Method and system for automatically managing secure communications and distribution of secrets in multiple communications jurisdiction zones

• US 9,942,275 B2
• Filed: 07/29/2016
• Issued: 04/10/2018
• Est. Priority Date: 11/01/2013
• Status: Active Grant

• Current Assignee: Intuit, Inc.
• Original Assignee: Intuit, Inc.
• Inventors: Lietz, M. Shannon, Cabrera, Luis Felipe
• Primary Examiner(s): Tran, Tri
• Application Number:
  US15/223,331
• Publication Number:
  US 20160337406A1
• Time in Patent Office: 620 Days
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24

Abstract

Communications and security policy data for two or more zones is obtained that includes data indicating allowed protocols for the respective communications jurisdiction zones. Request data indicating a desired exchange of data between a secrets data source in a first zone and a requesting resource in a second zone is received/obtained. The first zone policy data and the second zone policy data is automatically obtained and analyzed to determine an allowed type of communications security level for the desired exchange of data that complies with both the first zone communications and data security policy data and the second zone policy data. A communications channel, including the allowed type of secure communications security level, is automatically establishing between the first resource and the second resource, and at least a portion of the requests secrets and/or other data is exchanged.

Claims

1. A system for automatically managing secure communications and transferring secrets across multiple communications jurisdiction zones comprising:

at least one processor; and

at least one memory coupled to the at least one processor, the at least one memory having stored therein instructions which when executed by any set of the at least one processors, perform a process for automatically managing secure communications and transferring secrets across multiple communications jurisdiction zones, the process including;

identifying two or more communications jurisdiction zones from which, and/or to which, secrets and other data may be transferred using one or more types of communications channels including one or more types of secure communications security levels;

obtaining communications and data security policy data for the identified communications jurisdiction zones, the communications and data security policy data for the identified communications jurisdiction zones including data indicating allowed types of secure communications security levels for the respective communications jurisdiction zones, the communications and data security policy data for the plurality of data security jurisdiction zones further including data indicating allowed secrets data for each of the respective data security jurisdiction zones of the plurality of data security jurisdiction zones and nonallowed secrets data for the respective data security jurisdiction zones of the plurality of data security jurisdiction zones, the allowed secrets data for each given respective data security jurisdiction zone representing one or more secrets allowed to be used to protect data in the given data security jurisdiction zone;

obtaining secrets request data originating from a requesting resource, the obtained secrets request data indicating a desired exchange of secrets data to a requesting resource, at least a portion of the secrets data being in a first communications jurisdiction zone and the requesting resource being in a second communications jurisdiction zone different from the first communications jurisdiction zone;

automatically obtaining first communications jurisdiction zone communications and data security policy data associated with the first communications jurisdiction zone and second communications jurisdiction zone communications and data security policy data associated with second communications jurisdiction zone from the communications and data security policy data;

automatically analyzing the data security policy data of the data security jurisdiction zone of the requesting resource to determine allowed secrets encryption key data with respect to the data security jurisdiction zone of the requesting resource;

identifying one or more classes of allowed secrets data by classifying the allowed secrets data represented by the secrets data according to a level of security provided by the secrets represented by the allowed secrets;

obtaining the allowed secrets data within the one or more classes of allowed secrets data with respect to the data security jurisdiction zone of the requesting resource;

automatically analyzing the first communications jurisdiction zone communications and data security policy data, the second communications jurisdiction zone communications and data security policy data, and the secrets request data to determine at least one allowed type of secure communications security level for the desired exchange of secrets and/or other data that complies with both the first communications jurisdiction zone communications and data security policy data and the second communications jurisdiction zone communications and data security policy data;

selecting one of the at least one allowed type of secure communications security level;

automatically establishing the required type of communications channel including the allowed type of secure communications security level between the first communications jurisdiction zone and the second communications jurisdiction zone; and

automatically providing the allowed secrets data to the requesting resource.

2. The system for automatically managing secure communications and transferring secrets across multiple communications jurisdiction zones of claim 1 wherein at least one of the two or more communications jurisdiction zones are selected from the group of communications jurisdiction zones consisting of:

a geographic region communications jurisdiction zone;

a political region communications jurisdiction zone;

a security based communications jurisdiction zone;

a computing environment communications jurisdiction zone;

a computing sub-environment communications jurisdiction zone within a computing environment communications jurisdiction zone; and

any combination thereof.

