Network communications security agent

• US 7,917,745 B2
• Filed: 11/17/2008
• Issued: 03/29/2011
• Est. Priority Date: 04/07/2000
• Status: Expired due to Term

• Current Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Original Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Inventors: Janes, Sherman M.
• Primary Examiner(s): Parthasarathy; Pramila
• Application Number:
  US12/272,635
• Publication Number:
  US 20090125712A1
• Time in Patent Office: 862 Days
• Field of Search: None
• US Class Current: 713/151
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying

Abstract

One embodiment of an inventive networking environment includes clients called sending clients because they send network content through a network, and clients called receiving clients because they receive the network content from the sending clients through the network. Both sending clients and receiving clients are “clients” in that they rely on a management server to orchestrate the secure transfer of information from sending clients to receiving clients.

Claims

1. A computer program product embodied on at least one non-transitory computer readable storage medium for use with at least one computer processor for implementing data security in a transfer of an event from a sending client to a receiving client located remotely therefrom across a network, the network further including a key server located remotely from each of the sending and receiving clients, the computer program product comprising:

(a) computer code for receiving, at each of the sending and receiving clients, keying information associated with the event from the key server, the keying information including a plurality of selector/security association pairs corresponding to different timewise intervals of the event;

(b) computer code for populating, at the sending client, a first database of selector/security association pairs local to the sending client using said keying information received from the key server;

(c) computer code for populating, at the receiving client, a second database of selector/security association pairs local to the receiving client using said keying information received from the key server;

(d) computer code for receiving, at the sending client, first data from a network application program interface (API) of the sending client, the first data comprising a portion of the event to be sent from the sending client to the receiving client;

(e) computer code for determining, at the sending client, whether the first data is eligible for a first security operation, wherein eligibility is determined by first selector data contained in the first data;

(f) computer code for creating, at the sending client, a first selector based on the first selector data and using said first selector to search the first database for at least one selector/security association pair identifying a first security association corresponding to the first selector;

(g) computer code for applying, at the sending client, the first security operation to the first data if the first data is eligible, wherein said computer code for applying the first security operation comprises computer code for using the first security association on the at least a portion of the first data;

(h) computer code for sending, at the sending client, the first data to which the first security operation has been applied to a network protocol layer of the sending client for transfer over the network and reception by a network protocol layer of the receiving client;

(i) computer code for receiving, at the receiving client, second data from the network protocol layer of the receiving client, the second data including the first data to which the first security operation has been applied;

(j) computer code for determining, at the receiving client, whether said second data is eligible for a second security operation, wherein eligibility is determined by second selector data contained in the second data;

(k) computer code for creating, at the receiving client, a second selector based on the second selector data and using said second selector to search the second database for at least one selector/security association pair identifying a second security association corresponding to the second selector;

(l) computer code for applying, at the receiving client, the second security operation to the second data if the second data is eligible, wherein said computer code for applying the second security operation comprises computer code for using the second security association on the at least a portion of the second data; and

(m) computer code for sending, at the receiving client, the second data to which the second security operation has been applied to a network API of the receiving client.

2. The computer program product of claim 1, wherein the first selector data is based at least in part on one of an internet protocol address taken from the first data and a port indicator taken from the first data.

3. The computer program product of claim 1, wherein said computer code for applying the first security operation comprises at least one of computer code for attaching a header to the first data, said header including a security operation tag, and computer code for encrypting the first data.

4. The computer program product of claim 1, wherein said computer code for determining if the second data is eligible for the second security operation comprises at least one of computer code for detecting a security operation tag in a header of the second data, and computer code for detecting failure of an integrity check on the second data.

5. The computer program product of claim 1, wherein said computer code for determining if the second data is eligible for the second security operation comprises computer code for determining that the second data is not eligible for the second security operation if the second selector cannot be created based on the second selector data, said second data being sent to the network API of the receiving client without an applied security operation if it is so determined that the second data is not eligible.

6. The computer program product of claim 1, wherein said computer code for using the second security association comprises at least one of computer code for applying encryption to the second data, computer code for removing special packaging from the second data, computer code for applying decryption to the second data, and computer code for performing an integrity check on the second data.

7. The computer program product of claim 1, wherein said timewise intervals of said event are relatively short compared to an overall duration of said event.

8. The computer program product of claim 7, wherein said computer code for applying the first security operation at the sending client comprises computer code for encrypting the first data using a first symmetric encryption key from the first database, and wherein said computer code for applying the second security operation at the receiving client comprises computer code for reversing said first security operation using a second symmetric encryption key from the second database corresponding to said first symmetric encryption key.

