APPARATUS FOR PROVIDING SECURITY OVER UNTRUSTED NETWORKS

• US 20110202758A1
• Filed: 12/10/2010
• Published: 08/18/2011
• Est. Priority Date: 07/30/1996
• Status: Active Grant

• Current Assignee: Edwin H. Wrench, James M. Holden, James O. Nickel, Stephen E. Levin
• Original Assignee: Edwin H. Wrench, James M. Holden, James O. Nickel, Stephen E. Levin
• Inventors: Holden, James M, Nickel, James O., Levin, Stephen E., Wrench, Edwin H.
• Granted Patent: US 8,346,925 B2
• Time in Patent Office: Days
• US Class Current: 713/155
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06F 2211/001 In-Line Device
• CPC Class Codes: G06F 2211/005 Network, LAN, Remote Access, Distributed System
• CPC Class Codes: G06F 2211/007 Encryption, En-/decode, En-/decipher, En-/decypher, Scramble, (De-)compress
• CPC Class Codes: G06F 2211/009 Trust
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/14 : for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 67/141 : Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/563 : Data redirection of data network streams
• CPC Class Codes: H04L 9/3247 : involving digital signatures
• CPC Class Codes: H04L 9/3268 : using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04L 9/3273 : for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869
• CPC Class Codes: H04L 9/40 : Network security protocols
• CPC Class Codes: H04W 12/069 : using certificates or pre-shared keys

Abstract

A network security apparatus adapted to provide for secure communications across data networks, including untrusted networks. In one embodiment, the security apparatus comprises one or more components disposed within the software stack of a computerized device, the components including an association process adapted to establish security associations between devices on the network, and an encryption key generation process adapted to generate one or more encryption keys. In one variant, the keys are specifically for use with temporary or ad hoc security associations. The one or more keys are exchanged according to a key exchange protocol after the device is authenticated or authenticates another device. In one implementation, the device comprises a portable device such as a laptop computer.

Claims

1-52. -52. (canceled)

53. Network security apparatus configured to communicate with a computerized host device and other network security apparatus on a network having components that may be individually secure or non-secure, the apparatus comprising:

a cryptographic material generation process, said generation process being adapted to generate cryptographic material comprising at least one encryption key;

a message process adapted to exchange first security association information between the security apparatus and at least one of said other security apparatus on the network via one or more messages; and

an association process configured to establish a security association between said network apparatus and said at least one other network security apparatus based at least in part on said first security association information;

wherein said apparatus further comprises a key exchange protocol, said key exchange protocol being adapted to exchange said at least one encryption key between said network security apparatus and at least one other security apparatus using at least one message generated by said message process.

54. The apparatus of claim 53, wherein said security association information comprises a digital certificate.

55. The apparatus of claim 54, wherein said one or more messages comprise at least one of :

(i) a request message requesting establishment of a security association; and

(ii) a reply message granting said security association.

56. The apparatus of claim 54, wherein said digital certificate comprises a public encryption key.

57. The apparatus of claim 56, further comprising an encryption process adapted to encrypt said at least one encryption key using at least said public key and a private key in the possession of said network security apparatus.

58. The apparatus of claim 56, further comprising an encryption process adapted to encrypt said at least one encryption key using at least a private key.

59. The apparatus of claim 55, wherein said cryptographic material further comprises at least one initialization vector.

60. The apparatus of claim 59, wherein said initialization vector is used by said at least one other network security apparatus to initialize an encryption algorithm.

61. The apparatus of claim 53, further comprising an encryption process adapted to encrypt data received from said host device using said at least one encryption key.

62. The apparatus of claim 53, wherein said material generation process is adapted to generate said at least one encryption key and a second encryption key different from said at least one key.

63. The apparatus of claim 54, wherein said digital certificate is used by said association process to verify the identity of a sender of said certificate, and said at least one encryption key is generated only after said verification of said identity.

64. The apparatus of claim 53, wherein said computerized host device comprises a portable untrusted device having a software stack, said stack comprising said message process, said material generation process, and said association process as part thereof.

