Proactive internet connectivity probe generator

• US 9,756,078 B2
• Filed: 07/24/2014
• Issued: 09/05/2017
• Est. Priority Date: 07/24/2014
• Status: Active Grant

• Current Assignee: GE Digital Holdings LLC (GE Aerospace)
• Original Assignee: General Electric Company
• Inventors: Berdichevski, Igor, Ateret, Lior
• Primary Examiner(s): BAROT, BHARAT
• Application Number:
  US14/339,748
• Publication Number:
  US 20160028601A1
• Time in Patent Office: 1,139 Days
• Field of Search: 709220-222, 709223-224, 713151-152
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/16 Implementing security features at a particular protocol layer
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 69/321 Interlayer communication protocols or service data unit [SDU] definitions; Interfaces between layers

Abstract

Described herein are reception of first processor-executable program code and a configuration file specifying a target internet protocol address, an asset-identifying information type, and a security protocol, and execution of the received first processor-executable program code to identify a first one or more network communication interfaces of the first computing system, generate a message including information conforming to the asset-identifying information type, the information identifying a first asset, secure the message based on the security protocol, and transmit the secure message to the target internet protocol address via each of the first one or more network communication interfaces.

Claims

1. A system comprising:

a first computing device comprising;

a first one or more network communication interfaces associated with a network protocol comprising one or more transmission layers; and

a first processor to execute processor-executable program code in order to cause the first computing device to;

receive (1) first processor-executable program code and (2) a configuration file specifying (i) a target internet protocol address, (ii) an asset-identifying information type to identify a particular hardware machine, and (iii) a security protocol for transmission over the one or more transmission layers, the security protocol comprising public key encryption via a public key, a unique asynchronous key, or password-protection wherein in a case that the security protocol is public key encryption, the configuration file comprises the public key; and

execute the received first processor-executable program code to;

identify the first one or more network communication interfaces by probing the one or more transmission layers;

generate a message including information conforming to the asset-identifying information type, the information identifying a first asset;

secure the message based on the security protocol; and

transmit the secure message to the target internet protocol address via each of the first one or more network communication interfaces.

2. A system according to claim 1, further comprising:

a second computing device comprising;

a second network communication interface; and

a second processor to execute processor-executable program code in order to cause the second computing device to;

generate the configuration file specifying the target internet protocol address, the asset-identifying information type, and the security protocol; and

transmit the configuration file from the second network communication interface to the first computing device,

wherein the first computing device and the second computing device are within a same demilitarized computing network.

3. A system according to claim 2, wherein the second processor is further to execute the processor-executable program code in order to cause the second computing device to transmit the first processor-executable program code to the first computing device.

4. A system according to claim 1, further comprising:

a second computing device comprising;

a second network communication interface; and

a second processor to execute processor-executable program code in order to cause the second computing device to;

receive the secure message at the target internet protocol address;

unsecure the secure message based on the security protocol to generate the message; and

determine the first asset based on the information identifying the first asset in the message.

5. A system according to claim 4, the second processor to further execute processor-executable program code in order to cause the second computing device to:

in response to the determination of the first asset, execute security measures to protect the first asset.

6. A system according to claim 4, further comprising:

a third computing device comprising;

a third network communication interface; and

a third processor to execute processor-executable program code in order to cause the third computing device to;

generate the configuration file specifying the target internet protocol address, the asset-identifying information type, and the security protocol; and

transmit the configuration file from the third network communication interface to the first computing device,

wherein the first computing device and the third computing device are within a same demilitarized computing network.

