Secured communications arrangement applying internet protocol security

• US 9,716,589 B2
• Filed: 09/30/2013
• Issued: 07/25/2017
• Est. Priority Date: 04/22/2013
• Status: Active Grant

• Current Assignee: Unisys Corporation
• Original Assignee: Unisys Corporation
• Inventors: Inforzato, Sarah K, Hinaman, Ted, Johnson, Robert A, Wild, Kathleen
• Primary Examiner(s): Najjar, Saleh
• Assistant Examiner(s): Teng, Louis
• Application Number:
  US14/042,182
• Publication Number:
  US 20140317405A1
• Time in Patent Office: 1,394 Days
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0485 Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 69/18 Multiprotocol handlers, e.g. single devices capable of handling multiple protocols
• CPC Class Codes: H04L 9/0838 Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these network architectures or network communication protocols for key exchange in a packet data network H04L63/061
• CPC Class Codes: H04L 9/0841 involving Diffie-Hellman or related key agreement protocols

Abstract

A secure communications arrangement including an endpoint is disclosed. The endpoint includes a computing system. The computing system includes a user level services component and a kernel level callout driver interfaced to the user level services component and configured to establish an IPsec tunnel with a remote endpoint. The computing system also includes a filter engine storing one or more filters defining endpoints authorized to communicate with the endpoint via the IPsec tunnel. The computing system also includes a second kernel level driver configured to establish a secure tunnel using a second security protocol different from IPsec.

Claims

1. An endpoint comprising a computing system, the computing system including:

a user level services component;

an input/output control (IOCTL) interface;

a kernel level callout driver interfaced to the user level services component via the IOCTL interface and configured to establish an IPsec tunnel with a remote endpoint;

a filter engine storing one or more filters defining endpoints authorized to communicate with the endpoint via the IPsec tunnel; and

a second kernel level driver interfaced to the user level services component via the IOCTL interface and residing between the kernel level callout driver and a network interface of the endpoint, the second kernel level driver configured to establish a secure tunnel using a second security protocol different from IPsec;

wherein the IPsec tunnel and secure tunnel are selectably established based on an addressing scheme of a network to which the endpoint is connected, the second kernel level driver configured to pass packets exchanged via the IPsec tunnel to the kernel level callout driver; and

wherein a user is associated with a community of interest, and wherein the user level services component manages storage of one or more community of interest keys including a key assigned to the community of interest associated with the user; and

wherein one or more community of interest keys are provided to the endpoint via the secure tunnel.

2. The endpoint of claim 1, wherein the computing system includes an operating system that includes a native IPsec security protocol implementation.

3. The endpoint of claim 2, wherein the kernel level callout driver utilizes the native IPsec security protocol implementation.

4. The endpoint of claim 1, wherein the kernel level callout driver utilizes a native IPsec security protocol implementation.

5. The endpoint of claim 1, wherein the second kernel level driver passes through IPsec-secured communications received at the kernel level callout driver from the endpoint.

6. The endpoint of claim 1, wherein the one or more filters block requests received at the endpoint from endpoints not allowed by the one or more filters.

7. The endpoint of claim 6, wherein the one or more filters define computing systems within an intranet.

8. The endpoint of claim 1, further comprising a user logon component configured to associate a user with the endpoint.

9. The endpoint of claim 1, wherein the filter engine applies a filter based on the key assigned to the community of interest associated with the user.

10. The endpoint of claim 1, further comprising a plurality of user level services including a prelogon service, a logon service, and a protocol service.

11. The endpoint of claim 10, further comprising an applet interface to the logon service.

12. A secure communications arrangement comprising:

an endpoint comprising a computing system, the computing system including;

a user level services component;

an input/output control (IOCTL) interface;

a kernel level callout driver interfaced to the user level services component via the IOCTL interface and configured to establish an IPsec tunnel with a remote endpoint;

a filter engine storing one or more filters defining endpoints authorized to communicate with the endpoint via the IPsec tunnel; and

a second kernel level driver interfaced to the user level services component via the IOCTL interface and residing between the kernel level callout driver and a network interface of the endpoint, the second kernel level driver configured to establish a secure tunnel using a second security protocol different from Ipsec;

wherein the IPsec tunnel and secure tunnel are selectably established based on an addressing scheme of a network to which the endpoint is connected, the second kernel level driver configured to pass packets exchanged via the IPsec tunnel to the kernel level callout driver; and

an administration server configured to securely communicate with the endpoint via the secure tunnel established via the second kernel level driver, wherein the administration server is configured to provide one or more community of interest keys to the endpoint via the secure tunnel.

13. The secure communications arrangement of claim 12, further comprising the remote endpoint.

14. The secure communications arrangement of claim 12, wherein the administration server is configured to provide secure remote access to the endpoint via the secure tunnel.

15. The secure communications arrangement of claim 12, further comprising a security appliance configured to securely communicate with the endpoint via the secure tunnel established via the second kernel level driver.

16. The secure communications arrangement of claim 15, wherein the security appliance is configured to receive log events from the endpoint, wherein at least one of the log events is associated with the IPsec tunnel established with the remote endpoint.

17. A secure communications arrangement comprising:

a first endpoint comprising a computing system, the computing system including;

a user level services component;

an input/output control (IOCTL) interface;

a kernel level callout driver interfaced to the user level services component via the IOCTL interface and configured to establish an IPsec tunnel with a second endpoint;

a filter engine storing one or more filters defining endpoints authorized to communicate with the first endpoint via the IPsec tunnel; and

a second kernel level driver residing between the kernel level callout driver and a network interface of the endpoint, the second kernel level driver configured to the user level services component via the IOCTL interface and configured to establish a secure tunnel using a second security protocol different from IPsec;

wherein the IPsec tunnel and secure tunnel are selectably established based on an addressing scheme of a network to which the endpoint is connected, the second kernel level driver configured to pass packets exchanged via the IPsec tunnel to the kernel level callout driver;

the second endpoint comprising a second computing system, the second computing system including;

a second user level services component;

a second input/output control (IOCTL) interface;

a second kernel level callout driver interfaced to the second user level services component via the second IOCTL interface and configured to establish an IPsec tunnel with the first endpoint;

a second filter engine storing one or more filters defining endpoints authorized to communicate with the second endpoint via the IPsec tunnel; and

a second kernel level driver interfaced to the user level services component via the second IOCTL interface and configured to establish a second secure tunnel using a second security protocol different from IPsec;

a security appliance communicatively connected to the first endpoint via the secure tunnel and to the second endpoint via the second secure tunnel, in which the security appliance is configured to receive log events from the endpoint, wherein at least one of the log events is associated with the IPsec tunnel established with the first endpoint; and

an administration server communicatively connected to the first and second endpoints and configured to provide community of interest keys to the first and second endpoints via the second secured tunnel.