System for providing security in a network comprising communications devices

• US 7,904,565 B2
• Filed: 07/11/2007
• Issued: 03/08/2011
• Est. Priority Date: 07/30/1996
• Status: Expired due to Fees

• Current Assignee: Round Rock Research LLC
• Original Assignee: Round Rock Research LLC
• Inventors: Holden, James M, Levin, Stephen E, Nickel, James O, Wrench, Edwin H
• Primary Examiner(s): VU, VIET DUY
• Application Number:
  US11/776,421
• Publication Number:
  US 20080016332A1
• Time in Patent Office: 1,336 Days
• Field of Search: 709/217, 709/219, 709/227, 709/228, 709/229, 709/237, 709/250
• US Class Current: 709/227
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06F 2211/001 In-Line Device
• CPC Class Codes: G06F 2211/005 Network, LAN, Remote Access, Distributed System
• CPC Class Codes: G06F 2211/007 Encryption, En-/decode, En-/decipher, En-/decypher, Scramble, (De-)compress
• CPC Class Codes: G06F 2211/009 Trust
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/14 : for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 67/141 : Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/563 : Data redirection of data network streams
• CPC Class Codes: H04L 9/3247 : involving digital signatures
• CPC Class Codes: H04L 9/3268 : using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04L 9/3273 : for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869
• CPC Class Codes: H04L 9/40 : Network security protocols
• CPC Class Codes: H04W 12/069 : using certificates or pre-shared keys

Abstract

A system for providing communications security and authentication to a plurality of computerized devices is disclosed. In one embodiment, the system is useful with an untrusted network, and comprises security apparatus adapted to create associations with a plurality of security devices on the network. Traffic between the associated devices may be encrypted and residue-protected for e.g., data confidentiality and integrity protection. In one variant, the security apparatus of the system comprises a software entity disposed at least partly within the software stack of a host. A security card may also be used as part of the security apparatus system. The computerized devices of the system may be untrusted (e.g., have an untrusted operating system) and also be physically unsecure.

Claims

1. A system for providing secure communications between a plurality of devices, comprising:

a first, substantially portable device comprising a host computer running an untrusted operating system and untrusted hardware, a communications stack operative to run on said host computer, a first security apparatus adapted to establish a security association, and a communications interface adapted to establish a communications link with at least one other device;

a second computerized device comprising a second security apparatus;

a first computer program operative to run on said first portable device and adapted to verify the identify of a user of said first portable device before farther access is permitted;

a second computer program operative to run on said first portable device and adapted to receive data sent from a higher layer process in said host computer for transmission over said communications link;

a third computer program operative to run on said first portable device and adapted to determine whether said security association exists with said second security apparatus of said second computerized device;

a fourth computer program operative to run on said first portable device and adapted to encrypt at least a portion of said data sent from said higher layer process using at least one cryptographic key; and

a fifth computer program operative to run on said first portable device and adapted to transmit said at least portion of said data sent from said higher layer process to said second security apparatus when said security association does exist;

wherein said second computerized device comprises an interface to a second network, said second network having other security apparatus associated therewith, said other security apparatus of said second network being configured to establish security associations with said portable device via at least said second computerized device using at least a portion of a dynamically generated encryption data; and

wherein said first security apparatus is adapted to dynamically generate said encryption data for each association, said act of generating not requiring intervention by a user of said portable device.

2. The system of claim 1, wherein said first security apparatus comprises a removable and substantially user- or device-specific security card received at least party within a card reading apparatus of said portable device.

3. The system of claim 2, wherein at least portions of said card are physically secure and protected from unauthorized access.

4. The system of claim 2, wherein said card must exchange security information with said host computer before further processing of a user transaction or message is permitted.

5. The system of claim 4, wherein said exchanged security information comprises security information that is unique and specific to said card.

6. The system of claim 2, wherein said at least one cryptographic key is generated at least in part based on security information disposed on said security card.

7. The system of claim 1, wherein said second computerized device comprises a substantially fixed and at least partly physically secure network access control device.

