Ofek, Yoram, Yung, Marcel Mordechay, Baldi, Mario
• Primary Examiner(s): Vu; Kim
• Assistant Examiner(s): TRUVAN, LEYNNA THANH
• Application Number:
  US10/219,379
• Publication Number:
  US 20030177382A1
• Time in Patent Office: 2,036 Days
• Field of Search: 709100-103, 709/106, 709/225, 709/229, 709/201, 709206-207, 709/223, 709232-235, 709/238, 705/64, 705/67, 705/75, 726 2- 7, 726/17, 726/19, 726/21, 726/27, 726/30, 726 1- 6, 726/13, 707 4- 5, 707/103.R, 707100-102, 707/103.Y, 707/104.1, 713/160, 713/164, 713/168, 380/262
• US Class Current: 726/2
• CPC Class Codes: G06F 21/14 against software analysis or reverse engineering, e.g. by obfuscation
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/193 at the transport layer, e.g. TCP related
• CPC Class Codes: H04L 47/27 Evaluation or update of window size, e.g. using information derived from acknowledged [ACK] packets
• CPC Class Codes: H04L 47/283 in response to processing delays, e.g. caused by jitter or round trip time [RTT]
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/163 In-band adaptation of TCP data exchange; In-band control procedures
• CPC Class Codes: Y04S 40/20 Information technology specific aspects, e.g. CAD, simulation, modelling, system security
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

The objective of this invention is to ensure that programs that generate and send data packets are well behaved. This invention discloses a method and system that consist of an end station and a network interface, such that, the network interface is capable of determining the authenticity of the program used by the end station to generate and send data packets. The method is based on using a hidden program that was obfuscated within the program that is used to generate and send data packets from the end station. The hidden program is being updated dynamically and it includes the functionality for generating a pseudo random sequence of security signals. Only the network interface knows how the pseudo random sequence of security signals were generated, and therefore, the network interface is able to check the validity of the pseudo random sequence of security signals, and thereby, verify the authenticity of the programs used to generate and send data packets.

Claims

1. A method of providing controlled communication, the method comprising:

processing of data within a first computing system in accordance with a first defined logic;

generating a first security tag independent of the first data packets, responsive to validating the processing, within the first computing system, occurring in accordance with a second defined logic;

wherein the generating of the first security tag is unrelated to content of the first data packet,

transmitting the first security tag as an output from the first computing system onto a communications path in accordance with the defined rules of transmission for coupling to a second computing subsystem;

transmitting a first data packet, after the transmitting of the first security tag, as an output from the first computing system onto a communications path in accordance with defined rules of transmission;

validating the first security tag responsive to independent generation in the second computing system therein of a second security tag; and

controlling communications with the first computing system responsive to the validating the first security tag responsive to the generation of the second security tag.

2. The method as in claim 1, further comprising:

receiving within a second computing system, the first security tag coupled from the communications path;

validating in the second computing system, the processing of data in accordance with a third defined logic responsive to generating the second security tag; and

validating the processing occurring within the first computing system responsive to the first security tag and the second security tag.

3. The method as in claim 2, further comprising:

mapping the first data packet to a first defined action responsive to validating the processing of data in accordance with the third defined logic; and

mapping the first data packet to a second defined action responsive to a failed validating of the processing of data in accordance with the third defined logic.

4. The method as in claim 3, wherein the first defined action is comprised of enabling utilization of coupling the first data packet for further processing.

5. The method as in claim 3, wherein the second defined action is comprised of denial of further utilization of the first data packet.

6. The method as in claim 3, wherein the second defined action provides for local storage of the first data packet in the second computing system without further processing.

7. The method as in claim 3, wherein the second defined action has an associated second priority level, wherein the second priority level is a lower priority for transmission than the first priority level.

8. The method as in claim 7, wherein the priority level for transmission is determined responsive to a predefined set of bits within the first data packet.

9. The method as in claim 3, further comprising:

wherein the first defined action provides for forwarding of the first data packet for further communication over a defined communications path.