3. The system for automatically managing secure communications and transferring secrets across multiple communications jurisdiction zones of claim 1 wherein at least one of the one or more types of communications channels is selected from the group of types of communications channels consisting of:

an SSL communications channel;

a TLS communications channel;

an STMP communications channel;

an SMTP communications channel;

an STP communications channel;

an ICMP communications channel; and

any secure communication protocol channel.

4. The system for automatically managing secure communications and transferring secrets across multiple communications jurisdiction zones of claim 1 wherein at least one of the one or more types of secure communications security levels is an encryption level for encrypting data transferred using the one or more types of communications channels and/or encrypting messages transferred using the one or more types of communications channels.

5. The system for automatically managing secure communications and transferring secrets across multiple communications jurisdiction zones of claim 1 wherein the allowed secrets data is allowed encryption key data including at least one encryption key in compliance with the data security policy data for the data security jurisdiction zone of the requesting resource.

6. The system for automatically managing secure communications and transferring secrets across multiple communications jurisdiction zones of claim 5 wherein at least one encryption key represented by the allowed encryption key data is selected from the group of encryption keys consisting of:

a public encryption key;

a private encryption key;

a symmetric encryption key;

an asymmetric encryption key;

a public pre-placed encryption key;

a private pre-placed encryption key;

a 40-bit encryption key;

any length encryption keys;

an authentication encryption key;

a benign encryption key;

a content-encryption key (CEK);

a cryptovariable encryption key;

a derived encryption key;

an electronic encryption key;

an ephemeral encryption key;

a key encryption key (KEK);

a key production encryption key (KPK);

a FIREFLY encryption key;

a master encryption key;

a message encryption key (MEK);

a RED encryption key;

a session encryption key;

a traffic encryption key (TEK);

a transmission security encryption key (TSK);

a seed encryption key;

a signature encryption key;

a stream encryption key;

a Type 1 encryption key;

a Type 2 encryption key;

a Vernam encryption key;

a zeroized encryption key; and

any combination thereof.

7. The system for automatically managing secure communications and transferring secrets across multiple communications jurisdiction zones of claim 1 wherein the secrets request data represents a request for encryption key data to be transferred to the requesting resource.

8. The system for automatically managing secure communications and transferring secrets across multiple communications jurisdiction zones of claim 1 wherein the allowed secrets data is allowed encryption key data including at least one encryption key in compliance with the data security policy data for the data security jurisdiction zone of the requesting resource.

9. The system for automatically managing secure communications and transferring secrets across multiple communications jurisdiction zones of claim 8 wherein the communications and data security policy data for the identified communications jurisdiction zones is updated automatically.

10. A system for automatically managing secure communications and transferring secrets across multiple communications jurisdiction zones comprising:

at least one processor; and

at least one memory coupled to the at least one processor, the at least one memory having stored therein instructions which when executed by any set of the at least one processors, perform a process for automatically managing secure communications and transferring secrets across multiple communications jurisdiction zones, the process including;

identifying two or more communications jurisdiction zones from which, and/or to which, secrets and other data may be transferred using one or more types of communications channels including one or more types of secure communications security levels;

obtaining communications and data security policy data for the identified communications jurisdiction zones, the communications and data security policy data for the identified communications jurisdiction zones including data indicating allowed types of secure communications security levels for the respective communications jurisdiction zones, the data security policy data for the plurality of data security jurisdiction zones including data indicating allowed secrets data for each of the respective data security jurisdiction zones of the plurality of data security jurisdiction zones and nonallowed secrets data for the respective data security jurisdiction zones of the plurality of data security jurisdiction zones, the allowed secrets data for each given respective data security jurisdiction zone representing one or more secrets allowed to be used to protect data in the given data security jurisdiction zone;

obtaining secrets request data indicating a desired exchange of secrets data between a first resource in a first communications jurisdiction zone and a requesting resource in a second communications jurisdiction zone;

automatically obtaining first communications jurisdiction zone communications and data security policy data associated with the first communications jurisdiction zone and second communications jurisdiction zone communications and data security policy data associated with second communications jurisdiction zone from the communications and data security policy data;