8. The system of claim 1, wherein said second security apparatus of said second computerized device comprises an at least partly physically secure network gateway.

9. The system of claim 1, wherein said first computer program verifies the identity of said user of said portable devices via a unique name or identification associated with said user.

10. The system of claim 1, wherein said first computer program verifies the identity of said user of said portable device via a password associated with said user.

11. The system of claim 1, wherein said first computer program verifies the identity of said user of said portable device via a key associated with said host computer.

12. The system of claim 1, wherein said substantially portable device further comprises a network protocol used to resolve an IP address from a given hardware or network address.

13. The system of claim 1, wherein said substantially portable device further comprises a network protocol used to resolve a given hardware or network address from an IP address.

14. The system of claim 1, wherein said first security apparatus is further adapted to authenticate said second security apparatus of said second computerized device using a key-exchange algorithm.

15. The system of claim 1, wherein said first security apparatus is further adapted to authenticate said second security device from which said second security apparatus has first requested authentication.

16. The system of claim 1, wherein at least portions of said first security apparatus is disposed substantially within said software stack above the Physical Layer thereof.

17. The system of claim 1, wherein at least portions of said first security apparatus is disposed substantially within said software stack above the Link Layer thereof.

18. The system of claim 1, wherein at least portions of said first security apparatus is disposed substantially within said software stack below the Transport Layer thereof.

19. The system of claim 1, wherein said at least one cryptographic key comprises at least one key of a public/private key pair.

20. The system of claim 2, wherein said card further comprises a device driver.

21. The system of claim 20, wherein said driver comprises an application programming interface (API).

22. The system of claim 1, wherein said secure association comprises a non-permanent trusted communications channel between and unique to said first security apparatus and said second security apparatus.

23. The system of claim 22, wherein said second computerized device comprises a fixed, substantially stand-alone device.

24. The system of claim 1, wherein said communications link further comprises an auditor function in data communication therewith, said auditor function adapted to facilitate audit or tracking of unauthorized security events or attempted accesses.

25. The system of claim 1, wherein said second computerized device comprises at least one interface port, access to which is based at least in part on identification of a user of said substantially portable device.

26. The system of claim 1, wherein at least one encryption key is dynamically generated by said first security apparatus of said portable device pursuant to establishing an association with said second security apparatus, said at least one key being specific to a particular session between said first security apparatus and said second security apparatus.

27. The system of claim 1, wherein said first and second security apparatus of said devices are adapted to encrypt at least portions of said message using a block cipher.

28. The system of claim 1, wherein said first and second security apparatus of said devices generate at least one encryption key for use in encrypting at least portions of said message, said at least one encryption key comprises at least a portion of a public/private key pair.

29. The system of claim 1, wherein said first security apparatus generates at least one encryption key for use in encrypting at least portions of said message, said at least one encryption key comprising a symmetric encryption key.

30. The system of claim 1, wherein said first security apparatus generates at least one encryption key, and said at least one encryption key provides confidentiality and integrity of user datagrams during a particular session or association between said first security apparatus and said second security apparatus.

31. The system of claim 1, wherein, said first security apparatus is further adapted to generate a request message for transmission to at least said second security apparatus, said request message initiating an authentication procedure and comprising at least cryptographic information generated by said substantially portable device.

32. The system of claim 31, wherein, said cryptographic information comprises a cryptographic vector.

33. The system of claim 32, wherein, said cryptographic vector comprises a vector used by said second security apparatus as part of a mutual authentication procedure between said substantially portable device and said second computerized device.

34. The system of claim 31, wherein, said cryptographic information comprises a cryptographic key.

35. The system of claim 1, wherein said first security apparatus, as part of establishing said association, utilizes random data that is transmitted from said second computerized device.

36. The system of claim 1, wherein said second security apparatus comprises a cryptographic element exchange algorithm adapted to generate and transmit random data to said first security apparatus as part of a mutual authentication.

37. The system of claim 1, wherein at least a portion of said transmitted at least portion is evaluated by said second security apparatus using a first cryptographic residue generated at said second security apparatus using at least locally stored information, and a second residue of said transmitted message.