10. The method as in claim 9, wherein the defined communications path is part of at least one of:

a VPN, an ATM, a FR, a CPN, a content delivery network (CDN), an ISP, a shared media, a firewall, a local area network, an Internet, a metropolitan area network, a SAN, a link to an application server, a link to a web server, a link to a data base server, a link to an Internet server, a link to a network server, a public network, an enterprise network, and a carrier network.

11. The method as in claim 3, further comprising:

wherein the first defined action provides for enabling of coupling at least one of the first computing system and the second computing system to a third computing system.

12. The method as in claim 11, wherein the third computing system is comprised of at least one of:

an application server, a web server, a data base server, an Internet server, a network server, a firewall, a multimedia server, a video server, and a domain name server.

13. The method as in claim 11, wherein the coupling provides for transfer of data content from the third computing system to at least one of the first computing system and the second computing system.

14. The method as in claim 13, wherein the data content is comprised of at least one of:

application software, web-pages, audio content, video movie content, video still visual content, audiovisual content, and digital data content.

15. The method as in claim 3, wherein the first defined action is comprised of enabling further processing of the first data packet in the second computing system.

16. The method as in claim 3, wherein the first action is comprised of processing that is done by at least one of:

a router, a server, a web-server, a database, a firewall, and a network appliance.

17. The method as in claim 2, wherein the first computing system and the second computing system are both contained within a single physical computing system.

18. The method as in claim 17, wherein the single physical computing system is at least one of:

a single printed circuit hoard, a single chip, a single computing module, a single chassis, an hand held device, a PDA (personal data assistant), a cellular phone, a single box, and a user terminal.

19. The method as in claim 2, wherein the first computing system and the second computing system are comprised of separate physical computing systems.

20. The method as in claim 2, wherein the second computing system has non-modifiable processing logic.

21. The method as in claim 2, wherein at least one of the first computing system and the second computing system is comprised of at least one of:

a tamper-proof hardware, a tamper-proof firmware, a self-destructive hardware, and a smart card.

22. The method as in claim 2, further comprising:

making at least one of;

the first computing system and the second computing system inoperative responsive to detection of at least one of;

tampering, attempting to replace hardware, attempting to replace firmware, and attempting to replace software.

23. The method as in claim 2, further comprising:

coupling the first computing system and the second computing system through a communications network.

24. The method as in claim 23, wherein the communications network is at least one of:

an access network, a metropolitan network, a local area network, a wireless network, an enterprise network, a cellular telephone network, a cable modem network, a passive optical network, Ethernet, token ring, a spatial reuse ring, SONET ring, resilient packet ring, a costumer premise network (CPN), an IP, Internet, a 3G wireless network, IEEE 802 standards, ATM network, frame relay (FR) network, a virtual private network (VPN), a shared media, a peer-to-peer network, and a storage area network (SAN).

25. The method as in claim 2, further comprising:

directly coupling the first computing system and the second computing system via at least one of;

a Blue-Tooth connection, an infrared connection, an input-output channel, an internal computer bus, a universal serial bus (USB), a mother board, and an IEEE 1394 connection.

26. The method as in claim 2, wherein the first computing system is part of at least one of:

a single printed circuit board, a single chip, a single computing module, a single chassis, an hand held device, a PDA, a cellular phone, a smart card, a single box, a user terminal, an application software module, an operating system module, a Java applet, a communications software module, a firmware component, a software driver, and a distributed system software module.

27. The method as in claim 2, wherein the second computing system is part of at least one of:

a server, a firewall, a gateway, a router, a routing controller, a local area network bridge, a local area network switch, a wireless base station, a wireless 3G base station, an IEEE 802.11 base station, an IEEE 802.15 access, an IEEE 802.16 access, an IEEE 802.17 access, a cable modem head-end, a central office, an ADSL DSLAM, and a point-of-presence (PoP).

28. The method as in claim 1, further comprising:

obfuscating so as to impede observation and understanding of at least one of;

the processing of data in accordance with the first defined logic; and

the processing of the first security tag in accordance with the second defined logic.