automatically analyzing the data security policy data of the data security jurisdiction zone of the requesting resource to determine allowed secrets encryption key data with respect to the data security jurisdiction zone of the requesting resource;

identifying one or more classes of allowed secrets data by classifying the allowed secrets data represented by the secrets data according to a level of security provided by the secrets;

obtaining the allowed secrets data within the one or more classes of allowed secrets data with respect to the data security jurisdiction zone of the requesting resource;

automatically analyzing the data indicating the desired exchange of secrets and/or other data to determine a required type of communications channel;

obtaining enterprise data transfer policy data, the enterprise data transfer policy data including data indicating required types of secure communications security levels for one or more types of secrets data;

automatically analyzing the allowed secrets data and the enterprise data transfer policy data to determine enterprise allowed types of secure communications security levels data for the desired exchange of secrets data;

automatically analyzing the first communications jurisdiction zone communications and data security policy data, the second communications jurisdiction zone communications and data security policy data, and the enterprise allowed types of secure communications security level data, to determine at least one allowed type of secure communications security level for the desired exchange of secrets and/or other data that complies with each of the first communications jurisdiction zone communications and data security policy data, the second communications jurisdiction zone communications and data security policy data, and the enterprise allowed types of secure communications security level data;

selecting, from the allowed types of secure communications security levels for the first communications jurisdiction zone communications and data security policy data, the second communications jurisdiction zone communications and data security policy data, and the enterprise allowed types of secure communications security level data and the secrets request data, one of the at least one allowed type of secure communications security level;

automatically establishing the required type of communications channel including the allowed type of secure communications security level between the first communications jurisdiction zone and the second communications jurisdiction zone; and

automatically providing the allowed secrets data to the requesting resource.

11. The system for automatically managing secure communications and transferring secrets across multiple communications jurisdiction zones of claim 10 wherein at least one of the two or more communications jurisdiction zones are selected from the group of communications jurisdiction zones consisting of:

a geographic region communications jurisdiction zone;

a political region communications jurisdiction zone;

a security based communications jurisdiction zone;

a computing environment communications jurisdiction zone;

a computing sub-environment communications jurisdiction zone within a computing environment communications jurisdiction zone; and

any combination thereof.

12. The system for automatically managing secure communications and transferring secrets across multiple communications jurisdiction zones of claim 10 wherein at least one of the one or more types of communications channels is selected from the group of types of communications channels consisting of:

an SSL communications channel;

a TLS communications channel;

an STMP communications channel;

an SMTP communications channel;

an STP communications channel;

an ICMP communications channel; and

any secure communication protocol channel.

13. The system for automatically managing secure communications and transferring secrets across multiple communications jurisdiction zones of claim 10 wherein the enterprise data transfer policy data indicating required types of secure communications security levels for one or more types of data is determined based, at least in part, on at least one data classification factor selected from the group of data classification factors consisting of:

a determination as to the sensitivity of the secrets and/or other data to be transferred as determined by the enterprise charged with protecting the data;

a determination as to the sensitivity of the secrets and/or other data to be transferred as determined by one or more regulations and/or regulatory agencies;

a determination as to the sensitivity of the secrets and/or other data to be transferred as determined based on the need to protect the identity and personal information of the owners and/or sources of the data to be protected;

a determination of the risk associated with the secrets and/or other data to be transferred;

a determination of the vulnerability associated with the secrets and/or other data to be transferred;

a determination of the commercial value of the secrets and/or other data to be transferred;

a determination of the strategic value of the secrets and/or other data to be transferred;

a determination of the entertainment value of the secrets and/or other data to be transferred; and

any combination thereof.

14. The system for automatically managing secure communications and transferring secrets across multiple communications jurisdiction zones of claim 10 wherein at least one of the one or more types of secure communications security levels is an encryption level for encrypting data transferred using the one or more types of communications channels and/or encrypting messages transferred using the one or more types of communications channels.

15. The system for automatically managing secure communications and transferring secrets across multiple communications jurisdiction zones of claim 10 wherein the allowed secrets data is allowed encryption key data including at least one encryption key in compliance with the data security policy data for the data security jurisdiction zone of the requesting resource.