38. The system of claim 37, wherein said evaluation of said first and second residues comprises comparing said residues to see if they match.

39. The system of claim 38, wherein if said first and second residue does not match, a change in the operation of said second security apparatus is invoked.

40. The system of claim 39, wherein said change in the operation comprises performing a network audit function.

41. A system for providing secure communications between two or more devices on a communications network, comprising:

a first, substantially portable communications device comprising a host computerized device running an untrusted operating system and a network communications interface adapted to communicate with said network and said host computerized device;

a remote security device in communication with said network;

a security card adapted to be received at least partly within said first substantially portable communications device, said security card having portions comprising user-specific and cryptographic data stored therein, at least said portions being protected against access by unauthorized users;

a first computer program operative to run on said first substantially portable communications device adapted to dynamically obtain at least one identifier for said portable communications device when said network communications interface is placed in data communication with said network;

a second computer program operative to run on said first substantially portable communications device adapted to establish a security association between said portable communications device and said remote security device, said second computer program comprising a cryptographic data exchange algorithm adapted to cause said portable communications device and said remote security device to exchange cryptographic information while establishing said security association; and

a third computer program operative to run on said first substantially portable communications device adapted to seal or encrypt data sent from said portable device using at least said cryptographic information;

wherein said cryptographic information for said security association is generated without requiring intervention by a user of said first, substantially portable communications device.

42. The system of claim 41, wherein said security card further comprises a device driver having an application programming interface (API).

43. The system of claim 41, wherein, said second computer program is further adapted to generate a request message for transmission to at least said remote security device of said second computerized device, said request message initiating an authentication procedure and comprising at least cryptographic information generated by said substantially portable device.

44. The system of claim 43, wherein, said cryptographic information comprises a cryptographic vector.

45. The system of claim 44, wherein, said cryptographic vector comprises a vector used by said remote security device as part of a mutual authentication procedure between said substantially portable device and said remote security device.

46. The system of claim 43, wherein, said cryptographic information comprises a cryptographic key.

47. The system of claim 46, wherein, said cryptographic key comprises a key that is part of a public/private key pair.

48. The system of claim 43, wherein, said cryptographic information comprises a digital signature generated based at least in part on said cryptographic data stored in said security card.

49. The system of claim 41, wherein said identifier comprises an IP address.

50. The system of claim 49, wherein said first computer program is further adapted to:

(i) obtain an IP address for said a second computerized device based on a hardware address thereof;

or (ii) obtain a hardware address for a second computerized device based on an IP address thereof.

51. The system of claim 41, wherein at least a portion of said data sent is evaluated by said remote security device using a first cryptographic residue generated at said remote device using at least locally stored information, and a second residue of said sent data.

52. The system of claim 41, wherein said protection against access by unauthorized users comprises at least physical protection for said at least portions.

53. The system of claim 41, wherein said protection against access by unauthorized users comprises verification of prospective users via a unique name or identification associated with a valid user.

54. The system of claim 41, wherein said protection against access by unauthorized users comprises verification of prospective users via a password associated with a valid user.

55. The system of claim 41, wherein said protection against access by unauthorized users comprises verification of prospective users via a key associated with said host computerized device.

56. The system of claim 41, wherein said substantially portable device is physically non-secure.

57. The system of claim 41, wherein said remote security device of said second computerized device comprises a gateway, said gateway being in direct or indirect data communication with a second network.

58. The system of claim 57, wherein said second network comprises the Internet, and said second network is in data communication with a website.

59. The system of claim 41, wherein said portable device comprises an encryption algorithm that is initialized at least in part using a cryptographic vector.

60. The system of claim 59, wherein said substantially portable device is adapted to generate a new vector for each encryption event.