29. The method as in claim 1, wherein the generating of the first security tag is hidden within the processing of data in accordance with the first defined logic.

30. The method as in claim 1, wherein generating of the security tag is encrypted within the processing of data in accordance with at least one of:

the first defined logic and the second defined logic.

31. The method as in claim 1, wherein the first defined logic is comprised of a plurality of parts, and wherein the second defined logic is comprised of a plurality of parts, the method further comprising:

receiving selected ones of the plurality of parts as selected parts comprised of at least one of;

selected ones of the plurality of parts of the first defined logic and selected ones of the plurality of parts of the second defined logic.

32. The method as in claim 31, wherein the selected parts determine at least one of:

performance characteristics, access characteristics, transmission limitations, transmission rates, window sizes, port numbers, IP addresses, network addresses, quotas, renewable quotas, usage parameters of copyright protected content, packet structure limitations, and transmission schedule.

33. The method as in claim 31, wherein the selected parts are provided by at least one of a local separate controller, a remote separate controller, a remote server, a remote web server, a firewall, a database, a video server, a content delivery server, a smart card, a tamper resisting device, and self-destruction device.

34. The method as in claim 1, wherein at least one of the defined rules of transmission determines a renewable precondition for said transmitting of at least one of said first data packet and said first security tag vector.

35. The method as in claim 34, wherein the renewable precondition for transmission is defined by least one of:

renewable transmission quota of a number of first data packets that can be transmitted per unit of time, time signal, UTC time signal, digitally signed time signal, digitally signed time-stamp, digitally signed time-stamp from UTC (coordinated universal time), digital cash for transmission of the first data packets, biometric keys, and cryptographic keys for marking the first data packets.

36. The method as in claim 34, wherein the renewable precondition for transmission is comprised of one of being valid and of not being valid, the method further comprising:

suspending the transmitting responsive to the renewable precondition for transmission not being valid.

37. The method as in claim 34, further comprising:

obtaining the renewable precondition for transmission is obtained from at least one of;

a predefined logic, an external rule controller, a security management system (SMS), a network interface, a network appliance, a server, a network management system, a firewall, a local computation, a smart card device, and a portable device.

38. The method as in claim 1, further comprising:

replacing at least a part of the first defined logic and apart of the second defined logic, with a new part of a respective one of the first defined logic and the second defined logic.

39. The method as in claim 38, wherein the replacing comprises at least one of:

adding data, deleting data and replacing data and wherein data comprises at least one of a plurality of lines of codes, machine codes, obfuscated codes, object codes, tables of codes, program parameters, subroutine parameters, tables of parameters, data structure of parameters, software modules, alpha numeric values, cryptographic fields, assembly language code, software applets, program control information, firmware code, instructions for reprogramming programmable hardware elements such as field programmable gate-arrays (FPLAs).

40. The method as in claim 1, wherein the generating is comprised of at least one of applying a pseudo-random generator, applying a pseudo-random function, applying a cryptographic function, applying an encryption function, applying a scrambling subroutine, applying an authentication function, applying a digital signing function, applying a cryptographic hash function, applying a subroutine, applying a computational logic module, applying a symmetric cryptography function, applying an asymmetric cryptography function, employing a cryptographic key, employing a cryptographic seed, employing an encrypted software, employing an obfuscated software, employing a hidden program, employing logic with a set of parameters, employing a hardware module, employing a smart card, employing a portable device, and employing a distributed protocol.

41. A method of providing controlled communications, the method comprising:

generating a first computing system a respective generated security tag vector generated responsive to processing of the data within the first computing system according to a first defined logic;

generating a local security tag vector within second computing system, responsive to a second defined logic;

receiving data packets for local storage in the first computing system;

controlling one of quality and class of service for communication of data packets responsive to the comparing of the local security tag vector to the generated security tag vector; and

wherein the generated security tag vector and the local security tag vector are generated independent of the content of the data packets.

