Offload processing for secure data transfer

• US 7,441,119 B2
• Filed: 11/06/2002
• Issued: 10/21/2008
• Est. Priority Date: 12/05/2001
• Status: Expired due to Fees

• Current Assignee: Trend Micro Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Brabson, Roy Frank, Gambino, Mark Richard, Overby, Jr., Linwood Hugh
• Primary Examiner(s): Sheikh, Ayaz
• Assistant Examiner(s): Sherkat, Arezoo
• Application Number:
  US10/289,107
• Publication Number:
  US 20030105953A1
• Time in Patent Office: 2,176 Days
• Field of Search: 713/164, 713/152
• US Class Current: 713/164
• CPC Class Codes: H04L 63/0485 Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/166 at the transport layer

Abstract

Improvements in security processing are disclosed which enable security processing to be transparent to the application. Security processing (such as Secure Sockets Layer, or “SSL”, or Transport Layer Security, or “TLS”) is performed in (or controlled by) the stack. A decision to enable security processing on a connection can be based on configuration data or security policy, and can also be controlled using explicit enablement directives. Directives may also be provided for allowing applications to communicate with the security processing in the stack for other purposes. Functions within the protocol stack that need access to clear text can now be supported without loss of security processing capability. No modifications to application code, or in some cases only minor modifications (such as inclusion of code to invoke directives), are required to provide this security processing. Improved offloading of security processing is also disclosed, which provides processing efficiencies over prior art offloading techniques. Offload components can be controlled from the kernel, an SSL layer or an application.

Claims

1. A method of improving security processing in a computing network, comprising:

providing a security offload component in an operating system kernel which performs security processing;

providing control functions in an SSL layer or application layer for directing operation of the security offload component;

providing an application program;

executing the application program under control of the operating system kernel; and

executing the provided control functions during execution of the application program, thereby selectably directing the security offload component to secure at least one communication of the executing application program.

2. The method according to claim 1, wherein the executing control functions include a function directing the security offload component to begin securing the communications.

3. The method according to claim 1, wherein the executing control functions include a function directing the security offload component to stop securing the communications.

4. The method according to claim 2, wherein the executing control functions further specifies information to be used by the security offload component.

5. The method according to claim 4, wherein the specified information comprises one or more of:

authentication information;

cipher suites options; and

security key input information.

6. The method according to claim 1, wherein the control functions include providing client and/or server certificates to the security offload component for use in securing the communications.

7. The method according to claim 1, wherein the control functions include providing one or more keys or key rings to the security offload component for use in securing the communications.

8. The method according to claim 1, wherein the control functions include providing an identification of a encryption algorithm to the security offload component for use in securing the communications.

9. The method according to claim 1, wherein secured outbound data of the executing application is thereby sent to its destination directly from the security offload component, after a single pass over a data bus from the SSL Layer or application layer.

10. A method of improving security processing in a computing network, comprising:

providing a security offload component in an operating system kernel that performs security handshake processing; and

providing a control function in an SSL layer or application layer for initiating operation of the security handshake processing by the security offload component;

wherein the control function executes under the control of the operating system kernel.

11. The method according to claim 10, further comprising sending a completion response from the security offload component to the SSL layer or application layer upon completion of the security handshake processing, wherein the completion response conveys information for use by the SSL layer or application layer in carrying out secure communications on a secure session which results from the security handshake processing.

12. The method according to claim 11, wherein the conveyed information comprises one or more of:

an identifier of the secure session;

one or more session keys;

a current sequence number for messages of the secure session;

a cipher suite to be used for the secure session;

a protocol version to be used for the secure session; and

a digital certificate or other security credentials.