Portable computerized device with network security

• US 7,844,706 B2
• Filed: 07/11/2007
• Issued: 11/30/2010
• Est. Priority Date: 07/30/1996
• Status: Expired due to Fees

• Current Assignee: Round Rock Research LLC
• Original Assignee: Round Rock Research LLC
• Inventors: Holden, James M, Levin, Stephen E, Nickel, James O, Wrench, Edwin H
• Primary Examiner(s): VU, VIET DUY
• Application Number:
  US11/776,461
• Publication Number:
  US 20080016345A1
• Time in Patent Office: 1,238 Days
• Field of Search: 709/217, 709/219, 709/223, 709/225, 709/227, 709/228, 709/229, 709/237, 709/250
• US Class Current: 709/225
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06F 2211/001 In-Line Device
• CPC Class Codes: G06F 2211/005 Network, LAN, Remote Access, Distributed System
• CPC Class Codes: G06F 2211/007 Encryption, En-/decode, En-/decipher, En-/decypher, Scramble, (De-)compress
• CPC Class Codes: G06F 2211/009 Trust
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/14 : for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 67/141 : Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/563 : Data redirection of data network streams
• CPC Class Codes: H04L 9/3247 : involving digital signatures
• CPC Class Codes: H04L 9/3268 : using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04L 9/3273 : for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869
• CPC Class Codes: H04L 9/40 : Network security protocols
• CPC Class Codes: H04W 12/069 : using certificates or pre-shared keys

Abstract

A portable computerized device useful within a network and adapted to provide communication security. In one embodiment, the network comprises an untrusted network, and the portable device comprises network security apparatus adapted to create associations with other network security devices on the network. Traffic between the associated devices may be encrypted for e.g., data confidentiality and integrity protection. In one variant, the network security apparatus comprises a software entity disposed at least partly within the software stack of a host computer. A card-like hardware structure may also be used as part of the security apparatus. The host computer may be untrusted (e.g., have an untrusted operating system).

Claims

1. A portable computing device adapted to provide network security functions, comprising:

a host computer;

a software stack operative to run on said host computer; and

network security apparatus for use with said stack, said security apparatus adapted to communicate data with other network security apparatus over a data network by establishing an association, said establishing of said association between said network security apparatus and said other network security apparatus resulting in the execution of a key exchange algorithm adapted to cause said network security apparatus and said other network security apparatus to exchange cryptographic keys;

where said first network security apparatus is configured to;

receive a message sent from a higher layer process in said host computer for transmission over said network;

determine whether an association between said network security apparatus and said other network security apparatus in communication with said network exists;

convert at least a portion of said received message to a format utilized by said network; and

transmit said message received from said higher layer process to said other network security apparatus when said association does exist.

2. The device of claim 1, wherein said portable computing device further comprises a network protocol used to resolve an IP address from a given hardware or network address.

3. The device of claim 2, wherein said given hardware or network address comprises an Ethernet address.

4. The device of claim 2, wherein said given hardware or network address comprises a 48-bit address.

5. The device of claim 1, wherein said portable computing device further comprises a network protocol used to resolve a given hardware or network address from an IP address.

6. The device of claim 5, wherein said given hardware or network address comprises an Ethernet address.

7. The device of claim 5, wherein said given hardware or network address comprises a 48-bit address.

8. The device of claim 1, wherein said network apparatus is further adapted to authenticate at least one other computing device or associated network security apparatus requesting to form an association using said key-exchange algorithm.

9. The device of claim 1, wherein said network apparatus is further adapted to authenticate at least one other computing device or network security apparatus from which said network security apparatus has first requested authentication.

10. The device of claim 1, wherein said network security apparatus is disposed substantially within said software stack above the Physical Layer thereof.

11. The device of claim 10, wherein said network security apparatus is disposed substantially within said software stack below the Network Layer thereof.

12. The device of claim 10, wherein said network security apparatus is disposed substantially within said software stack below the Transport Layer thereof.

13. The device of claim 1, wherein said conversion of said at least portion of said received message to said format further comprises encrypting said at least portion using at least one key of a public/private key pair.

14. The device of claim 1, wherein said network security apparatus comprises a removable card-like structure plugged into a slot of said host computer.

15. The device of claim 1, wherein said network security apparatus comprises a PCMCIA card.

16. The device of claim 14, wherein said card-like structure further comprises a device driver.

17. The device of claim 16, wherein said driver comprises an application programming interface (API).

18. The device of claim 1, wherein said association comprises a non-permanent trusted communications channel between and unique to said first network security apparatus and said other network security apparatus.

19. The device of claim 18, wherein said at least one other network security apparatus comprises a fixed, substantially stand-alone device.

20. The device of claim 1, wherein said host computer comprises an untrusted operating system.

21. The device of claim 20, wherein said portable computing device is physically non-secure.

22. The device of claim 1, wherein said association comprises a mutual authentication process, wherein said network security apparatus is adapted to authenticate said other network security apparatus, and further adapted to authenticate itself to said other apparatus.