42. The method as in claim 41, further comprising:

mapping the received data packets to a first class of service responsive to determining the local security tag vector equaling the generated security tag vector; and

mapping the received data packets to a second defined action responsive to the determining of a difference between the local security tag vector from the generated security tag vector.

43. The method as in claim 41, further comprising:

wherein the first defined action provides for forwarding of the received data packet for communication utilizing a defined communications path.

44. The method as in claim 43, wherein the defined communications path is part of at least one of:

a VPN, an ATM, a FR, a CPN, a content delivery network (CDN), an ISP, a shared media, a firewall, a local area network, an Internet, a metropolitan area network, a SAN, a link to application server, a link to web server, a link to data base server, a link to Internet server, a link to network server, a public network, an enterprise network, and a carrier network.

45. The method as in claim 42, further comprising:

forwarding the received data packets to a third computing system responsive to at least one of;

the first defined action and the second defined action.

46. The method as in claim 45, wherein the third computing system is at least one of:

an application server, a web server, a data base server, an Internet server, a network server, a firewall, a multimedia server, a video server.

47. The method as in claim 45, wherein the first defined action is comprised of a processing of the received data packets.

48. The method as in claim 47, wherein the processing is done by at least one of:

a router, a server, a web-server, a database, a firewall, and a network appliance.

49. The method as in claim 41, wherein the defined logic is comprised of multiple parts, the method further comprising:

replacing at least a part of the defined logic for the generating of the security tag vector.

50. The method as in claim 49, wherein the replacing is comprised of using information obtained by at least one of:

a local operation, a predefined logic, an external rule controller, a security management system, a network interface, a network appliance, a server, a network management system, a firewall, a base station, a video server, a local computation, a smart card device, and a portable device.

51. A system providing controlled communication of a first computing subsystem, the system comprising:

processing logic within the first computing subsystem providing processing in accordance with first defined rules;

tag logic within the first computing subsystem providing generation a first security tag responsive to validating the processing in accordance with the first defined rules;

wherein the first computing subsystem transmits the first security tag onto a communications path in accordance with defined rules of transmission;

wherein the first computing subsystem transmits the first data packet onto a communications path in accordance with the defined rules of transmission;

wherein the generating the first security tag is unrelated to content of the first data packet; and

a second computing system,

wherein the second computing subsystem receives the first security tag from the communications path;

wherein the second computing subsystem validates the first security tag on the second computing system, responsive to second defined rules; and

wherein the second computing subsystem controls communications between the first computing subsystem and the second computing subsystem, responsive to validating the first security tag.

52. The system as in claim 51, further comprising:

means for mapping the first data packet to provide a first defined action responsive to a successful validating by the means for validating; and

means for mapping the first data packet to provide a second defined action responsive to a failed validating by the means for validating.

53. The system as in claim 52, wherein the first defined action provides for coupling the first data packet for further communication.

54. The system as in claim 53, wherein the second defined action provides for denial of further communication.

55. The system as in claim 53, wherein the second defined action provides for local storage in the second computing system.

56. The system as in claim 53, wherein the second defined action is at a lower priority level of transmission priority than that of the first defined action.

57. The system as in claim 56, wherein the priority level of transmission is determined responsive to a predefined set of bits within the first data packet.

58. The system as in claim 52, further comprising:

means for forwarding the first data packet for further communication over a defined communications path responsive to the first defined action.

59. The system as in claim 58, wherein the defined communications path is part of at least one of:

a VPN, an ATM, a FR, a CPN, a content delivery network (CDN), an ISP, a shared media, a firewall, a local area network, an Internet, a metropolitan area network, a SAN, a link to application server, a link to web server, a link to data base server, a link to Internet server, a link to network server, a public network, an enterprise network, and a carrier network.

60. The system as in claim 52, further comprising:

means for forwarding the first data packet to a separate computing device responsive to the first defined action.

61. The system as in claim 60, wherein the separate computing device is at least one of:

an application server, a web server, a data base server, an Internet server, a network server, a firewall, a multimedia server, a video server, and a domain name server.

