Secure network architecture method and apparatus

• US 7,225,463 B2
• Filed: 12/20/2000
• Issued: 05/29/2007
• Est. Priority Date: 10/24/1997
• Status: Expired due to Fees

• Current Assignee: III Holdings 1, LLC
• Original Assignee: Richard G Dusenbury Jr.
• Inventors: Dusenbury, Jr., Richard G.
• Primary Examiner(s): Smithers, Matthew
• Application Number:
  US09/739,879
• Publication Number:
  US 20010052080A1
• Time in Patent Office: 2,351 Days
• Field of Search: 713/201, 713/200, 713/182, 726/7
• US Class Current: 726/7
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: H04L 63/0421 Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity

Abstract

A secure network architecture method and apparatus that provides security at all levels of the network. The system and method of the present invention provides communications profiles for all network resources that uniquely identify the individual network resources and provide for absolute object identity. Communications over the network are managed at all levels by the network resources themselves by virtue of individual communications profiles that are policed by arbitrators and network resources alike.

Claims

1. A system for providing security in a network comprising a plurality of network resources each having a communication profile and a unique identifier, each network resource being connected to communicate with another network resource only if permitted by the communication profile of each network resource.

2. The system of claim 1, further comprising a central directory communicating with said network resources to establish said communication profile and unique identifier for each of said network resources.

3. The system of claim 2, wherein said central directory includes a database of cryptographic elements for distribution to network resources.

4. The system of claim 3, further including means for supplying cryptographic elements from a unique random number generator to said central directory.

5. The system of claim 4, wherein the unique random number generator includes means for checking a newly generated number against a database of previously generated numbers and if the new number has not been previously generated, stores the new number for later use.

6. The system of claim 2, wherein said network resources include at least one arbitrator with its own communication profile and unique identifier, said arbitrator receiving communications destined for network resources and transmitting the communications to the network resources.

7. The system of claim 6, wherein said arbitrator includes means for metering usage of the network resources.

8. The system of claim 6, wherein said arbitrator includes means for testing the communication profile of network resources to determine if a communication is authorized.

9. The system of claim 8, wherein the arbitrator further comprises storage means in which is stored the most frequently needed communication profiles of network resources to which the arbitrator can transmit communications and in which is further stored the most frequently needed communication profiles of network resources from which the arbitrator can receive communications.

10. The system of claim 6, wherein each said network resource includes means for testing a received communication by checking the type of communication against at least one communication profile.

11. The system of claim 6, wherein the arbitrator includes means for providing a cryptographic element to a transmitting network resource.

12. The system of claim 11, wherein the arbitrator includes means for receiving cryptographic elements from the central directory in response to a request from the arbitrator.

13. The system of claim 11, wherein the arbitrator includes means for receiving cryptographic elements from another arbitrator.

14. The system of claim 1, wherein the network resources include a plurality of workstations.

15. The system of claim 14, wherein each workstation includes means to check communications to be transmitted from the workstation and to permit the transmission to occur only if it is permitted by at least one workstation'"'"'s communication profile.

16. The system of claim 14, wherein each workstation includes means to check communication to be received and permits reception to occur only if reception of said communication is permitted by at least one workstation'"'"'s communication profile.

17. The system of claim 14, wherein each workstation includes means to request cryptographic elements from an arbitrator.

18. The system of claim 17, wherein the cryptographic element is a bit ring.

19. The system of claim 1, wherein at least one of said plurality of network resources is a container consisting of media resources.

20. The system of claim of claim 1, wherein each of said plurality of network resources is a container which includes digital information.

21. The system of claim of claim 20, wherein the information is encrypted.

22. The system of claim of claim 21, wherein the container includes an Unpredictable Error Detection and Correction Code, whereby any modification to the container information is detectable.

23. The system of claim of claim 20, wherein the container information includes audio/visual data.

24. The system of claim of claim 20, wherein the container information comprises access privileges to other network resources.

25. The system for providing security in a network in accordance with claim 1, wherein the network is selected from the group consisting of cellular networks, media distribution networks, computer networks and any combination thereof, and wherein said network resources are connectable to the selected network, the system further including:

a central directory connected to said network for establishing a communications profile for each network resource connected to the selected network to determine the method and type of communication permissible for each said network resource;

a unique random number generator connected to said central directory for producing a unique identifier for each said network resource;

each said network resource connected to said selected network being responsive to said central directory for receiving its corresponding unique identifier to establish absolute object identity for each network resource and for receiving its corresponding communications profile to establish allowable communications by and to each network resource, whereby said network resources are connected to the selected network so as to communicate with another network resource only if permitted to do so communication profiles of both network resources.

