METHOD AND SYSTEM FOR ESTABLISHING A SECURITY PERIMETER IN COMPUTER NETWORKS

• US 20080016227A1
• Filed: 07/11/2007
• Published: 01/17/2008
• Est. Priority Date: 07/30/1996
• Status: Active Grant

• Current Assignee: Round Rock Research LLC
• Original Assignee: Micron Technology, Inc.
• Inventors: Holden, James, Levin, Stephen, Wrench, Edwin, Nickel, James
• Granted Patent: US 7,970,900 B2
• Time in Patent Office: Days
• US Class Current: 709/227
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06F 2211/001 In-Line Device
• CPC Class Codes: G06F 2211/005 Network, LAN, Remote Access, Distributed System
• CPC Class Codes: G06F 2211/007 Encryption, En-/decode, En-/decipher, En-/decypher, Scramble, (De-)compress
• CPC Class Codes: G06F 2211/009 Trust
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/14 : for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 67/141 : Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/563 : Data redirection of data network streams
• CPC Class Codes: H04L 9/3247 : involving digital signatures
• CPC Class Codes: H04L 9/3268 : using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04L 9/3273 : for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869
• CPC Class Codes: H04L 9/40 : Network security protocols
• CPC Class Codes: H04W 12/069 : using certificates or pre-shared keys

Abstract

A multi-level network security system is disclosed for a computer host device coupled to at least one computer network. The system including a secure network interface Unit (SNIU) contained within a communications stack of the computer device that operates at a user layer communications protocol. The SNIU communicates with other like SNIU devices on the network by establishing an association, thereby creating a global security perimeter for end-to-end communications and wherein the network may be individually secure or non-secure without compromising security of communications within the global security perimeter. The SNIU includes a host/network interface for receiving messages sent between the computer device and network. The interface operative to convert the received messages to and from a format utilized by the network. A message parser for determining whether the association already exists with another SNIU device. A session manager coupled to said network interface for identifying and verifying the computer device requesting access to said network. The session manager also for transmitting messages received from the computer device when the message parser determines the association already exists. An association manager coupled to the host/network interface for establishing an association with other like SNIU devices when the message parser determines the association does not exist.

Claims

1. A method of providing security between two computer networks, at least one of said networks having a server, said two networks having a network interface unit coupled therebetween, the method comprising;

using said network interface unit for identifying a user requesting access to or from one of said networks, verifying if the identified user is authorized for access to or from at least one of the two networks;

establishing a session with another entity on one of said two networks if said identified user is verified for access; and

providing a security manager in communication with said network interface unit, said security manager adapted to perform the functions of controlling the operation and configuration of said network interface unit in order to protect the security of data present in one of said two networks that is transmitted via said secure network interface unit to the other of said two networks.

2. The method of claim 1, wherein said network interface unit establishes said session at a session layer of interconnection.

3. The method of claim 2, wherein said session layer of interconnection comprises the Session Layer of the Open Systems Interconnection (OSI) model.

4. The method of claim 1, wherein said network interface unit comprises a manager module that establishes said session.

5. The method of claim 1, wherein said act of establishing a session comprises establishing an association in order to authenticate said another entity.

6. The method of claim 5, wherein said act of establishing an association comprises utilizing an Internet Protocol (IP) address associated with said another entity.

7. The method of claim 1, wherein said another entity comprises a web site, and said act of establishing a session comprises utilizing an Internet Protocol (IP) address associated with said web site.

8. The method of claim 1, wherein said network interface unit uses the facilities of at least some existing lower level protocols to transmit data across at least one of said networks.

9. The method of claim 8, wherein said act of coupling a network interface unit between the networks comprises placing a software function in the communications stack of a non-secure host device.

10. The method of claim 9, wherein said act of placing comprises placing said software function at a layer below the network layer of said stack.