62. The system as in claim 52, wherein the first defined action is comprised of a local processing at the second computing subsystem of the first data packet.

63. The system as in claim 62, wherein the local processing is done by at least one of:

a router, a server, a web-server, a database, a firewall, a network appliance.

64. The system as in claim 51, wherein the first computing subsystem and the second computing subsystem are both contained within a single physical computing system.

65. The system as in claim 64, wherein the single physical computing system is at least one of:

a single printed circuit board, a single chip, a single computing module, a single chassis, an hand held device, a PDA, a cellular phone, a single box, a user terminal.

66. The system as in claim 51, wherein the first computing subsystem and the second computing subsystem are each contained in separate physical computing systems.

67. The system as in claim 51, wherein the second computing subsystem is comprised of non-modifiable processing logic.

68. The system as in claim 51, wherein at least one of the first computing subsystem and the second computing subsystem is comprised of at least one of:

a tamper-proof hardware, a tamper-proof firmware, a smart card, and a self-destructive hardware.

69. The system as in claim 51, wherein at least one of:

the first computing subsystem and the second computing subsystem is made inoperative responsive to detection of at least one of;

tampering, attempt to replace hardware, attempt to replace firmware, and attempt to replace software.

70. The system as in claim 51, further comprising:

means for obfuscating to impede observation and understanding of least one of;

the processing of data in accordance with the first defined rules; and

, processing, in accordance with the second defined rules.

71. The system as in claim 51, wherein the tag logic for providing for generating of the first security tag vector is hidden within the processing, in accordance with the first defined rules.

72. The system as in claim 51, wherein the logic for generating of the security tag vector is encrypted within the processing of data in accordance with at least one of:

the first defined rules and the second defined rules.

73. The system as in claim 51, further comprising:

a communications network for coupling of the first computing subsystem and the second computing subsystem.

74. The system as in claim 73, wherein the communications network is at least one of:

an access network, a metropolitan network, a local area network, a wireless network, an enterprise network, a cellular telephone network, a cable modem network, a passive optical network, Ethernet, token ring, a spatial reuse ring, SONET ring, resilient packet ring, a costumer premise network (CPN), an IP, Internet, a 3G wireless network, IEEE 802 standards, ATM network, frame relay (FR) network, a virtual private network (VPN), a shared media, peer-to-peer network, and a storage area network (SAN).

75. The system as in claim 51, further comprising:

means for directly coupling the first computing subsystem via at least one of;

a blue-tooth connection, an infrared connection, an input-output channel, an internal computer bus, a universal serial bus (USB), a mother board, and an IEEE 1394 connection.

76. The system as in claim 51, wherein the first computing subsystem is part of at least one of:

a single printed circuit board, a single chip, a single computing module, a single chassis, an hand held device, a PDA, a cellular phone, a smart card, a single box, a user terminal, an application software module, an operating system module, a Java applet, a communications software module, a firmware component, a software driver, and a distributed system software module.

77. The system as in claim 51, wherein the second computing subsystem is part of at least one of:

a server, a firewall, a gateway, a router, a routing controller, a local area network bridge, a local area network switch, a wireless base station, an IEEE 802.15 access, an IEEE 802.16 access, an IEEE 802.17 access, a wireless 3G base station, an IEEE 802.11 base station, a cable modem head-end, a central office, an ADSL DSLAM, and a point-of-presence (PoP).

78. The system as in claim 51, wherein the first defined rules is comprised of a plurality of parts, and wherein the second defined rules is comprised of a plurality of parts, the system further comprising:

means for receiving selected ones of the plurality of parts from at least one of;

the first defined rules and the second defined rules from at least one of;

a local separate controller, a remote separate controller, a remote server, a remote web server, a firewall, a database, a video server, a content delivery server, a smart card, a tamper resisting device, and a self-destruction device.

79. The system as in claim 78, wherein the selected parts determine at least one of:

performance characteristics, access characteristics, transmission limitations, transmission rates, window sizes, port numbers, IP addresses, network addresses, quotas, renewable quotas, usage parameters of data rights for protected content, packet structure limitations, and transmission schedule.