16. The system for automatically managing secure communications and transferring secrets across multiple communications jurisdiction zones of claim 15 wherein at least one encryption key represented by the allowed encryption key data is selected from the group of encryption keys consisting of:

a public encryption key;

a private encryption key;

a symmetric encryption key;

an asymmetric encryption key;

a public pre-placed encryption key;

a private pre-placed encryption key;

a 40-bit encryption key;

any length encryption keys;

an authentication encryption key;

a benign encryption key;

a content-encryption key (CEK);

a cryptovariable encryption key;

a derived encryption key;

an electronic encryption key;

an ephemeral encryption key;

a key encryption key (KEK);

a key production encryption key (KPK);

a FIREFLY encryption key;

a master encryption key;

a message encryption key (MEK);

a RED encryption key;

a session encryption key;

a traffic encryption key (TEK);

a transmission security encryption key (TSK);

a seed encryption key;

a signature encryption key;

a stream encryption key;

a Type 1 encryption key;

a Type 2 encryption key;

a Vernam encryption key;

a zeroized encryption key; and

any combination thereof.

17. The system for automatically managing secure communications and transferring secrets across multiple communications jurisdiction zones of claim 10 wherein the secrets request data represents a request for encryption key data to be transferred to the requesting resource.

18. The system for automatically managing secure communications and transferring secrets across multiple communications jurisdiction zones of claim 10 wherein at one of the first resource and the requesting resource are selected from the group of resources consisting of:

a virtual machine;

a virtual server;

a database or data store;

an instance in a cloud environment;

a cloud environment access system;

part of a mobile device;

part of a remote sensor;

part of a laptop computing system;

part of a desktop computing system;

part of a point-of-sale computing system;

part of an ATM; and

part of an electronic voting machine computing system.

19. The system for automatically managing secure communications and transferring secrets across multiple communications jurisdiction zones of claim 10 wherein the communications and data security policy data for the identified communications jurisdiction zones is obtained from a secure communications policy manager.

20. The system for automatically managing secure communications and transferring secrets across multiple communications jurisdiction zones of claim 19 wherein the communications and data security policy data for the identified communications jurisdiction zones is updated automatically.

21. A system for automatically managing secure communications and transferring secrets across multiple communications jurisdiction zones comprising:

at least one processor; and

at least one memory coupled to the at least one processor, the at least one memory having stored therein instructions which when executed by any set of the at least one processors, perform a process for automatically managing secure communications and transferring secrets across multiple communications jurisdiction zones, the process including;

identifying two or more communications jurisdiction zones from which, and/or to which, secrets and other data may be transferred using one or more types of communications channels including one or more types of secure communications security levels;

obtaining communications and data security policy data for the identified communications jurisdiction zones, the communications and data security policy data for the identified communications jurisdiction zones including data indicating allowed types of secure communications security levels for the respective communications jurisdiction zones, the communications and data security policy data for the plurality of data security jurisdiction zones further including data indicating allowed secrets data for each of the respective data security jurisdiction zones of the plurality of data security jurisdiction zones and nonallowed secrets data for the respective data security jurisdiction zones of the plurality of data security jurisdiction zones, the allowed secrets data for each given respective data security jurisdiction zone representing one or more secrets allowed to be used to protect data in the given data security jurisdiction zone;

obtaining secrets request data originating at a requesting resource, the obtained secrets request data indicating a desired exchange of secrets data to a requesting resource, at least a portion of the secrets data being in a first communications jurisdiction zone and the requesting resource being in a second communications jurisdiction zone different from the first communications jurisdiction zone;

automatically obtaining first communications jurisdiction zone communications and data security policy data associated with the first communications jurisdiction zone and second communications jurisdiction zone communications and data security policy data associated with second communications jurisdiction zone from the communications and data security policy data;

automatically analyzing the data security policy data of the data security jurisdiction zone of the requesting resource to determine allowed secrets encryption key data with respect to the data security jurisdiction zone of the requesting resource;

identifying one or more classes of allowed secrets data by classifying the allowed secrets data represented by the secrets data according to a level of security provided by the secrets;

obtaining the allowed secrets data within the one or more classes of allowed secrets data with respect to the data security jurisdiction zone of the requesting resource;

