Computerized access device with network security

• US 7,797,423 B2
• Filed: 07/11/2007
• Issued: 09/14/2010
• Est. Priority Date: 07/30/1996
• Status: Expired due to Fees

• Current Assignee: Round Rock Research LLC
• Original Assignee: Round Rock Research LLC
• Inventors: Holden, James M, Levin, Stephen E, Nickel, James O, Wrench, Edwin H
• Primary Examiner(s): VU, VIET DUY
• Application Number:
  US11/776,445
• Publication Number:
  US 20080010454A1
• Time in Patent Office: 1,161 Days
• Field of Search: 709/217, 709/219, 709/227, 709/228, 709/236, 709/237, 709/250
• US Class Current: 709/225
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06F 2211/001 In-Line Device
• CPC Class Codes: G06F 2211/005 Network, LAN, Remote Access, Distributed System
• CPC Class Codes: G06F 2211/007 Encryption, En-/decode, En-/decipher, En-/decypher, Scramble, (De-)compress
• CPC Class Codes: G06F 2211/009 Trust
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/14 : for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 67/141 : Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/563 : Data redirection of data network streams
• CPC Class Codes: H04L 9/3247 : involving digital signatures
• CPC Class Codes: H04L 9/3268 : using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04L 9/3273 : for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869
• CPC Class Codes: H04L 9/40 : Network security protocols
• CPC Class Codes: H04W 12/069 : using certificates or pre-shared keys

Abstract

A computerized access device useful within a network and adapted to provide communication security. In one embodiment, the network comprises an untrusted network, and the access device comprises stand-alone network security apparatus adapted to create associations with other network security devices on the network. Traffic between the associated devices may be encrypted for e.g., data confidentiality and integrity protection. In one variant, the network security apparatus comprises a software entity disposed at least partly within the software stack of a stand-alone hardware device. In another variant, the device functions as a gateway or portal to another network (e.g., the Internet or another untrusted network), or to another device within the same network.

Claims

1. A network access device adapted to provide network security functions, comprising:

a software stack operative to run on said access device; and

first network security apparatus for use with said stack, said security apparatus adapted to communicate data with other network security apparatus resident on a computing device over a data network by establishing an association, and where said first network security apparatus is configured to;

receive a message sent from said other network security apparatus of said computing device over a first physically non-secure network;

determine whether an association between said network security apparatus and said other network security apparatus of said computing device on said network exists;

convert at least a portion of said received message to a format utilized by said network; and

transmit said message received from said other network security apparatus of said computing device to a third network security apparatus over a second physically non-secure network when said association does exist without having to resort to an external entity to secure communications between said other network security apparatus and said third network security apparatus;

wherein said establishing of said association between said first network security apparatus and said other network security apparatus resident on said computing device results in the execution of a key exchange algorithm in which said network access device and said computing device exchange cryptographic keys over said first physically non-secure network.

2. The device of claim 1, wherein said access device further comprises a network protocol used to resolve an IP address from a given hardware or network address.

3. The device of claim 2, wherein said given hardware or network address comprises an Ethernet address.

4. The device of claim 2, wherein said given hardware or network address comprises a 48-bit address.

5. The device of claim 1, wherein said access device further comprises a network protocol used to resolve a given hardware or network address from an IP address.

6. The device of claim 5, wherein said given hardware or network address comprises an Ethernet address.

7. The device of claim 5, wherein said given hardware or network address comprises a 48-bit address.

8. The device of claim 1, wherein said access device is further adapted to authenticate said third network security apparatus to form an association using a key-exchange algorithm.

9. The device of claim 1, wherein said access device is further adapted to authenticate said third network security apparatus from which said access device has first requested authentication.

10. The device of claim 1, wherein said network security apparatus is disposed substantially within said software stack above the Physical Layer thereof.

11. The device of claim 10, wherein said network security apparatus is disposed substantially within said software stack below the Network Layer thereof.

12. The device of claim 10, wherein said network security apparatus is disposed substantially within said software stack below the Transport Layer thereof.