65. The apparatus of claim 64, wherein said network comprises an untrusted network, and said apparatus further comprises a network interface adapted to send and receive data between said host device and said network.

66. The apparatus of claim 53, wherein said material generation process is further adapted to generate at least one random number for use in association with said at least one encryption key.

67. The apparatus of claim 66, wherein said at least one random number is transmitted along with said at least one encryption key as part of said key exchange protocol.

68. The apparatus of claim 53, wherein said apparatus utilizes a cryptographic residue for determining datagram integrity.

69. A portable computerized device adapted for secure communications over an untrusted network, the device comprising:

network security apparatus configured to communicate with other network security apparatus on said network, the apparatus comprising;

a cryptographic material generator, said generator being adapted to generate cryptographic material comprising at least one encryption key;

a message process adapted to exchange first security association information between the security apparatus and at least one of said other security apparatus on the network via one or more messages;

an association process configured to establish a temporary security association between said network apparatus and said at least one other network security apparatus based at least in part on said first security association information; and

a key exchange protocol, said key exchange protocol being adapted to exchange said at least one encryption key between said network security apparatus and at least one other security apparatus using at least a request and reply message exchange;

wherein said network security apparatus is disposed within a software stack of said portable device.

70. The device of claim 69, wherein said security association information comprises a digital certificate, said digital certificate comprising a public portion of a public-private key pair.

71. The device of claim 69, further comprising an encryption process adapted to encrypt said at least one encryption key using at least a private key.

72. The device of claim 71, wherein said cryptographic material further comprises at least one initialization vector, said initialization vector is used by said at least one other network security apparatus to initialize an encryption algorithm.

73. The device of claim 69, wherein said material generation process is adapted to generate said at least one encryption key and another key different from said at least one encryption key.

74. The device of claim 69, wherein said digital certificate is used by said association process to verify the identity of a sender of said certificate.

75. The device of claim 69, wherein said material generator is further adapted to generate at least one random number, said at least one random number being transmitted as part of said key exchange protocol.

76. The device of claim 69, wherein said material generator is further adapted to generate at least one random number for use in association with said at least one encryption key, said at least one random number being transmitted along with said at least one encryption key as part of said key exchange protocol

77. The device of claim 69, wherein said apparatus utilizes a cryptographic residue for determining message integrity.

78. Network security apparatus configured to communicate with a computerized host device and other network security apparatus on a network having components that may be individually secure or non-secure, the apparatus comprising:

a message process adapted to exchange first security association information including a digital certificate between the security apparatus and at least one of said other security apparatus on the network via one or more messages, said digital certificate comprising a first encryption key;

a cryptographic material management process, said management process being adapted to package cryptographic material comprising at least one second encryption key for distribution to said at least one other security apparatus; and

an association process configured to establish a security association between said network apparatus and said at least one other network security apparatus based at least in part on said first security association information;

wherein said apparatus further comprises a key exchange protocol, said key exchange protocol being adapted to exchange said at least one second encryption key between said network security apparatus and said at least one other security apparatus using at least one message generated by said message process.

79. A portable computerized device adapted for secure communications over an untrusted network, the device comprising:

network security apparatus configured to communicate with other network security apparatus on said network, the apparatus comprising;

a message process adapted to exchange first security association information between the security apparatus and at least one of said other security apparatus on the network via one or more messages;

a cryptographic material management process, said management process being adapted to package cryptographic material comprising at least one encryption key for distribution to said at least one other network security apparatus;

an association process configured to establish an ad hoc security association between said network apparatus and said at least one other network security apparatus based at least in part on said first security association information;

a key exchange protocol, said key exchange protocol being adapted to exchange said at least one encryption key between said network security apparatus and said at least one other security apparatus using at least a request and reply message exchange; and

a block ciphering algorithm adapted to cipher data to be transmitted between said network security apparatus and said at least one other security apparatus;

wherein said network security apparatus is disposed within a software stack of said portable device.