Hardware security agent for network communications

• US 9,225,689 B2
• Filed: 02/28/2014
• Issued: 12/29/2015
• Est. Priority Date: 02/28/2014
• Status: Active Grant

• Current Assignee: SAP SE
• Original Assignee: SAP SE
• Inventors: Lorch, Robert
• Primary Examiner(s): Smithers, Matthew
• Application Number:
  US14/194,329
• Publication Number:
  US 20150249646A1
• Time in Patent Office: 669 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: H04L 63/0414 during transmission, i.e. party's identity is protected against eavesdropping, e.g. by using temporary identifiers, but is known to the other party or parties involved in the communication
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

A hardware security agent may include a request inspector configured to receive an alias at the hardware security agent by way of a network interface of an untrusted computer, and a mapper configured to map the alias to corresponding protected data stored within the hardware security agent. The hardware security agent may further include a substitution manager configured to provide the corresponding protected data from the hardware security agent over a network to a target network site.

Claims

1. A hardware security agent including instructions recorded on a nontransitory computer-readable medium, and executable by at least one processor, the hardware security agent comprising:

a request inspector configured to receive an alias at the hardware security agent by way of a network interface of an untrusted computer;

a mapper configured to map the alias to corresponding protected data stored within the hardware security agent; and

a substitution manager configured to provide the corresponding protected data from the hardware security agent over a network to a target network site.

2. The hardware security agent of claim 1, comprising an alias generator configured to receive the alias from a user for storage in conjunction with the protected data within the hardware security agent, using a configuration interface of the hardware security agent.

3. The hardware security agent of claim 2, wherein the configuration interface is not connected to the network and is connected to a corresponding interface of a trusted computer to receive the alias.

4. The hardware security agent of claim 1, wherein the protected data includes authentication credentials of a user of the hardware security agent for accessing a user account at the target site.

5. The hardware security agent of claim 1, wherein the protected data includes financial information of a user of the hardware security agent sent to the target network site to facilitate a transaction therewith.

6. The hardware security agent of claim 1, wherein the request inspector is further configured to receive the alias from within an intercepted network request designated for the target network site.

7. The hardware security agent of claim 6, wherein the substitution manager is configured to substitute the protected data for the alias within the intercepted network request, to provide a secure network request in a standard form expected by the target network site.

8. The hardware security agent of claim 1, wherein the request inspector is configured to:

receive a response from the target network site after receipt of the protected data thereby;

inspect the response for inclusion of additional protected data therein; and

substitute the additional protected data with a corresponding additional alias.

9. The hardware security agent of claim 1, further comprising an authentication engine configured to require authentication of a user of the hardware security agent before providing access thereto to the user.

10. A computer-implemented method for executing instructions stored on a non-transitory computer readable storage medium, the method comprising:

receiving an alias at a hardware security agent by way of a network interface of an untrusted computer;

mapping the alias to corresponding protected data stored within the hardware security agent; and

providing the corresponding protected data from the hardware security agent over a network to a target network site.

11. The method of claim 10, further comprising receiving the alias from a user for storage in conjunction with the protected data within the hardware security agent, using a configuration interface of the hardware security agent, wherein the configuration interface is not connected to the network and is connected to a corresponding interface of a trusted computer to receive the alias.

12. The method of claim 10, wherein receiving the alias comprises receiving the alias from within an intercepted network request from the untrusted computer designated for the target network site.

13. The method of claim 12, wherein providing the corresponding protected data comprises:

substituting the protected data for the alias within the intercepted network request; and

providing a secure network request in a standard form expected by the target network site.

14. The method of claim 10, further comprising:

receiving a response from the target network site after receipt of the protected data thereby;

inspecting the response for inclusion of additional protected data therein; and

substituting the additional protected data with a corresponding additional alias.

15. A computer program product, the computer program product being tangibly embodied on a non-transitory computer-readable storage medium and comprising instructions that, when executed, by at least one processor, cause the at least one processor to:

receive an alias at a hardware security agent by way of a network interface of an untrusted computer;

map the alias to corresponding protected data stored within the hardware security agent; and

provide the corresponding protected data from the hardware security agent over a network to a target network site.

16. The computer program product of claim 15, wherein the instructions, when executed, cause the at least one processor to receive the alias from a user for storage in conjunction with the protected data within the hardware security agent, using a configuration interface of the hardware security agent.

17. The computer program product of claim 16, wherein the configuration interface is not connected to the network and is connected to a corresponding interface of a trusted computer to receive the alias.

18. The computer program product of claim 15, wherein the instructions, when executed, cause the at least one processor to receive the alias from within an intercepted network request designated for the target network site.

19. The computer program product of claim 18, wherein the instructions, when executed, cause the at least one processor to substitute the protected data for the alias within the intercepted network request, to provide a secure network request in a standard form expected by the target network site.

20. The computer program product of claim 15, wherein the instructions, when executed cause the at least one processor to:

receive a response from the target network site after receipt of the protected data thereby;

inspect the response for inclusion of additional protected data therein; and

substitute the additional protected data with a corresponding additional alias.