automatically analyzing the secrets request data indicating the desired exchange of secrets data to determine a required type of communications channel;

obtaining data owner data transfer policy data, the data owner data transfer policy data including data indicating owner required types of secure communications security levels for one or more types of data;

automatically obtaining data type data indicating the type of data involved in the desired exchange of secrets and/or other data;

automatically analyzing the data type data and the data owner data transfer policy data to determine data owner allowed types of secure communications security level data for the desired exchange of secrets and/or other data;

automatically analyzing the first communications jurisdiction zone communications and data security policy data, the second communications jurisdiction zone communications and data security policy data, and data owner allowed types of secure communications security level data, to determine at least one allowed type of secure communications security level for the desired exchange of secrets and/or other data that complies with each of the first communications jurisdiction zone communications and data security policy data, the second communications jurisdiction zone communications and data security policy data, and the data owner allowed types of secure communications security level data;

selecting one of the at least one allowed type of secure communications security level;

automatically establishing the required type of communications channel including the allowed type of secure communications security level between the first communications jurisdiction zone and the second communications jurisdiction zone; and

automatically providing the allowed secrets data to the requesting resource.

22. The system for automatically managing secure communications across multiple communications jurisdiction zones of claim 21 wherein at least one of the two or more communications jurisdiction zones are selected from the group of communications jurisdiction zones consisting of:

a geographic region communications jurisdiction zone;

a political region communications jurisdiction zone;

a security based communications jurisdiction zone;

a computing environment communications jurisdiction zone;

a computing sub-environment communications jurisdiction zone within a computing environment communications jurisdiction zone; and

any combination thereof.

23. The system for automatically managing secure communications across multiple communications jurisdiction zones of claim 21 wherein at least one of the one or more types of communications channels is selected from the group of types of communications channels consisting of:

an SSL communications channel;

a TLS communications channel;

an STMP communications channel;

an SMTP communications channel;

an STP communications channel;

an ICMP communications channel; and

any secure communication protocol channel.

24. The system for automatically managing secure communications across multiple communications jurisdiction zones of claim 21 wherein at least one of the one or more types of secure communications security levels is an encryption level for encrypting data transferred using the one or more types of communications channels and/or encrypting messages transferred using the one or more types of communications channels.

25. The system for automatically managing secure communications and transferring secrets across multiple communications jurisdiction zones of claim 21 wherein the allowed secrets data is allowed encryption key data including at least one encryption key in compliance with the data security policy data for the data security jurisdiction zone of the requesting resource.

26. The system for automatically managing secure communications and transferring secrets across multiple communications jurisdiction zones of claim 25 wherein at least one encryption key represented by the allowed encryption key data is selected from the group of encryption keys consisting of:

a public encryption key;

a private encryption key;

a symmetric encryption key;

an asymmetric encryption key;

a public pre-placed encryption key;

a private pre-placed encryption key;

a 40-bit encryption key;

any length encryption keys;

an authentication encryption key;

a benign encryption key;

a content-encryption key (CEK);

a cryptovariable encryption key;

a derived encryption key;

an electronic encryption key;

an ephemeral encryption key;

a key encryption key (KEK);

a key production encryption key (KPK);

a FIREFLY encryption key;

a master encryption key;

a message encryption key (MEK);

a RED encryption key;

a session encryption key;

a traffic encryption key (TEK);

a transmission security encryption key (TSK);

a seed encryption key;

a signature encryption key;

a stream encryption key;

a Type 1 encryption key;

a Type 2 encryption key;

a Vernam encryption key;

a zeroized encryption key; and

any combination thereof.

27. The system for automatically managing secure communications and transferring secrets across multiple communications jurisdiction zones of claim 21 wherein the secrets request data represents a request for encryption key data to be transferred to the requesting resource.

28. The system for automatically managing secure communications and transferring secrets across multiple communications jurisdiction zones of claim 21 wherein the allowed secrets data is allowed encryption key data including at least one encryption key in compliance with the data security policy data for the data security jurisdiction zone of the requesting resource.

29. The system for automatically managing secure communications and transferring secrets across multiple communications jurisdiction zones of claim 28 wherein the communications and data security policy data for the identified communications jurisdiction zones is updated automatically.