×

Auditable cryptographic protected cloud computing communication system

  • US 8,694,770 B1
  • Filed: 08/21/2012
  • Issued: 04/08/2014
  • Est. Priority Date: 07/18/2012
  • Status: Active Grant
First Claim
Patent Images

1. An auditable cryptographic protected cloud computing communication system comprising:

  • a. a plurality of industrial devices, wherein each industrial device has an individualized messaging protocol enabling each industrial device to receive commands and transmit status and measurement data using the individualized messaging protocol for each industrial device;

    b. a computing cloud in communication with the plurality of industrial devices, wherein the computing cloud is configured to provide at least one service and shared hardware and software resources, and wherein the computing cloud comprises;

    (i) one or more data storages;

    (ii) one or more processors;

    (iii) one or more enterprise servers having an enterprise processor, wherein the enterprise processor is in communication with an enterprise data storage, one or more data storages in the cloud, or combinations thereof, wherein the enterprise server communicates in each individualized messaging protocol of each industrial device using in-band and out-of-band messages; and

    (iv) a plurality of physical cryptographic modules, each physical cryptographic module having a physical cryptographic module processor with a physical cryptographic module data storage, and wherein the plurality of physical cryptographic modules are disposed between the enterprise server in the computing cloud and each industrial device for communicating in-band messages to each industrial device using the messaging protocol of each industrial device, and wherein each physical cryptographic module data storage comprises;

    1. computer instructions to receive in-band plain text status and measurement data in the individualized messaging protocol of the industrial device in communication therewith;

    2. computer instructions to transmit in-band decrypted commands to the industrial device, in communication therewith;

    3. computer instructions for providing encrypted messaging both in-band and out-of-band from the industrial device, in communication therewith, using the individualized messaging protocol of the industrial device; and

    4. computer instructions to generate cryptographic keys for;

    digital signatures in authentication certificates;

    cryptographic key exchanges; and

    cryptographic communication sessions between the plurality of physical cryptographic modules, a cryptographic manager tool, one or more data storages in the computing cloud, or combinations thereof without human intervention, allowing online encryption and decryption of plain text commands, status and measurement data, messages, log information, and alarm messages, without turning off any operating industrial devices, and without turning off the enterprise server in the computing cloud and while creating an auditable communication pathway from the enterprise server in the computing cloud to operating industrial devices; and

    c. wherein the cryptographic manager tool comprises;

    (i) a plurality of virtual cryptographic modules, wherein each virtual cryptographic module comprises;

    1. computer instructions to receive plain text commands from the enterprise server to start at least one virtual cryptographic module of the plurality of virtual cryptographic modules and provide routine commands to the at least one virtual cryptographic module during operation;

    2. computer instructions to receive plain text setting commands from the cryptographic manager tool;

    3. computer instructions to transmit plain text setting information to the cryptographic manager tool;

    4. computer instructions to transmit in-band plain text commands during start up to the physical cryptographic module;

    5. computer instructions to transmit out-of-band plain text commands during start up to the physical cryptographic module;

    6. computer instructions to receive in-band plain text and status and measurement data from the physical cryptographic module during start up;

    7. computer instructions to receive out-of-band plain text messages from the physical cryptographic module during start up;

    8. computer instructions to receive out-of-band encrypted log information with status and measurement data from the physical cryptographic module;

    9. computer instructions to receive out-of-band alarm messages from the physical cryptographic module;

    10. computer instructions to transmit out-of-band encrypted commands to the physical cryptographic module;

    11. computer instructions to receive in-band encrypted status and measurement data from the physical cryptographic module;

    12. computer instructions to transmit in-band encrypted commands to the physical cryptographic module;

    13. computer instructions to transmit encrypted collected log information to the enterprise server;

    14. computer instructions to transmit decrypted status and measurement data in the messaging protocol of the industrial device from the industrial device to the enterprise server;

    15. computer instructions to monitor, configure and reconfigure online and on demand, continuously, a plurality of cryptographic pipes connecting the cryptographic manager tool to the physical cryptographic modules and wherein the cryptographic pipes comprise computer instructions in one or more data storages in the computing cloud for controlling communication between the cryptographic manager tool and the physical cryptographic modules simultaneously;

    16. computer instructions to monitor, configure, and reconfigure online and on demand, continuously, the plurality of physical cryptographic modules, simultaneously;

    17. computer instructions to monitor, configure, and reconfigure online and on demand, continuously, the plurality of virtual cryptographic modules, simultaneously;

    18. computer instructions to generate cryptographic keys for;

    digital signatures in authentication certificates and cryptographic key exchanges;

    19. computer instructions to create cryptographic communication sessions between the plurality of virtual cryptographic modules and the plurality of physical cryptographic modules, without human intervention, allowing cloud computing based encryption and decryption of plain text commands, status and measurement data, messages, log information, and alarm messages without turning off any operating industrial devices, and without turning off the enterprise server in the computing cloud, and while creating an auditable communication pathway from the enterprise server in the computing cloud to operating industrial devices;

    20. computer instructions to transmit plain text setting information to at least one cryptographic pipe of the plurality of cryptographic pipes;

    21. computer instructions to receive plain text setting information from at least one cryptographic pipe of the plurality of cryptographic pipes;

    22. a library of virtual cryptographic module settings;

    23. a library of physical cryptographic module settings; and

    24. computer instructions to schedule generation of cryptographic keys by the virtual cryptographic module, by the physical cryptographic module, or combinations thereof, using cryptographic time outs; and

    wherein at least one cryptographic pipe of the plurality of cryptographic pipes communicates with at least one virtual cryptographic module of the plurality of virtual cryptographic modules.

View all claims
  • 2 Assignments
Timeline View
Assignment View
    ×
    ×