13. The device of claim 1, wherein said conversion of said at least portion of said received message to said format further comprises encrypting said at least portion using at least one key of a public/private key pair.

14. The device of claim 1, wherein said association comprises a non-permanent trusted communications channel between and unique to said first network security apparatus and said other network security apparatus of said computing device.

15. The device of claim 14, wherein said access device comprises a substantially fixed and stand-alone device.

16. The device of claim 1, wherein said computing device comprises an untrusted operating system.

17. The device of claim 16, wherein said computing device is physically non-secure.

18. The device of claim 1, wherein said association comprises a mutual authentication process, wherein said network security apparatus is adapted to authenticate said other network security apparatus, and further adapted to authenticate itself to said other network security apparatus.

19. The device of claim 1, wherein said first network security apparatus comprises a gateway function, said gateway function permitting secure data communication over a second network.

20. The device of claim 19, wherein said second data network comprises the Internet, and said second data network is in data communication with a website.

21. The device of claim 1, wherein said first network security apparatus of said access device comprises at least one interface port, access to which is based at least in part on identification of a user of said computing device.

22. The device of claim 21, wherein said identification of a user is accomplished based at least in part on a cryptographic element associated with said computing device.

23. The device of claim 1, wherein said network security apparatus is adapted to dynamically generate at least one encryption key for each association, said act of generating not requiring either (i) intervention by a network administrator;

or (ii) intervention by a user of said computing device.

24. The device of claim 1, wherein at least one encryption key is dynamically generated by said network security apparatus pursuant to establishing an association with said other network security apparatus, said at least one key being specific to a particular session between said network security device and said other network security device.

25. The device of claim 1, wherein said network security apparatus is adapted to encrypt at least portions of said message using a block cipher.

26. The device of claim 1, wherein said network security apparatus generates at least one encryption key for use in encrypting at least portions of said message, said at least one encryption key comprises at least a portion of a public/private key pair.

27. The device of claim 1, wherein said network security apparatus generates at least one encryption key for use in encrypting at least portions of said message, said at least one encryption key comprises a symmetric encryption key.

28. The device of claim 1, wherein said network security apparatus generates at least one encryption key, and said at least one encryption key provides confidentiality, integrity and authentication of user datagrams during a particular session or association between said network security apparatus and said other network security apparatus.

29. The device of claim 1, wherein said network security apparatus comprises an encryption algorithm that is initialized at least in part using an initialization vector (IV).

30. The device of claim 29, wherein said encryption algorithm is configured so that encrypting data using the same encryption key, but different IVs, will produce different ciphered output.

31. The device of claim 29, wherein said network security apparatus is adapted to generate a new IV for each encryption event.

32. The device of claim 1, wherein said network security apparatus, as part of establishing said association, generates random data that is transmitted to said other network security apparatus.

33. The device of claim 1, wherein said key exchange algorithm is adapted to generate and transmit random data to said other network security apparatus.

34. The device of claim 33, wherein said transmission of said random data is associated with a procedure that permits both said network security apparatus and said other network security apparatus to possess encryption keys that permit the two apparatus to decrypt encrypted data sent by the other.

35. The device of claim 1, wherein at least a portion of said received message is evaluated by said first network security apparatus using a first cryptographic residue generated at said first network security apparatus using at least locally stored information, and a second residue of said received message.

36. The device of claim 35, wherein said evaluation of said first and second residues comprises comparing said residues to see if they match.

37. The device of claim 36, wherein if said first and second residue does not match, a change in the operation of said first network security apparatus is invoked.

38. The device of claim 37, wherein said change in the operation comprises performing a network audit function.

39. The device of claim 1, wherein no pre-positioned network configuration data is used in establishing said association between said first network security apparatus and said other network security apparatus resident on said computing device.

40. The device of claim 1, wherein said association is established at least in part based on an authentication of other network security apparatus resident on said computing device by said first network security apparatus that does not require access to a physically secure storage device.

