Achieving high assurance connectivity on computing devices and defeating blended hacking attacks

• US 7,490,350 B1
• Filed: 03/14/2005
• Issued: 02/10/2009
• Est. Priority Date: 03/12/2004
• Status: Active Grant

• Current Assignee: SCA Technica, Inc.
• Original Assignee: SCA Technica, Inc.
• Inventors: Murotake, David K, Martin, Antonio
• Primary Examiner(s): Song, Hosuk
• Application Number:
  US11/079,673
• Time in Patent Office: 1,429 Days
• Field of Search: 726 1- 4, 726 11- 15, 709224-225, 713153-154
• US Class Current: 726/11
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04W 12/082 using revocation of authorisation
• CPC Class Codes: H04W 12/086 using security domains
• CPC Class Codes: H04W 12/088 using filters or firewalls

Abstract

System and techniques for protecting wireless communication systems from blended electronic attacks that may combine wireless and computer attacks. One embodiment is an integrated hardware and software firewall/protection system that provides a protection scheme that may include an additional functional processing layer between the hardware firewall and a mobile terminal. This additional functional processing layer performs an extra layer of communications and security processing, including such features as management of Internet Connection Firewall (ICF) functions, key generation for firewall and virtual private network (VPN) functions, and packet inspection and filtering.

Claims

1. A device providing a protection scheme for a communications system, the device comprising:

a communications section for processing incoming wireless communications;

a firewall coupled to said communications section;

a host interface, with said firewall coupled between said host interface and said communications system, and isolated by said firewall from the communications section, and

a wireless module central processor (WMCP) wherein the WMCP is configured for providing booting and management operations, adapted for passing inspected data to said host interface, and is further configured to provide software defined radio functionality for the device.

2. The device of claim 1 further comprising a packet inspection system coupled between the firewall and the host interface.

3. The device of claim 2 wherein the packet inspection system performs at least one of the features selected from the group consisting of:

uniform resource link (URL) blocking, domain name blocking, keylog blocking, malware inspecting, spyware inspecting and virus inspecting.

4. The device of claim 1, wherein said WMCP comprises said firewall.

5. The device of claim 4 wherein the device further comprises at least one section of memory coupled to the WMCP.

6. The device of claim 5, wherein a log file of detected attacks and other selected security incidents are logged and stored in said memory.

7. The device of claim 1 wherein the communications section comprises:

a transceiver for receiving said wireless communication from a wireless network; and

a modem for demodulating received wireless communication before passing it to the hardware firewall.

8. The device of claim 7 further comprising a protocol firewall between said transceiver and said modem.

9. The device of claim 7, wherein said modem comprises a wireless protocol stack, said protocol stack providing protocol firewalling and filtering capabilities.

10. The device of claim 1 wherein the communications system is selected from at least one of the group consisting of:

a personal computer (PC), a laptop, a personal digital assistant (PDA), cell phone, a mobile email device, and a server.

11. The device of claim 1 wherein the device is integrated into one of the group consisting of:

a wireless modem, a wired modem, a USB module, a plug-and-play PC card module, a PCI card module, a switched fabric module, cell phone, and a chip/chip set on a motherboard of the communications system.

12. The device of claim 1, wherein the firewall performs security functions, said security functions include at least one of the group consisting of:

public/private key exchange, automatic public/private key exchange, VPN, URL blocking, Domain Name Blocking, Red side encryption/decryption, network address translation (NAT), port address translation (PAT), stateful packet inspection firewall, Internet routing, management of demilitarized zone (DMZ) router functions, detection of port scanning, packet filtering and threat signature detection, system integrity process to verify system integrity, and concealment of unused ports.

13. The device of claim 1, further comprising an outbound firewall for blocking and/or filtering outbound network traffic.

14. The device of claim 13, where said outbound firewall operates in conjunction with the communications system to allow or deny control network access to one or more individual programs.

15. A device for providing a protection scheme for a host transmitting and/or receiving wireless communications, the device having a Red/Black isolation architecture and comprising:

a Black side communicatively coupled by at least one channel with said wireless communications;

a Red side coupled between said Black side and said host;

a reconfigurable wireless module central processor (WMCP) for enforcing isolation and/or separation between said Red side and said Black side, said WMCP comprising at least one firewall, an encryption capability for said host, and a packet inspection module adapted to receive decrypted packet data to examine a packet payload; and

a host interface coupled to said host wherein the WMCP is further configured for providing booting and management operations, adapted for passing inspected data to said host interface, and further configured to provide software defined radio functionality for the device.

16. The device of claim 15, wherein the device is integrated into at least one of a group consisting of:

wireless modem, a USB module, a plug-and-play PC card module, a PCI card module, a cell phone, a switched fabric module and an integrated chip/chip set on a host motherboard.

17. The device of claim 15, wherein the WMCP provides security functions, said security function includes at least one of the group consisting of:

public/private key exchange, automatic public/private key exchange, VPN, URL blocking, Domain Name Blocking, Red side encryption/decryption, network address translation (NAT), port address translation (PAT), stateful packet inspection firewall, Internet routing, management of demilitarized zone (DMZ) router functions, detection of port scanning, packet filtering and threat signature detection, system integrity process to verify system integrity, and concealment of unused ports.

18. The device of claim 15, wherein said Black side further comprises a protocol firewall.

19. The device of claim 15, wherein said WMCP comprises a wireless protocol stack, said protocol stack providing protocol firewalling and filtering capabilities.

20. The device of claim 15, further comprising an outbound firewall for blocking and filtering outbound network traffic.

21. The device of claim 20, where said outbound firewall operates in conjunction with the host to control network access to one or more individual programs.

22. The device of claim 15, wherein a log file of detected attacks and other selected security incidents are logged and stored in at least one memory unit coupled to the WMCP.