11. An apparatus for providing security over a non-secure network, the apparatus comprising:

a secure network interface for providing secure communications of data on said non-secure network, said secure network interface configured to perform a trusted layer protocol, said trusted layer protocol setting up secure sessions, performing sealing algorithms on said data, and using the facilities of existing lower level protocols to transmit data across said non-secure network; and

a security manager adapted to cause said secure network interface to be initialized, operated and configured for protecting the security of said data transmitted through said secure network interface, said security manager capable of participating in the implementation of at least one of a plurality of security policies.

12. The apparatus of claim 11, wherein said secure network interface comprises a software entity disposed within the communication stack of a non-secure host device.

13. The apparatus of claim 12, software entity is disposed within the communication stack below the transport layer.

14. The apparatus of claim 11, wherein said software entity is disposed within the communication stack above the link layer.

15. The apparatus of claim 11, wherein said security manager is at least partly disposed within the communication stack of a non-secure host device.

16. The apparatus of claim 17, wherein said security manager is configured to initialize said secure network interface by at least providing a cryptographic key thereto.

17. The apparatus of claim 11, wherein said security manager is at least partly disposed within a device associated with said non-secure network adapted for data communication with said secure network interface.

18. The apparatus of claim 11, wherein said apparatus is adapted for coupling to a second network, said second network being secure or non-secure.

19. The apparatus of claim 11, further comprising an application programming interface (API), said API being adapted to interface with a card, said card providing at least on security related function.

20. The apparatus of claim 19, wherein said at least one security related function comprises authentication.

21. The apparatus of claim 20, wherein said authentication is accomplished at least in part based on a cryptographic key or digital signature.

22. The apparatus of claim 21, wherein said security manager is at least partly disposed within a device associated with said non-secure network adapted for data communication with said secure network interface, said data communication comprising at least one of said cryptographic key or digital signature.

23. The apparatus of claim 21, wherein said secure network interface comprises a software entity disposed within the communication stack of a non-secure host device, and said security manager is at least partly disposed within said non-secure host device and is adapted to provide at least one of said cryptographic key or digital signature.

24. An apparatus for providing security over a non-secure network, the apparatus comprising:

a secure network interface for providing secure communications of data on said non-secure network, said secure network interface comprising;

a computer host having a memory; and

a network communications program configured to perform a trusted layer protocol, said trusted layer protocol providing user access control, setting up secure sessions, performing sealing algorithms on said data, and using the facilities of existing lower level protocols to transmit data across said non-secure network; and

a security manager program adapted to cause said secure network interface to be initialized, operated and configured for protecting the security of said data transmitted through said secure network interface, said security manager capable of participating in the implementation of at least one of a plurality of security policies.

25. The apparatus of claim 24, wherein said security manager program is a software program co-resident with said network communications program on said host.

26. The apparatus of claim 25, wherein said host is non-secure.

27. The apparatus of claim 26, wherein said security manager program and said network communications program are executed by said computer host.

28. The apparatus of claim 24, wherein said non-secure computer network comprises a first network and a second network and a guard network interface unit between said first and second networks.

29. The apparatus of claim 28, wherein at least one of said first and second networks comprises the Internet.

30. The apparatus of claim 24, wherein said non-secure computer network comprises the Internet, and said apparatus is adapted to communicate with a web site using at least said Internet.

31. The apparatus of claim 30, wherein said security manager is adapted to utilize a private/public key system for end-to-end security across said Internet.

32. The apparatus of claim 24, wherein said security manager provides internetwork digital signature support.

33. The apparatus of claim 24, wherein said computer host comprises a non-secure host, and said secure network interface is substantially transparent to application programs running on said host.

34. The apparatus of claim 24, wherein said host is non-secure, said security manager program is a software program co-resident with said network communications program on said non-secure host, and said security manager is adapted to utilize a private/public key system for end-to-end security across said non-secure network.

35. The apparatus of claim 34, wherein at least one of said security policies comprises session reuse protection.

36. The apparatus of claim 24, wherein at least one of said security policies comprises session reuse protection.

37. The apparatus of claim 24, wherein at least one of said security policies comprises session security labeling.

38. The apparatus of claim 24, wherein said secure network interface establishes said secure session in order to transmit at least one of video and voice data.