41. The device of claim 1, wherein said association between said network apparatus and said other network apparatus resident on said computing device is established using only:

a first message from the other network security apparatus resident on said computing device to the first network security apparatus; and

a second message from the first network security apparatus to the other network security apparatus.

42. The device of claim 41, wherein said first message comprises a request message, and said second message comprises a grant message.

43. The device of claim 1, wherein said association between said first network apparatus and said other network security apparatus resident on said computing device is established without resort to an entity external to said first network security apparatus or said other network security apparatus.

44. A portal device in communication with one or more devices via a physically unsecure data network and further adapted to provide network security functions, comprising:

a software stack operative to run on said portal device; and

network security apparatus for use with said stack, said security apparatus adapted to communicate data between a second network security apparatus resident on a computerized device on said physically unsecure data network and said one or more devices also located on said physically unsecure data network;

said network security apparatus operative to;

establish an ad hoc and temporary association between said portal device and said second network security apparatus of said computerized device by utilizing at least a key exchange algorithm in which said portal device and said second network security apparatus exchange cryptographic keys over said physically non-secure network;

receive a message sent from said computerized device;

modify at least a part of said received message to produce a modified message; and

transmit said modified message to at least one of said one or more devices resident on said physically unsecure data network;

wherein said network security functions comprise;

providing confidentiality for at least a portion of said modified message;

providing integrity protection for at least a portion of said modified message; and

authenticating said one or more devices as well as authenticating said portal device to said one or more devices.

45. The device of claim 44, wherein said network security apparatus, further comprises:

an interface for receiving said message sent from said computerized device, wherein said message is intended for transmission over said data network;

an association determination process configured to determine whether an association exists between the network security apparatus and said second network security apparatus;

a session management process in communication with said interface and configured to transmit said message to said data network if said association determination process determines that said association exists; and

an association manager in communication with said interface for establishing an association with said second network security apparatus if said association does not exist.

46. The device of claim 45, further comprising apparatus adapted to, when said association does not exist, buffer or queue said message for at least a period of time prior to releasing said message for transmission over said data network.

47. The device of claim 45, wherein said session manager is adapted to encrypt said message using a block cipher encryption algorithm prior to transmitting said message to said data network.

48. The device of claim 47, wherein said association manager is configured to authenticate a received message from said second network security apparatus during said establishing an association.

49. The device of claim 48, wherein said association comprises an ad hoc trusted communications path between said network security apparatus and said second network security apparatus.

50. The device of claim 45 further comprising an apparatus adapted to generate an encryption key that is substantially unique to said association.

51. The device of claim 44, wherein said network security apparatus operates according to a trusted session-based protocol, said trusted session-based protocol adapted to establishes one or more encryption keys during said establishing an association, said one or more keys being substantially unique to said association.

52. The device of claim 51, wherein said trusted session-based protocol provides at least one mechanism to verify that said message is unaltered during transmission between said computerized device and said security apparatus device.

53. The device of claim 52, wherein said at least one mechanism to verify that said message is unaltered during transmission over said network comprises a cryptographic residue.

54. The device of claim 44, wherein said network security apparatus comprises at least one mechanism to authenticate at least one other computerized device or network security apparatus in communication with said network.

55. The device of claim 54, wherein said at least one mechanism comprises a cryptographic residue.

56. The device of claim 54, wherein said computerized device comprises an untrusted operating system.

57. The device of claim 56, wherein said portal device comprises a gateway, said gateway being in data communication with said network.

58. The device of claim 57, wherein said network comprises the Internet, and said network is in data communication with a website.