61. A security system, comprising:

a portable communications device, said portable communications device comprising a host computerized device adapted to run an untrusted operating system;

a security card adapted to be received at least partly within said host device, said security card having portions comprising user-specific and cryptographic data stored therein, at least said portions being protected against access by unauthorized users;

a card interface apparatus adapted to receive said security card at least partly within said host device;

a communications interface of said portable communications device adapted for data communication with an untrusted network;

software adapted to verify a user of said portable device using at least a portion of one of said user-specific and cryptographic data and an input supplied by a user via a user interface of said portable device;

software adapted to exchange at least a portion of said cryptographic data between said card and host device;

software adapted to establish a security association between said portable communications device and a security device on said network, said establishment comprising use of a cryptographic data exchange algorithm adapted to cause said portable communications device and said security device to exchange cryptographic data while establishing said association so as to enable at least ciphering or encrypting using one or more cryptographic keys; and

software adapted to cipher or encrypt data sent from said portable device using at least one of said cryptographic keys;

wherein said security device comprises an interface to a second network, said second network having other security apparatus associated therewith, said other security apparatus of said second network being configured to establish security associations with said portable communications device via at least said security device using a dynamically generated portion of said exchanged cryptographic data; and

wherein said portable communications device is adapted to dynamically generate said portion of said exchanged cryptographic data for each association, said act of generating not requiring intervention by a user of said portable communications device.

62. The system of claim 61, wherein said card comprises a device driver with application programming interface (API).

63. The system of claim 61, further comprising software adapted to generate a request message for transmission to a security device, said request message initiating an authentication procedure and comprising at least cryptographic information generated by said portable device.

64. The system of claim 63, wherein said cryptographic information comprises a cryptographic vector.

65. The system of claim 64, wherein said cryptographic vector comprises a vector used by said network security device as part of a mutual authentication procedure between said portable device and said security device.

66. The system of claim 63, wherein said cryptographic information comprises a cryptographic key.

67. The system of claim 66, wherein said cryptographic key comprises a key that is part of a public/private key pair.

68. The system of claim 63, wherein said cryptographic information comprises a digital signature generated based at least in part on cryptographic data stored in said card.

69. The system of claim 61, wherein said providing security card comprises portions comprising user-specific and cryptographic data stored therein, at least said portions being protected against access by unauthorized users.

70. The system of claim 69, wherein said protection against access by unauthorized users comprises at least physical protection for said at least portions.

71. The system of claim 69, wherein said protection against access by unauthorized users comprises verification of prospective users via a unique name or identification associated with a valid user.

72. The system of claim 69, wherein said protection against access by unauthorized users comprises verification of prospective users via a password associated with a valid user.

73. The system of claim 69, wherein said protection against access by unauthorized users comprises verification of prospective users via a key associated with said host user device.

74. A system for providing security to a plurality of portable communications devices, said system comprising:

a first portable communications device that provides a plurality of security functions, comprising;

a physically unsecure and untrusted host device having an untrusted operating system;

a communications stack operative to run on said host device;

a communications interface adapted to establish temporary two-way communications with an untrusted multi-user network, said interface being driven at least in part by said stack; and

a card reading apparatus; and

security apparatus for use with said communications stack of said first portable communications device, said security apparatus comprising;

(i) a removable and substantially user-specific security card to be received at least party within said card reading apparatus of said portable device; and

(ii) a security stack operable to interface with one or more layers of said communications stack;

wherein said security apparatus operates so as to;

verify the identity of said user of said portable device before further access to said network via said communications stack is permitted;

physically secure security data elements uniquely associated with said user thereof; and

exchange security information with said physically unsecure and untrusted host device before further processing of a user transaction or message is permitted;

wherein said security card is substantially platform agnostic such that it may be removed from and inserted into another portable physically unsecure and untrusted communications device while;

(i) providing similar user-specific security functionality to that of said portable device; and

(ii) substantially preventing compromise of said security data elements; and

a second remote security device comprising an interface to a second network, said second network having other security devices associated therewith, said other security devices of said second network being configured to establish security associations with said first portable communications device via at least said second remote security device using at least a portion of a dynamically generated encryption data; and

wherein said security apparatus of said first portable communications device dynamically generates said encryption data for each association, said act of generating not requiring intervention by a user of said first portable communications device.