# US 10,374,803 B2 · Methods for internet communication security

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,374,803 B2
- Document ID: US10374803B2
- Status: Granted
- Kind: B2
- Application number: 16/153,409
- Filed: 2018-10-05
- Published: 2019-04-11
- Granted: 2019-08-06
- Earliest claimed: 2017-10-06
- Assignees: Stealthpath, Inc.
- Applicants: Stealthpath, Inc.
- Inventors: Mike Clark; Andrew Gordon; Matt Clark
- Web page: https://patentgrep.com/patent/US10374803B2

## CPC

- G06F 9/45558: {Hypervisor-specific management and integration aspects}
- G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine
- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)}
- H04L 9/3228: {One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key}
- H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)}
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)}
- H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint}
- H04L 63/105: {Multiple levels of security}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)}
- H04L 67/565: Conversion or adaptation of application format or content (adding application control or application functional data H04L67/561)
- G06F 21/602: {Providing cryptographic facilities or services}
- G06F 2009/45587: {Isolation or security of virtual machine instances}
- G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices
- H04L 45/745: Address table lookup; Address filtering
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

The present disclosure relates to network security software cooperatively configured on plural nodes to authenticate and authorize devices, applications, users, and data protocol in network communications by exchanging nonpublic identification codes, application identifiers, and data type identifiers via pre-established communication pathways and comparing against pre-established values to provide authorized communication and prevent compromised nodes from spreading malware to other nodes.

## Claims

### Claim 1

A product for authorizing network communications in a hypervisor, the product comprising a non-transitory computer-readable storage medium having computer-readable program code embodied therein, the computer-readable program code executable in a hypervisor to perform communication management operations, the communication management operations comprising:
i) intercepting a first network packet in the hypervisor, the first network packet comprising a first higher-than-OSI layer three portion;
ii) decrypting, with a single-use cryptographic key, at least a portion of the first higher-than-OSI layer three portion to obtain one or more first packet parameters;
iii) authorizing the first network packet in the hypervisor, comprising: comparing the one or more first packet parameters with one or more first expected values; and
iv) passing the authorized first network packet to a virtual device.

### Claim 2 (depends on 1)

The product of claim 1, wherein the communication management operations further comprise:
i) detecting negotiation of a secure communication pathway between a first remote node and the virtual device, the negotiation comprising a series of network packet communications between the first remote node and the virtual device;
ii) aligning a series of cryptographic keys utilized in the hypervisor with a series of cryptographic keys utilized in the virtual device;
iii) monitoring the series of network packet communications; and
iv) confirming success of the negotiation prior to the passing the authorized first network packet.

### Claim 3 (depends on 2)

The product of claim 2, wherein the monitoring comprises:
a) detecting a nonpublic first identification code sent from the virtual device to a software port on the first remote node via a pre-established communication pathway; followed by
b) further detecting a nonpublic second identification code sent from the remote node; and
c) comparing the nonpublic second identification code with a pre-established value for the first remote node.

### Claim 4 (depends on 3)

The product of claim 3, wherein the communication management operations comprise: determining the pre-established value for the first remote node from a software port number assigned to the software port.

### Claim 5 (depends on 3)

The product of claim 3, wherein the monitoring comprises:
a) detecting a first application identification code for a first user-application sent from the virtual device to the first remote node via the pre-established communication pathway; followed by
b) detecting a second application identification code for a second user-application sent from the first remote node; and
c) comparing the second application identification code with a pre-established value for the second user-application.

### Claim 6 (depends on 5)

The product of claim 5, wherein the communication management operations comprise: determining the pre-established value for the first remote node from the software port number.

### Claim 7 (depends on 1)

The product of claim 1, wherein the communication management operations comprise: determining the one or more first expected values from a one-to-one correspondence with an n-tuple comprising the one or more first expected values, a destination port number of the first network packet, and a destination network address of the first network packet.

### Claim 8 (depends on 7)

The product of claim 7, wherein the one or more first packet parameters comprise a source application identification code, the source application identification code referencing a source application program for the first network packet.

### Claim 9 (depends on 8)

The product of claim 8, wherein the one or more first packet parameters comprise a data model identification code.

### Claim 10 (depends on 9)

The product of claim 9, wherein the communication management operations comprise: confirming at least a portion of a payload of the first network packet conforms to a data range, the data range determined from the data model identification code.

### Claim 11 (depends on 9)

The product of claim 9, wherein the communication management operations comprise: confirming at least a portion of the payload of the first network packet conforms to a command type restriction, the command type restriction determined from the data model identification code.

### Claim 12 (depends on 9)

The product of claim 9, wherein the communication management operations comprise: translating a first payload of the first network packet from a first pre-established format to a second pre-established format, the first pre-established format and the second pre-established format determined from the data model identification code and/or the destination port number.

### Claim 13 (depends on 7)

The product of claim 7, wherein the communication management operations comprise: obtaining the one-to-one correspondence from an encrypted file loaded into memory of the hypervisor.

### Claim 14 (depends on 7)

The product of claim 7, wherein the communication management operations comprise: obtaining the one-to-one correspondence from the virtual device via at least one encrypted communication pathway.

### Claim 15 (depends on 1)

The product of claim 1, wherein the communication management operations further comprise:
i) intercepting a second network packet in the hypervisor, the second network packet ingressed from the virtual device, the second network packet comprising a second higher-than-OSI layer three portion;
ii) decrypting, with a single-use cryptographic key, at least a portion of the second higher-than-OSI layer three portion to obtain at least one packet parameter;
iii) authorizing the second network packet in the hypervisor, comprising: comparing the one or more second packet parameters with one or more second expected values; and
iv) passing the authorized second network packet to a remote second node.

### Claim 16 (depends on 1)

The product of claim 1, wherein the virtual device is a virtual machine.

### Claim 17 (depends on 1)

The product of claim 1, wherein the virtual device is a container.

### Claim 18 (depends on 1)

The product of claim 1, wherein the communication management operations comprise: obtaining the at least one packet parameter from a payload of the first network packet.

### Claim 19 (depends on 1)

The product of claim 1, wherein the first remote node is a bare metal device.

### Claim 20 (depends on 1)

The product of claim 1, wherein the first remote node is a further virtual device.

### Claim 21 (depends on 1)

The product of claim 1, wherein the hypervisor provides at least one virtual interface to the virtual device.

### Claim 22 (depends on 1)

The product of claim 1, wherein the communication management operations are configured for a Type 1 hypervisor.

### Claim 23 (depends on 1)

The product of claim 1, wherein the communication management operations are configured for a Type 2 hypervisor.

### Claim 24 (depends on 1)

The product of claim 1, wherein the communication management operations are transparent to the virtual device and all computer programs running on the virtual device.