59. The device of claim 58, wherein said computerized device comprises a portable computing device.

60. A substantially stand-alone gateway device adapted to provide network security functions and bridging between two physically unsecure networks, comprising:

a software stack operative to run on said device; and

first network security apparatus for use with said stack, said security apparatus adapted to communicate data with other network security apparatus over at least one of first and second physically unsecure data networks in data communication with said gateway device by establishing an association, and where said first network security apparatus is configured to;

receive a message sent from a higher layer process in said device for transmission over at least one of said networks;

determine whether an association between said first network security apparatus and another network security apparatus in communication with said at least one network exists;

convert at least a portion of said received message to a format utilized by said at least one network;

transmit at least portions of said message to said another network security apparatus when said association does exist; and

establish an association with said another network security apparatus if said association does not exist by dynamically generating at least one encryption key for each association, said act of generating not requiring intervention by an external entity, said at least one key being specific to a particular session between said first network security apparatus and said another network security apparatus;

wherein said substantially stand-alone gateway provides said network security functions while being directly coupled only to unsecure networks.

61. The device of claim 60, wherein said device further comprises a network protocol used to resolve an IP address from a given hardware or network address.

62. The device of claim 61, wherein said given hardware or network address comprises an Ethernet address.

63. The device of claim 61, wherein said given hardware or network address comprises a 48-bit address.

64. The device of claim 60, wherein said device further comprises a network protocol used to resolve a given hardware or network address from an IP address.

65. The device of claim 64, wherein said given hardware or network address comprises an Ethernet address.

66. The device of claim 64, wherein said given hardware or network address comprises a 48-bit address.

67. The device of claim 60, wherein said first network apparatus is further adapted to authenticate at least one other device or associated network security apparatus requesting to form an association using a key-exchange algorithm.

68. The device of claim 60, wherein said network security apparatus is disposed substantially within said software stack above the Physical Layer thereof.

69. The device of claim 68, wherein said network security apparatus is disposed substantially within said software stack below the Network Layer thereof.

70. The device of claim 68, wherein said network security apparatus is disposed substantially within said software stack below the Transport Layer thereof.

71. The device of claim 60, wherein said conversion of said at least portion of said received message to said format further comprises encrypting said at least portion using at least one key of a public/private key pair.

72. The device of claim 60, wherein said association comprises a non-permanent trusted communications channel between and unique to said first network security apparatus and said other network security apparatus.

73. The device of claim 60, wherein said association comprises a mutual authentication process, wherein said first network security apparatus is adapted to authenticate said other network security apparatus, and further adapted to authenticate itself to said other apparatus.

74. The device of claim 60, wherein said act of generating not requiring intervention by said external entity comprises not requiring either:

(i) intervention by a network administrator;

or (ii) an administration entity.

75. The device of claim 60, wherein said first network security apparatus is adapted to encrypt at least portions of said message using a block cipher.

76. The device of claim 60, wherein said first network security apparatus generates at least one encryption key for use in encrypting at least portions of said message, said at least one encryption key comprises at least a portion of a public/private key pair.

77. The device of claim 60, wherein said first network security apparatus generates at least one encryption key for use in encrypting at least portions of said message, said at least one encryption key comprises a symmetric encryption key.

78. The device of claim 60, wherein said first network security apparatus generates at least one encryption key, and said at least one encryption key provides confidentiality, integrity and authentication of user datagrams during a particular session or association between said first network security apparatus and said other network security apparatus.

79. The device of claim 60, wherein said first network security apparatus comprises an encryption algorithm that is initialized at least in part using an initialization vector (IV).

80. The device of claim 79, wherein said encryption algorithm is configured so that encrypting data using the same encryption key, but different IVs, will produce different ciphered output.

81. The device of claim 79, wherein said first network security apparatus is adapted to generate a new IV for each encryption event.

82. The device of claim 60, wherein said first network security apparatus, as part of establishing said association, generates random data that is transmitted to said other network security apparatus.

83. The device of claim 60, wherein said first network security apparatus further comprises a cryptographic element exchange algorithm adapted to generate and transmit random data to said other network security apparatus.

84. The device of claim 83, wherein said transmission of said random data is associated with a procedure that permits both said first network security apparatus and said other network security apparatus to possess encryption keys that permit the two apparatus to decrypt encrypted data sent by the other.