23. The device of claim 1, wherein said other network security apparatus comprises a gateway, said gateway being in data communication with a second network.

24. The device of claim 23, wherein said second network comprises the Internet, and said second network is in data communication with a website.

25. The device of claim 1, wherein said network further comprises an auditor function in data communication therewith.

26. The device of claim 1, wherein said other network security apparatus comprises at least one interface port, access to which is based at least in part on identification of a user of said portable computing device.

27. The device of claim 26, wherein said identification of a user is accomplished based at least in part on a cryptographic element associated with said portable computing device.

28. The device of claim 1, wherein said network security apparatus is adapted to dynamically generate at least one encryption key for each association, said act of generating not requiring either (i) intervention by a network administrator;

or (ii) intervention by a user of said portable computing device.

29. The device of claim 1, wherein at least one encryption key is dynamically generated by said network security apparatus pursuant to establishing an association with said other network security apparatus, said at least one key being specific to a particular session between said network security apparatus and said other network security apparatus.

30. The device of claim 1, wherein said network security apparatus is adapted to encrypt at least portions of said message using a block cipher.

31. The device of claim 1, wherein said network security apparatus generates at least one encryption key for use in encrypting at least portions of said message, said at least one encryption key comprises at least a portion of a public/private key pair.

32. The device of claim 1, wherein said network security apparatus generates at least one encryption key for use in encrypting at least portions of said message, said at least one encryption key comprises a symmetric encryption key.

33. The device of claim 1, wherein said network security apparatus generates at least one encryption key, and said at least one encryption key provides confidentiality, integrity and authentication of user datagrams during a particular session or association between said network security apparatus and said other network security apparatus.

34. The device of claim 1, wherein said network security apparatus comprises an encryption algorithm that is initialized at least in part using an initialization vector (IV).

35. The device of claim 34, wherein said encryption algorithm is configured so that encrypting data using the same encryption key, but different IVs, will produce different ciphered output.

36. The device of claim 34, wherein said network security apparatus is adapted to generate a new IV for each encryption event.

37. The device of claim 1, wherein said network security apparatus, as part of establishing said association, generates random data that is transmitted to said other network security apparatus.

38. The device of claim 1, wherein said key exchange algorithm is adapted to generate and transmit random data to said other network security apparatus.

39. The device of claim 38, wherein said transmission of said random data is associated with a procedure that permits both said network security apparatus and said other network security apparatus to possess encryption keys that permit the two apparatus to decrypt encrypted data sent by the other.

40. The device of claim 1, wherein at least a portion of said transmitted message is evaluated by said other network security apparatus using a first cryptographic residue generated at said other network security apparatus using at least locally stored information, and a second residue of said transmitted message.

41. The device of claim 40, wherein said evaluation of said first and second residues comprises comparing said residues to see if they match.

42. The device of claim 41, wherein if said first and second residue does not match, a change in the operation of said other network security apparatus is invoked.

43. The device of claim 42, wherein said change in the operation comprises performing a network audit function.

44. The device of claim 1, wherein no pre-positioned network configuration data is used in establishing said association between said network security apparatus and said other network security apparatus.

45. The device of claim 1, wherein said association is established at least in part based on an authentication of said network security apparatus by said other network security apparatus that does not require access to a physically secure storage device.

46. The device of claim 1, wherein said association is established at least in part based on an authentication of said other network security apparatus by said network security apparatus that does not require access to a physically secure storage device.

47. The device of claim 1, wherein said association between said network apparatus and said other network apparatus is established using only:

a first message from the network security apparatus to the other network apparatus; and

a second message from the other apparatus to the network security apparatus.

48. The device of claim 47, wherein said first message comprises a request message, and said second message comprises a grant message.

49. The device of claim 1, wherein said association between said network apparatus and said other network apparatus is established without resort to an entity external to said network security apparatus or said other network security apparatus.

50. A portable computing device comprising a network security system, said computing device being adapted for data communication with a network via a network communications interface, the device comprising:

a host computer; and

a network security module, at least a portion of said module operating within a software stack of said host computer and adapted for communication with other modules on said network, said security module comprising;

an interface for receiving a message sent from a higher layer process, wherein said message is intended for transmission over said network;

an association determination process configured to determine whether an association exists between the module and another network security module communicating with said network;

a session management process in communication with said interface and configured to transmit said message to said network if said association determination process determines that said association exists; and

an association manager in communication with said interface for establishing an association with one or more other network security modules if said association does not exist, said act of establishing an association resulting in the authentication of said one or more other network security modules as well as authenticating said portable computing device to said one or more other network security modules.

51. The computing device of claim 50, further comprising apparatus adapted to, when said association does not exist, buffer or queue said message for at least a period of time prior to releasing said message for transmission over said network.

52. The computing device of claim 50, wherein said network security module further comprises a removable card-like structure plugged into a slot of said host computer.