39. The apparatus of claim 24, wherein at least one of said security policies comprises association reuse protection.

40. An apparatus adapted to communicate messages over a network, the apparatus comprising:

a computerized host device having a memory and a communications stack;

a computer program running on said computerized host device and adapted to;

identify a user requesting access to said network,

support the authentication of said apparatus to another entity of said network with which said apparatus communicates;

establish a security association between said apparatus and said another entity if said authentication is successfully completed; and

establish a user session via said network and said another entity based at least in part on said established security association.

41. The apparatus of claim 40, wherein said computerized host device comprises a non-secure portable device.

42. The apparatus of claim 40, wherein said network comprises a plurality of networks, at least one of said plurality being non-secure.

43. The apparatus of claim 40, wherein said computer program is adapted to establish said user session at a session layer of interconnection using said communications stack.

44. The apparatus of claim 43, wherein said computer program is disposed within said communications stack below the transport layer.

45. The apparatus of claim 40, further comprising a security manager in communication with computer program, said security manager adapted to configure at least portions of said computer program in order to protect the security of messages sent from said computerized host device to said another entity.

46. The apparatus of claim 45, wherein said configuration of at least portions of said computer program comprises receiving at least one cryptographic key from said another entity.

47. The apparatus of claim 40, wherein said computer program further comprises a security manager function adapted to authenticate cryptographic data received from said another entity prior to establishing said security association.

48. The apparatus of claim 40, wherein said apparatus is further adapted to allow said user to transmit selected ones of data files over said network during said user session.

49. The apparatus of claim 40, wherein said apparatus is further adapted to protect the integrity of messages sent from said host device over at least a portion of said network using at least one cryptographic key.

50. The apparatus of claim 49, further comprising a security manager in communication with computer program, said security manager adapted to provide said message integrity protection using said at least one cryptographic key.

51. The apparatus of claim 50, wherein at least portions of said host device are non-secure, and said security manager comprises a removable card adapted to be received at least partly within said apparatus and to communicate with said computer program.

52. The apparatus of claim 51, wherein said card is adapted to store said at least one cryptographic key.

53. The apparatus of claim 52, wherein said apparatus is adapted to verify cryptographic data received from said another entity using data stored on said card.

54. The apparatus of claim 40, wherein said apparatus is adapted to provide session reuse protection.

55. The apparatus of claim 40, wherein said apparatus is adapted to provide session security labeling.

56. The apparatus of claim 40, wherein said apparatus is adapted to transmit both video and voice data as part of said user session.

57. The apparatus of claim 40, wherein said apparatus is adapted to provide association reuse protection.

58. The apparatus of claim 40, wherein said session is established with a third entity on said network via said another entity.

59. The apparatus of claim 58, wherein said apparatus comprises a non-secure portable device, and said third entity comprises a secure portable device.

60. A portable computerized apparatus adapted to communicate messages over a network to a second computerized apparatus, the apparatus comprising:

a computerized host having a memory and a communications stack;

a computer program running on said computerized host and adapted to;

identify a user requesting to transmit or receive messages over said network,

support the authentication of said portable apparatus to an entity of said network with which said portable apparatus may communicate;

establish a security association between said portable apparatus and said entity if said authentication is successfully completed; and

establish a user session between said portable apparatus and said second computerized apparatus via said network and said entity after said security association has been established;

wherein the data integrity of said messages is protected at least between said portable apparatus and said entity based on at least one cryptographic key.

61. The apparatus of claim 60, wherein said network comprises a plurality of networks in communication with one another, and said entity comprises a network interface adapted to pass said messages from a first of said plurality of networks to a second of said plurality of networks.

62. The apparatus of claim 61, wherein end-to-end data security between said portable apparatus and said second computerized device is established using a cryptographic key and algorithm.

63. The apparatus of claim 60, wherein said portable apparatus comprises a non-secure portable device adapted to receive a card, said card comprising cryptographic data stored therein, said cryptographic data being used to support said authentication.