85. The device of claim 60, wherein said association is established at least in part based on an authentication of said other network security apparatus by said first network security apparatus that does not require access to a physically secure storage device.

86. A network access device adapted to provide network security functions, comprising:

a software stack operative to run on said access device; and

first network security apparatus for use with said stack, said security apparatus adapted to communicate data with other network security apparatus resident on a computing device over a unsecure data network to a third computing device by establishing an association, said association comprising a non-permanent trusted communications channel between and unique to said first network security apparatus and said other network security apparatus of said computing device, and where said first network security apparatus is configured to;

receive a message sent from said other network security apparatus of said computing device via said unsecure data network;

determine whether an association between said network security apparatus and said other network security apparatus of said computing device on said network exists;

execute a mutual authentication process, wherein said network security apparatus is adapted to authenticate said other network security apparatus, and further adapted to authenticate itself to said other network security apparatus

convert at least a portion of said received message to a format utilized by said network; and

transmit said message received from said other network security apparatus of said computing device to said third computing device via said unsecure network when said association does exist;

wherein said establishing of said association between said first network security apparatus and said other network security apparatus resident on said computing device results in the execution of a key exchange algorithm adapted to cause said network access device and said computing device to exchange cryptographic keys; and

wherein said network security apparatus is adapted to dynamically generate at least one encryption key for each association, said at least one key being specific to a particular session between said network security apparatus and said other network security apparatus, said act of generating not requiring either (i) intervention by a network administrator;

or (ii) intervention by an external network entity in order to transmit said message to said third computing device via said unsecure network.

87. A gateway device in communication with one or more devices via a first physically unsecure data network and further adapted to provide network security functions, comprising:

a software stack operative to run on said gateway device; and

network security apparatus for use with said stack, said security apparatus adapted to communicate data between a second network security apparatus resident on a computerized device on a second physically unsecure data network and said one or more devices located on said first physically unsecure data network;

said network security apparatus operative to;

establish an ad hoc and temporary association between said gateway device and said second network security apparatus of said computerized device by utilizing at least a key exchange algorithm in which said gateway device and said second network security apparatus exchange cryptographic keys over said second physically non-secure network;

receive a message sent from said computerized device;

modify at least a part of said received message to produce a modified message; and

transmit said modified message to at least one of said one or more devices resident on said first physically unsecure data network;

wherein said network security functions comprise;

providing confidentiality for at least a portion of said modified message;

providing integrity protection for at least a portion of said modified message; and

authenticating said one or more devices as well as authenticating said gateway device to said one or more devices.

88. The device of claim 87, wherein said network security apparatus, further comprises:

an interface for receiving said message sent from said computerized device, wherein said message is intended for transmission over said first data network;

a session management process in communication with said interface and configured to transmit said message to said first data network when a security association exists; and

an association manager in communication with said interface for establishing an association with said second network security apparatus if said association does not exist.

89. The device of claim 88, further comprising apparatus adapted to, when said association does not exist, buffer or queue said message for at least a period of time prior to releasing said message for transmission over said first data network.

90. The device of claim 87, further comprising a session management process adapted to encrypt said message using a block cipher encryption algorithm prior to transmitting said message.

91. The device of claim 87, further comprising an association manager configured to authenticate a received message from said second network security apparatus during establishment of an association.

92. The device of claim 87, further comprising an apparatus adapted to generate an encryption key that is substantially unique to said ad hoc association.

93. The device of claim 92, further comprising at least one mechanism to verify that said message is unaltered during transmission over said second network comprises a cryptographic residue.

94. The device of claim 87, wherein said network security apparatus comprises at least one mechanism to authenticate at least one other computerized device or network security apparatus in communication with said second network.

95. The device of claim 94, wherein said at least one mechanism comprises a cryptographic residue.

96. The device of claim 87, wherein said computerized device comprises an untrusted operating system.

97. The device of claim 87, wherein said first network comprises the Internet, and said first network is in data communication with a website.

98. The device of claim 97, wherein said computerized device comprises a portable computing device.