9. A computer program product embodied on at least one non-transitory computer readable storage medium for use with at least one computer processor at a sending client for implementing data security in a transfer of an event from the sending client to a receiving client located remotely therefrom across a network, the network further including a key server located remotely from each of the sending and receiving clients, the computer program product comprising:

computer code for receiving data from a network application program interface (API) of the sending client, the data comprising a portion of the event to be sent from the sending client to the receiving client;

computer code for determining if the data is eligible for a security operation, wherein eligibility is determined by selector data contained in the data;

computer code for creating a selector based on the selector data and using said selector to search a local sending client database of security associations for at least one selector/security association pair identifying a security association corresponding to the selector, said local sending client database storing a plurality of selector/security association pairs received from the key server corresponding to different timewise intervals of said event;

computer code for applying the security operation to the data if the data is eligible, wherein said computer code for applying the security operation comprises computer code for using the security association on the at least a portion of the data; and

computer code for sending the data to which the security operation has been applied to a network protocol layer of the sending client.

10. The computer program product of claim 9, wherein the selector data is based at least in part on one of an internet protocol address taken from the data and a port indicator taken from the data.

11. The computer program product of claim 9, wherein said computer code for applying the security operation comprises at least one of computer code for attaching a header to the data, said header including a security operation tag, and computer code for encrypting the data.

12. The computer program product of claim 9, wherein said timewise intervals of said event are relatively short compared to an overall duration of said event.

13. A computer program product embodied on at least one non-transitory computer readable storage medium for use with at least one computer processor at a receiving client for implementing data security in a transfer of an event to the receiving client from a sending client located remotely therefrom across a network, the network further including a key server located remotely from each of the sending and receiving clients, the computer program product comprising:

computer code for receiving data from a network protocol layer of the receiving client, the data comprising a portion of the event being received at the receiving client;

computer code for determining if the data is eligible for a security operation, wherein eligibility is determined by selector data contained in the data;

computer code for creating a selector based on the selector data and using said selector to search a local receiving client database of security associations for at least one selector/security association pair identifying a security association corresponding to the selector, said local receiving client database storing a plurality of selector/security association pairs received from the key server corresponding to different timewise intervals of said event;

computer code for applying the security operation to the data if the data is eligible, wherein said computer code for applying the security operation comprises computer code for using the security association on the at least a portion of the data; and

computer code for sending the data to which the security operation has been applied to a network API of the receiving client.

14. The computer program product of claim 13, wherein said computer code for determining if the data is eligible for a security operation comprises at least one of computer code for detecting a security operation tag in a header of the data, and computer code for detecting failure of an integrity check on the data.

15. The computer program product of claim 13, further comprising computer code for blocking the data from being sent to the network API if no security association corresponding to the selector is found.

16. The computer program product of claim 13, wherein said computer code for determining if the data is eligible for the security operation comprises computer code for determining that the data is not eligible for the security operation if the selector cannot be created based on the selector data, the data being sent to the network API of the receiving client without an applied security operation if it is so determined that the data is not eligible.

17. The computer program product of claim 13, further comprising computer code for blocking the data from being sent to the network API if the data includes selector data but no selector can be created from it.

18. The computer program product of claim 13, wherein said computer code for using the security association comprises at least one of computer code for applying encryption to the data, computer code for removing special packaging from the data, computer code for applying decryption to the data, and computer code for performing an integrity check on the data.

19. The computer program product of claim 13, wherein said timewise intervals of said event are relatively short compared to an overall duration of said event.

20. The computer program product of claim 19, wherein said computer code for applying the security operation to the data comprises computer code for reversing a previous security operation applied to the data by the sending client.

21. A system for implementing data security in a transfer of an event from a sending client to a receiving client located remotely therefrom across a network, the sending client including a first processor and the receiving client including a second processor, the network further including a key server located remotely from each of the sending and receiving clients, the system comprising:

a first memory associated with said first processor and storing first instructions that, when executed by said first processor, cause the first processor to perform steps comprising;

receiving keying information associated with the event from the key server, the keying information including a plurality of selector/security association pairs corresponding to different timewise intervals of the event;

populating a first database of selector/security association pairs local to the sending client using said keying information;

receiving first data from a network application program interface (API) of the sending client, the first data comprising a portion of the event to be sent from the sending client to the receiving client;

determining whether the first data is eligible for a first security operation, wherein eligibility is determined by first selector data contained in the first data;

creating a first selector based on the first selector data and use said first selector to search the first database for at least one selector/security association pair identifying a first security association corresponding to the first selector;

applying the first security operation to the first data if the first data is eligible, said applying the first security operation comprising using the first security association on the at least a portion of the first data; and

sending the first data to which the first security operation has been applied to a network protocol layer of the sending client for transfer over the network and reception by a network protocol layer of the receiving client; and

a second memory associated with said second processor and storing second instructions that, when executed by said second processor, cause the second processor to perform steps comprising;

receiving said keying information from said key server;

populating a second database of selector/security association pairs local to the receiving client using said keying information;

receiving second data from the network protocol layer of the receiving client, the second data including the first data to which the first security operation has been applied;

determining whether said second data is eligible for a second security operation, wherein eligibility is determined by second selector data contained in the second data;

creating a second selector based on the second selector data and using said second selector to search the second database for at least one selector/security association pair identifying a second security association corresponding to the second selector;

applying the second security operation to the second data if the second data is eligible, said applying the second security operation comprising using the second security association on the at least a portion of the second data; and

sending the second data to which the second security operation has been applied to a network API of the receiving client.