53. The computing device of claim 50, wherein said network security module further comprises a PCMCIA card.

54. The computing device of claim 52, wherein said card-like structure further comprises a device driver.

55. The computing device of claim 54, wherein said driver comprises an application programming interface (API).

56. The computing device of claim 50, wherein said session manager is adapted to encrypt said message using a block cipher encryption algorithm prior to transmitting said message to said network.

57. The computing device of claim 56, wherein said association manager is configured to authenticate a received message from said one or more other security modules during said act of establishing an association.

58. The computing device of claim 57, wherein said association comprises an ad hoc trusted communications path between said network security module and said one or more other modules.

59. The computing device of claim 50 further comprising an apparatus adapted to generate an encryption key that is substantially unique to said association.

60. The computing device of claim 59, wherein said apparatus adapted to generate comprises a card-like structure plugged into a slot of said host computer.

61. The computing device of claim 59, wherein said apparatus adapted to generate comprises a PCMCIA card.

62. The computing device of claim 50, wherein said network security module operates according to a trusted session-based protocol, said trusted session-based protocol adapted to establish one or more encryption keys during said act of establishing an association, said one or more keys being substantially unique to said association.

63. The computing device of claim 62, wherein said trusted session-based protocol provides at least one mechanism to verify that said message is unaltered during transmission over said network.

64. The computing device of claim 63, wherein said at least one mechanism to verify that said message is unaltered during transmission over said network comprises a cryptographic residue.

65. The computing device of claim 63, wherein said at least one mechanism comprises a cryptographic residue.

66. A portable computing device, comprising:

a host computer; and

a network communications interface adapted to communicate with a data network and said host computer, said communications interface comprising;

a first portion comprising a card-like structure adapted to fit at least partly within a receptacle of said host computer, and generate cryptographic elements;

a second portion operating within a software stack of said host computer and adapted for communication with other like interfaces on said network, said second portion in data communication with said first portion, said second portion comprising;

a software interface for receiving a message sent from a higher layer process of said stack, wherein said message is intended for transmission over said network;

an association determination process configured to determine whether an association exists between the network communications interface and another network communications interface communicating with said network;

a session management process in communication with said software interface and configured to transmit said message to said network if said association determination process determines that said association exists; and

an association manager in communication with said interface capable of establishing an association with one or more other network communications interfaces if said association does not exist;

wherein if said association does not exist, said second portion generates an association request message for transmission to at least one of said one or more other network interfaces, said request message comprising at least one of said cryptographic elements.

67. The computing device of claim 66, further comprising at least one mechanism to verify that said message is unaltered during transmission over said network, wherein said at least one mechanism comprises a cryptographic residue.

68. The computing device of claim 66, wherein said network communications interface further comprises a 48-bit hardware address.

69. The computing device of claim 66, wherein said network communications interface further comprises an internet protocol (IP) address.

70. A portable computerized device, comprising:

a host computer;

a network communications interface adapted to communicate with an untrusted data network and said host computer;

wherein the network communications interface comprises a card-like structure adapted to fit at least partly within a receptacle of said host computer;

a first computer program adapted to obtain at least one network address for said computerized device when said communications interface is placed in data communication with said network;

a second computer program adapted to establish a security association between said portable device and another device on said network, said second computer program comprising a key exchange algorithm adapted to cause said portable computerized device and said another device to exchange cryptographic keys over an unsecure network while establishing said association; and

a third computer program adapted to seal or encrypt data sent from said portable device using at least one of said cryptographic keys.

71. The device of claim 70, wherein said portable device is adapted to dynamically generate at least one encryption key for each security association, said act of generating not requiring either (i) intervention by a network administrator;

or (ii) intervention by a user of said portable computerized device.

72. The device of claim 70, wherein said card-like structure further comprises a device driver having an application programming interface (API).

73. The device of claim 70, wherein, said second program is further adapted to generate an association request message for transmission to at least said another device, said request message comprising at least one of said cryptographic keys.

74. The device of claim 70, wherein said network address comprises an IP address, and said first program is further adapted to:

(i) obtain an IP address for said another device based on a hardware address thereof;

or (ii) obtain a hardware address for said another device based on an IP address thereof.

75. The device of claim 70, wherein at least a portion of said data sent is evaluated by said another device using a first cryptographic residue generated at said another device using at least locally stored information, and a second residue of said transmitted message.

76. The device of claim 70, wherein said association comprises a temporary trusted communications channel between and unique to said portable and said another device.

77. The device of claim 70, wherein said portable computerized device is physically non-secure.

78. The device of claim 70, wherein said another device comprises a gateway, said gateway being in data communication with a second network.

79. The device of claim 78, wherein said second network comprises the Internet, and said second network is in data communication with a website.

80. The device of claim 70, wherein said portable device comprises an encryption algorithm that is initialized at least in part using an initialization vector (IV).

81. The device of claim 80, wherein said portable device is adapted to generate a new IV for each encryption event.