7. A system according to claim 1, wherein the asset-identifying information type comprises a hardware serial number.

8. A non-transitory computer-readable medium storing program code, the program code executable by a processor of a first computing system to cause the first computing system to:

receive (1) first processor-executable program code and (2) a configuration file specifying (i) a target internet protocol address, (ii) an asset-identifying information type, and (iii) a security protocol for transmission over one or more transmission layers associated with a network protocol, the security protocol comprising public key encryption via a public key, a unique asynchronous key, or password-protection wherein in a case that the security protocol is public key encryption, the configuration file comprises the public key; and

execute the received first processor-executable program code to;

identify a first one or more network communication interfaces of the first computing system by probing the one or more transmission layers;

generate a message including information conforming to the asset-identifying information type, the information identifying a first asset;

secure the message based on the security protocol; and

transmit the secure message to the target internet protocol address via each of the first one or more network communication interfaces.

9. A non-transitory computer-readable medium according to claim 8, the program code executable by a processor of a second computing system to cause the second computing system to:

generate the configuration file specifying the target internet protocol address, the asset-identifying information type, and the security protocol; and

transmit the configuration file from the second network communication interface to the first computing system,

wherein the first computing system and the second computing system are within a same demilitarized computing network.

10. A system according to claim 9, the program code executable by the processor of the second computing system to cause the second computing system to transmit the first processor-executable program code to the first computing system.

11. A non-transitory computer-readable medium according to claim 8, the program code executable by a processor of a second computing system to cause the second computing system to:

receive the secure message at the target internet protocol address;

unsecure the secure message based on the security protocol to generate the message; and

determine the first asset based on the information identifying the first asset in the message.

12. A system according to claim 11, the program code executable by the processor of the second computing system to cause the second computing system to,

in response to the determination of the first asset, execute security measures to protect the first asset.

13. A non-transitory computer-readable medium according to claim 11, the program code executable by a processor of a third computing system to cause the third computing system to:

generate the configuration file specifying the target internet protocol address, the asset-identifying information type, and the security protocol; and

transmit the configuration file from a network communication interface of the third computing system to the first computing system,

wherein the first computing system and the third computing system are within a same demilitarized computing network.

14. A non-transitory computer-readable medium according to claim 8, wherein the asset-identifying information type comprises a hardware serial number.

15. A computer-implemented method comprising:

receiving, at a first computing system, (1) first processor-executable program code and (2) a configuration file specifying (i) a target internet protocol address, (ii) an asset-identifying information type, and (iii) a security protocol for transmission over one or more transmission layers associated with a network protocol, the security protocol comprising public key encryption via a public key, a unique asynchronous key, or password-protection wherein in a case that the security protocol is public key encryption, the configuration file comprises the public key;

executing the received first processor-executable program code at the first computing system to;

identify a first one or more network communication interfaces of the first computing system by probing the one or more transmission layers;

generate a message including information conforming to the asset-identifying information type, the information identifying a first asset;

secure the message based on the security protocol; and

transmit the secure message to the target internet protocol address via each of the first one or more network communication interfaces.

16. A computer-implemented method according to claim 15, further comprising:

generating, at a second computing system, the configuration file specifying the target internet protocol address, the asset-identifying information type, and the security protocol; and

transmitting the configuration file from a second network communication interface of the second computing system to the first computing system,

wherein the first computing system and the second computing system are within a same demilitarized computing network.

17. A computer-implemented method according to claim 15, further comprising:

transmitting the first processor-executable program code from the second computing system to the first computing system.

18. A computer-implemented method according to claim 15, further comprising:

receiving the secure message at the target internet protocol address at a second computing system;

unsecuring, at the second computing system, the secure message based on the security protocol to generate the message; and

determining, at the second computing system, the first asset based on the information identifying the first asset in the message.

19. A computer-implemented method according to claim 18, further comprising:

in response to the determination of the first asset, executing security measures to protect the first asset.

20. A computer-implemented method according to claim 18, further comprising:

generating, at a third computing system, the configuration file specifying the target internet protocol address, the asset-identifying information type, and the security protocol; and

transmitting the configuration file from a network communication interface of the third computing system to the first computing system,

wherein the first computing system and the third computing system are within a same demilitarized computing network.