22. The system of claim 21, wherein the first selector data is based at least in part on one of an internet protocol address taken from the first data and a port indicator taken from the first data.

23. The system of claim 21, wherein said applying the first security operation comprises at least one of attaching a header to the first data, said header including a security operation tag, and encrypting the first data.

24. The system of claim 21, wherein said determining if the second data is eligible for the second security operation comprises at least one of detecting a security operation tag in a header of the second data, and detecting failure of an integrity check on the second data.

25. The system of claim 21, wherein said determining if the second data is eligible for the second security operation comprises determining that the second data is not eligible for the second security operation if the second selector cannot be created based on the second selector data, and wherein said second data is sent to the network API of the receiving client without an applied security operation if it is so determined that the second data is not eligible.

26. The system of claim 21, wherein the second security association comprises at least one of applying encryption to the second data, removing special packaging from the second data, applying decryption to the second data, and performing an integrity check on the second data.

27. The system of claim 21, wherein said timewise intervals of said event are relatively short compared to an overall duration of said event.

28. The system of claim 27, wherein said applying the first security operation comprises encrypting the first data using a first symmetric encryption key from the first database, and wherein said applying the second security operation comprises reversing said first security operation using a second symmetric encryption key from the second database corresponding to said first symmetric encryption key.

29. A system for implementing data security in a transfer of an event from a sending client to a receiving client located remotely therefrom across a network, the sending client including a processor, the network further including a key server located remotely from each of the sending and receiving clients, the system comprising a memory associated with the processor and storing instructions that, when executed by said processor, cause the processor to perform steps comprising:

receiving data from a network application program interface (API) of the sending client, the data comprising a portion of the event to be sent from the sending client to the receiving client;

determining whether the data is eligible for a security operation, wherein eligibility is determined by selector data contained in the data;

creating a selector based on the selector data and using said selector to search a local sending client database of security associations for at least one selector/security association pair identifying a security association corresponding to the selector, said local sending client database storing a plurality of selector/security association pairs received from the key server corresponding to different timewise intervals of said event;

applying the security operation to the data if the data is eligible, wherein applying the security operation comprises using the security association on the at least a portion of the data; and

sending the data to which the security operation has been applied to a network protocol layer of the sending client.

30. The system of claim 29, wherein the selector data is based at least in part on one of an internet protocol address taken from the data and a port indicator taken from the data.

31. The system of claim 29, wherein said applying the security operation comprises at least one of attaching a header to the data, said header including a security operation tag, and encrypting the data.

32. The system of claim 29, wherein said timewise intervals of said event are relatively short compared to an overall duration of said event.

33. A system for implementing data security in a transfer of an event from a sending client to a receiving client located remotely therefrom across a network, the receiving client including a processor, the network further including a key server located remotely from each of the sending and receiving clients, the system comprising a memory associated with the processor and storing instructions that, when executed by said processor, cause the processor to perform steps comprising:

receiving data from a network protocol layer of the receiving client, the data comprising a portion of the event being received at the receiving client;

determining whether the data is eligible for a security operation, wherein eligibility is determined by selector data contained in the data;

creating a selector based on the selector data and using said selector to search a local receiving client database of security associations for at least one selector/security association pair identifying a security association corresponding to the selector, said local receiving client database storing a plurality of selector/security association pairs received from the key server corresponding to different timewise intervals of said event;

applying the security operation to the data if the data is eligible, wherein said applying the security operation comprises using the security association on the at least a portion of the data; and

sending the data to which the security operation has been applied to a network API of the receiving client.

34. The system of claim 33, wherein determining if the data is eligible for a security operation comprises at least one of detecting a security operation tag in a header of the data, and detecting failure of an integrity check on the data.

35. The system of claim 33, further comprising blocking the data from being sent to the network API if no security association corresponding to the selector is found.

36. The system of claim 33, wherein determining whether the data is eligible for the security operation comprises determining that the data is not eligible for the security operation if the selector cannot be created based on the selector data, and wherein said data is sent to the network API of the receiving client without an applied security operation if it is so determined that the data is not eligible.

37. The system of claim 33, further comprising blocking the data from being sent to the network API if the data includes selector data but no selector can be created from it.

38. The system of claim 33, wherein the security association comprises at least one of applying encryption to the data, removing special packaging from the data, applying decryption to the data;

and performing an integrity check on the data.

39. The system of claim 33, wherein said timewise intervals of said event are relatively short compared to an overall duration of said event.

40. The system of claim 39, wherein said applying the security operation to the data comprises reversing a previous security operation applied to the data by the sending client.