26. A method for establishing secure communication comprising:

establishing a communications profile and a unique identifier on a plurality of network resources on the network; and

transmitting communications from a network resource only if permitted by the network resource'"'"'s communication profile.

27. The method of claim 26, further including receiving communications by a network resource only if permitted by the network resource'"'"'s communication profile.

28. The method of claim 27, further including connecting said plurality of network resources to a network selected from the group comprising media distribution networks, computer networks and any combinations thereof.

29. The method of claim 26, further including establishing in at least one of said network resources, information about the communication profiles of other network resources to provide an arbitrator.

30. The method of claim 29, further comprising:

receiving at the arbitrator a communication transmitted by a transmitting network resource and destined for a destination network resource; and

re-transmitting the communication to the destination network resource.

31. The method of claim 30, further comprising:

checking the received communication against the communication profile of the arbitrator;

accepting the communication for re-transmission if the communication profile of the arbitrator allows it to be received; and

rejecting the communication for re-transmission if the communication profile of the arbitrator does not allow it to be received by the arbitrator.

32. The method of claim 29, further comprising:

checking the communication profile of a destination network resource;

rejecting re-transmission of the communication to a destination network resource if the communication is not allowed by the destination network resource communication profile; and

allowing re-transmission of the communication to the destination network resource if the communication is allowed by the destination network resource communication profile.

33. The method of claim 29, further comprising transferring cryptographic elements from the arbitrator to a network resources when said cryptographic elements are needed for communications.

34. The method of claim 33, further comprising transferring cryptographic elements from a central directory to said arbitrator.

35. The method of claim 29, further comprising storing in a central directory, unique random numbers from a unique random number generator for use in producing said communication profiles and unique identifiers for said network resources.

36. The method of claim 35, further including generating in said central directory the communication profile for said arbitrator.

37. The method of claim 29, further including:

receiving at said arbitrator a communication from a transmitting network resource;

encrypting the communication at said arbitrator and re-transmitting the encrypted communication to a network distribution resource, the network distribution resource broadcasting the encrypted communication; and

the arbitrator providing to a network resource a means to decrypt the encrypted communication broadcast from the network distribution resource.

38. The method of claim 26, wherein establishing a communication profile and unique identifier on each of a plurality of network resources includes establishing a plurality of workstations each with its own communication profile.

39. The method of claim 38, further comprising transmitting communications from a workstation only if permitted by said workstation'"'"'s communication profile.

40. The method of claim 38, further comprising receiving communications at a workstation only if permitted by said workstation'"'"'s communication profile.

41. The method of claim 40, further comprising permitting transmission of communications by a workstation only if the communication is permitted by said workstation'"'"'s communication profile.

42. The method of claim 26, further comprising encrypting information in said network resources.

43. The method of claim 42, further including preventing undetected modification of encrypted information in the network resources.

44. The method of claim 26, further including providing access privileges to said network resources.

45. The method of claim 26, further including preventing undetected modification of unencrypted information exchanged by network resources.

77. The method of claim 26, further including transmitting communications from a network resource only if permitted by the network resource'"'"'s communication profile.

46. Apparatus for guaranteeing absolute object identity comprising:

a generator generating unique random numbers;

a central directory connected to the generator to receive the unique random numbers from the generator;

the central directory including means to provide a loader applet which incorporates at least one of the unique random numbers;

at least one arbitrator connected to the central directory to receive the loader applet; and

at least one network resource communicating with said at least one arbitrator to receive said loader applet.

47. The apparatus of claim 46, wherein said at least one network resource includes a transmitting network resource and a receiving network resource.

48. The apparatus of claim 47, wherein each of the network resources has its own unique object identity.

49. The apparatus of claim 48, wherein said at least one arbitrator includes means to provide a cryptographic element to a transmitting network resource in advance of the transmitting network resource transmitting any sensitive communication.

50. The apparatus of claim 49, wherein said at least one arbitrator is connected to receive cryptographic elements from the central directory in response to a request from said arbitrator.

51. The apparatus of claim 49, wherein said at least one arbitrator is connected to receive cryptographic elements from another arbitrator for subsequent transmission to a transmitting network resource.