80. The system as in claim 51, wherein at least one of the defined rules of transmission determines a renewable precondition for transmission.

81. The system as in claim 80, wherein the renewable precondition for transmission is defined by least one of:

renewable transmission quota of first data packets, number of first data packets that can be transmitted per unit of time, time signal, UTC time signal, digitally signed time signal, digitally signed time-stamp, digitally signed time-stamp from UTC (coordinated universal time), digital cash for transmission of the first data packets, biometric parameters, and cryptographic keys for marking the first data packets.

82. The system as in claim 80, wherein the renewable precondition for transmission is obtained from at least one of:

a predefined logic, an external rule controller, a security management system (SMS), a network interface, a network appliance, a server, a network management system, a firewall, a local computation, a smart card device, and a portable device.

83. The system as in claim 80, wherein when the renewable precondition for transmission is not valid, transmission is suspended.

84. The system as in claim 51, further comprising:

means for replacing at least a part of at least one of;

the first defined rules and the second defined rules; and

wherein the means for replacing provides at least one of;

adding data, deleting data and replacing data and wherein data comprises at least one of lines of codes, machine codes, obfuscated codes, object codes, tables of codes, program parameters, subroutine parameters, tables of parameters, data structure of parameters, software modules, alpha numeric values, cryptographic fields, assembly language code, software applets, program con trot information, firmware code, instructions for reprogramming programmable hardware elements, and logic for field programmable gate-arrays (FPLAs).

85. The system as in claim 51, wherein the means for generating utilizes at least one of applying a pseudo-random generator, applying a pseudo-random function, applying a cryptographic function, applying an encryption function, applying a scrambling subroutine, applying an authentication function, applying a digital signing function, applying a cryptographic hash function, applying a subroutine, applying a computational logic module, applying a symmetric cryptography function, applying an asymmetric cryptography function, employing a cryptographic key, employing a cryptographic seed, employing an encrypted software, employing an obfuscated software, employing a hidden program, employing logic with a set of parameters, employing a hardware module, employing a smart card, employing a portable device, and employing a distributed protocol.

86. A system providing controlled signaling between separate computing subsystems, the system comprising:

first computing logic at a first computing subsystem, providing processing to provide a first defined operation responsive to first defined logic;

tag logic providing generation of a first security tag vector in the first computing logic responsive to validating the processing at the first computing logic in accordance with the first defined logic;

wherein the second computing subsystem receives the first security tag vector from the communications path;

wherein the second computing subsystem validates the processing at the first computing subsystem by processing the first security tag vector in accordance with a second defined logic, to provide verification of integrity of the first security tag vector; and

wherein the second computing subsystem controls communications between the first computing subsystem and the second computing subsystem, responsive to the verification of integrity of the first security tag vector.

87. The method as in claim 86, wherein the defined logic is comprised of a plurality of parts, wherein at least some selected parts of the plurality of parts of the defined logic for processing data, is performed on at least one of:

a single chip, a single chip on the mother board, a single computing module, a hand held device, a cellular phone, a smart card, a user terminal, an application software module, an operating system module, a Java applet, a communications software module, a firmware component, a software driver, a tamper resistance hardware, obfuscated software, tamper resistant software, tamper resistant firmware, and self-destructive hardware.

88. The system as in claim 86, wherein the first defined rules and the second defined rules are structured according to defined rules of operation, the system further comprising:

a separate rules controller for providing at least some of the defined rules of operation.

89. The system as in claim 86, wherein at least one of the defined rules of operation determines a renewable precondition for operation.

90. The system as in claim 86, wherein at least one of the defined rules of operation determines an action based on a context.

91. The system as in claim 90, wherein the context involves at least one of a system user present, a system user present at an end-station, a system user present at the computer used for transmission and operation, application program present, a data information available, data rights permission available and parameters available.

92. The system as in claim 90, wherein when said context is missing for operation, there is no transmitting the signal onto a communications path in accordance with the operation.