Distributed security architecture

• US 8,434,125 B2
• Filed: 03/05/2008
• Issued: 04/30/2013
• Est. Priority Date: 03/05/2008
• Status: Active Grant

• Current Assignee: The Boeing Co.
• Original Assignee: The Boeing Co.
• Inventors: Ramesh, Tirumale K., Meier, John L., Amanatullah, Jason Edward, Huang, Ming-Yuh
• Primary Examiner(s): Simitoski, Michael
• Assistant Examiner(s): Shayanfar, Ali
• Application Number:
  US12/043,034
• Publication Number:
  US 20090228951A1
• Time in Patent Office: 1,882 Days
• Field of Search: 726/1, 726/8, 709/224
• US Class Current: 726/1
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 69/32 Architecture of open systems interconnection [OSI] 7-layer type protocol stacks, e.g. the interfaces between the data link level and the physical level
• CPC Class Codes: H04L 69/321 Interlayer communication protocols or service data unit [SDU] definitions; Interfaces between layers

Abstract

A distributed security architecture may include: a mobile anti-tamper hardware policy enforcement point configured to control communication behaviors of a mobile client by enforcing communication policies within a policy decision point; a mobile anti-tamper hardware policy decision point encapsulated within the mobile anti-tamper hardware policy enforcement point; a policy exchange channel for policy distribution modes configured to distribute and/or update communication and routing security policies to the mobile client; a contextual manager configured to handle system-wide status change update signaling; and a mobility authentication manager configured to provide mobile clients with registration and credential/role assignments based on mobile access policies. The distributed security architecture may be configured to provide open system interconnection layer 3.5 policy-based secure routing, and open system interconnection layer 2 policy-based mandatory access control address filtering to provide secure communication and computing for layers 4, 5, 6, and 7.

Claims

1. A distributed security architecture implemented in a distributed computing network comprising mobile devices, the architecture comprising:

assets protected by entitlement-specifying policies;

a mobile anti-tamper hardware policy enforcement point that is configured to control communication behaviors of a mobile client by enforcing communication policies within a policy decision point;

a mobile anti-tamper hardware policy decision point that is encapsulated within the mobile anti-tamper hardware policy enforcement point;

a policy exchange channel for policy distribution nodes which is to at least one of distribute, update communication,or route security policies to the mobile client using a policy exchange protocol (PXP);

a contextual manager handling system-wide status change update signaling;

a mobility authentication manager providing mobile clients with registration and credential/role assignments based on mobile access policies;

open system interconnection layers 2, 3, 3.5, 4, 5, 6, and 7 in the distributed computing network;

wherein the open system interconnection layer 3.5 is above the open system interconnection layer 3 and provides distributed security policy enforcement and policy-based secure routing, and distributes and enforces the open system interconnection layer 3.5 security policy to mobile clients forming a policy-managed community of interest to at least two of the mobile clients and providing comprehensive information assurance in all of the open system interconnection layers; and

the open system interconnection layer 2 provides policy-based mandatory access control address filtering to provide a secured protocol session and computing at the open system interconnection layers 4, 5, 6, and 7.

2. The distributed security architecture of claim 1 wherein the policy exchange protocol is configured to control policy distribution and updates between a policy decision point and policy distribution nodes.

3. The distributed security architecture of claim 1 further comprising policy decision point hardware implementations in the distributed computing network which are read-proof to prevent authorization logic disclosure.

4. The distributed security architecture of claim 1 wherein the mobile clients are configured to update contextual flags in the distributed computing network to create changes in a policy decision point when permission is granted by a mobile client policy decision point policy.

5. The distributed security architecture of claim 1 wherein the policy distribution nodes are configured to distribute and update communication and routing security policies to the mobile clients via the policy exchange protocol.

6. The distributed security architecture of claim 1 wherein the policy exchange protocol is configured to allow distribution of security policies from the policy distribution nodes to a policy decision point.

7. The distributed security architecture of claim 1 further comprising a contextual manager in the distributed computing network configured to update contextual flags based on notices received from policy distribution nodes which are monitored by the mobile clients.

8. The distributed security architecture of claim 1 further comprising a mobility authentication manager in the distributed computing network configured to provide identity and role information of the mobile clients to policy distribution nodes for policy distribution, updates, and alerts of a contextual manager.

9. The distributed security architecture of claim 1 further comprising a contextual manager in the distributed computing network configured to handle system-wide status change update signaling.

10. The distributed security architecture of claim 9 wherein the system-wide status change update signaling comprises at least one of an alert level update, a policy update, or a client revocation.

11. A method for a distributed security architecture implemented in a distributed computing network comprising mobile devices, the method comprising:

protecting assets by entitlement-specifying policies;

encapsulating a mobile anti-tamper hardware policy decision point within the mobile anti-tamper hardware policy enforcement point;

distributing, by a policy exchange channel for policy distribution nodes, security policies to the mobile client using a policy exchange protocol (PXP);

handling, by a contextual manager, system-wide status change update signaling;

providing, by a mobility authentication manager, mobile clients with registration and credential/role assignments based on mobile access policies;

providing open system interconnection layers 2, 3, 3.5, 4, 5, 6, and 7 in the distributed computing network, the open system interconnection layer 3.5 is above the open system interconnection layer 3;

distributing security policy enforcement and policy-based secure routing;

distributing and enforcing the open system interconnection layer 3.5 security policy to mobile clients forming a policy-managed community of interest to at least two of the mobile clients and providing comprehensive information assurance in all of the open system interconnection layers; and

providing, by the open system interconnection layer 2, policy-based mandatory access control address filtering and providing a secured protocol session and computing at the open system interconnection layers 4, 5, 6, and 7.