52. The apparatus of claim 49, wherein said cryptographic element is a bitring.

53. The apparatus of claim 48, wherein each network resource includes means to request cryptographic elements from an arbitrator when communications to be transmitted are to be encrypted.

54. The apparatus of claim 47, wherein said central directory further includes a database of cryptographic elements for distribution to network resources.

55. The apparatus of claim 46, wherein said at least one network resource comprises at least one container comprising information.

56. The apparatus of claim 55, wherein said information is encrypted.

57. The apparatus of claim 56, wherein said encrypted information can be decrypted only if unmodified.

58. A method for establishing absolute object identity comprising:

generating unique random numbers;

transmitting the unique random numbers to a central directory;

creating in said central directory communication profiles incorporating said unique random numbers;

providing said communication profiles to at least one arbitrator; and

transferring different communication profiles from said arbitrator to each of a plurality of network resources for establishing a unique identity for each network resource.

59. The method of claim 58, further comprising:

supplying cryptographic elements from the arbitrator to a network resource when communications from the network resource are to be encrypted.

60. The method of claim 59, further comprising:

supplying a cryptographic element to said arbitrator from a central directory in response to a request for a cryptographic element from a network resource.

61. The method of claim 58, further comprising:

supplying cryptographic elements from the central directory to the arbitrator in response to a request from the arbitrator.

62. The method of claim 58, further comprising:

supplying unique random numbers from a unique random number generator to said central directory; and

generating bit rings from the unique random numbers received by the central directory.

63. A method for creating absolute object identity for objects on a network comprising:

creating a plurality of unique numbers;

conveying the unique numbers to a central directory;

creating in the central directory plurality communication profiles, each based in part on a corresponding unique number, each communication profile comprising at least a receive profile, a transmit profile, and unique identifier; and

supplying an individual communication profile to each of a plurality of network resources on the network.

64. The method of claim 63, further comprising:

transmitting communications from a transmitting network resource only if permitted by the transmitting network resource'"'"'s communication profile; and

receiving communications by a receiving network resource only if permitted by the receiving resource'"'"'s communication profile.

65. The method of claim 64, wherein receiving communications by a receiving network resource includes:

transferring communications transmitted by a transmitting network resource to a network resource serving as an arbitrator; and

re-transmitting the communications from the arbitrator to a destination network resource.

66. The method of claim 65, further comprising:

checking communications received by the arbitrator against the communication profile of the arbitrator;

accepting the communication for re-transmission if its reception is permitted by the arbitrator communication profile; and

rejecting the communication for further re-transmission if its reception is not permitted by the arbitrator communication profile.

67. The method of claim 66, further comprising:

storing in the arbitrator the most frequently needed communication profiles of network resources with which communication is permitted.

68. The method of claim 67, further comprising:

checking the communication profile of the receiving network resource stored in the arbitrator;

rejecting re-transmission of the communication to the destination network resource if the communication is not permitted by the receiving network resource; and

allowing re-transmission of the communication to the destination network resource if the communication is permitted by the destination network resource communication profile.

69. A system for controlling communication between network resources, comprising:

a plurality of arbitrators;

a plurality of network resources in communication with each of said arbitrators, each arbitrator and each of said network resources incorporating a corresponding communication profile for controlling receipt and transmission of communications; and

a central directory connected to each of said arbitrators for supplying said corresponding communication profiles to said arbitrators and said network resources.

70. The system of claim 69, further including a generator supplying unique random numbers to said central directory for providing a guaranteed unique identifier with each of said communication profiles to ensure absolute object identity for each of said arbitrators and network resources.

71. The system of claim 70, wherein said central director includes a database of cryptographic elements for distribution to arbitrators and network resources for encryption of communications between network resources.

72. The system of claim 70, wherein each of said arbitrators is connected to a corresponding set of network resources, and wherein said arbitrators are interconnected to permit communication between network resources through corresponding arbitrators.

73. The system of claim 72, wherein each of said arbitrators includes the most frequently needed communication profiles of its corresponding network resources.

74. The system of claim 73, wherein each communication profile includes a transmit profile and a receive profile to regulate the transmission and reception, respectively, of communications by each of said arbitrators and each of said network resources.

75. The system of claim 74, wherein at least one of said network resources is connectable to a media distribution network through or corresponding arbitrator.

76. The system of claim 74, wherein at least one of said network resources is a computer connectable to a network through a corresponding arbitrator.