# US 10,375,019 B2 · Methods for internet communication security

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,375,019 B2
- Document ID: US10375019B2
- Status: Granted
- Kind: B2
- Application number: 16/153,448
- Filed: 2018-10-05
- Published: 2019-04-11
- Granted: 2019-08-06
- Earliest claimed: 2017-10-06
- Assignees: Stealthpath, Inc.
- Applicants: Stealthpath, Inc.
- Inventors: Mike Clark; Andrew Gordon; Matt Clark
- Web page: https://patentgrep.com/patent/US10375019B2

## CPC

- H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)}
- H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords}
- H04L 9/16: the keys or algorithms being changed during operation
- H04L 9/3273: {for mutual authentication (network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869)}
- H04L 47/19: at layers above the network layer (network arrangements for networked applications for scheduling or organising the servicing of application requests H04L67/60)
- H04L 47/24: Traffic characterised by specific attributes, e.g. priority or QoS
- H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL}
- H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 69/22: Parsing or analysis of headers
- H04L 63/0272: {Virtual private networks}
- H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms}
- H04L 63/164: {at the network layer}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

The present disclosure relates to network security software cooperatively configured on plural nodes to authenticate and authorize devices, applications, users, and data protocol in network communications by exchanging nonpublic identification codes, application identifiers, and data type identifiers via pre-established communication pathways and comparing against pre-established values to provide authorized communication and prevent compromised nodes from spreading malware to other nodes.

## Claims

### Claim 1

A product for securing communications of a plurality of networked computing devices, the product comprising a non-transitory computer-readable storage medium having computer-readable program code embodied therein, the computer-readable program code executable by a first computing device to perform communication management operations, the communication management operations comprising:
i) consuming a first network packet to obtain an application layer first payload and a first port number, the first port number assigned to a transport layer first port for an end-user application program on a second computing device;
ii) decrypting an encrypted read-only first file and identifying a data record in the first file that contains the first port number in a first port number field of the identified data record in the first file, the first file stored locally on the first computing device;
iii) confirming the application layer first payload conforms to one or more formatting requirements named in the identified data record in the first file;
iv) negotiating an encrypted TCP connection with a network security software running on the second computing device, the encrypted TCP connection dedicated exclusively to routing communications that are a) directed to and/or originating from the transport layer first port, and b) formatted according to the named formatting requirements;
v) forming a second network packet, comprising: inserting into an application layer portion of the second network packet: a) at least a portion of the application layer first payload, b) a nonpublic identifier that is unique to the program code executable by the first computing device, c) a nonpublic user-identifier for a process owner running the program code executable by the first computing device, and d) an identifier for the one or more formatting requirements; and
vi) sending the second network packet to the network security software via the encrypted TCP connection.

### Claim 2 (depends on 1)

The product of claim 1, wherein the first network packet is received from a first NIC, wherein the encrypted TCP connection is configured to not traverse the first NIC.

### Claim 3 (depends on 1)

The product of claim 1, wherein the at least a portion of the application layer first payload is all of the application layer first payload.

### Claim 4 (depends on 1)

The product of claim 1, wherein the one or more formatting requirements comprises a data type.

### Claim 5 (depends on 1)

The product of claim 1, wherein the one or more formatting requirements comprises a data range.

### Claim 6 (depends on 1)

The product of claim 1, wherein the first file is a binary file with variable data record lengths.

### Claim 7 (depends on 1)

The product of claim 1, wherein the nonpublic identifier that is unique to the program code executable by the first computing device, the nonpublic user-identifier for the process owner running the program code executable by the first computing device, or the identifier for the one or more formatting requirements are encrypted separately from the at least a portion of the application layer first payload inserted into the second network packet.

### Claim 8 (depends on 1)

The product of claim 1, further comprising:
i) obtaining a source port number for the first network packet; and
ii) comparing the source port number to a list of port numbers authorized to provide data for communication to the end-user application and the user for the end-user application on the second computing device.

### Claim 9 (depends on 1)

The product of claim 1, wherein the communication management operations further comprise: translating, prior to forming the second network packet, the at least a portion of the application layer first payload to a pre-established format expected by the network security software on the second computing device.

### Claim 10 (depends on 9)

The product of claim 9, wherein the communication management operations comprise determining the pre-established format based at least on the named formatting requirements.

### Claim 11 (depends on 1)

The product of claim 1, further comprising: confirming the application layer first payload conforms to one or more content requirements named in the identified data record in the first file.

### Claim 12 (depends on 11)

The product of claim 11, wherein the one or more content requirements comprises a command type authorized to be present in the application layer first payload.

### Claim 13 (depends on 11)

The product of claim 11, wherein the one or more content requirements comprises a command type that is prohibited from being present in the application layer first payload.

### Claim 14 (depends on 1)

The product of claim 1, further comprising: configuring the encrypted TCP connection for dedicated communications prior to the sending the second network packet, comprising:
a) sending a nonpublic first identification code for the first computing device to the network security software via the encrypted TCP connection;
b) receiving, in response to the sending the nonpublic first identification code for the first computing device, a nonpublic second identification code for the second computing device in an application layer portion of a third network packet; and
c) comparing, in a kernel running on the first computing device, the nonpublic second identification code with a pre-established value for the second computing device.

### Claim 15 (depends on 14)

The product of claim 14, further comprising: configuring the encrypted TCP connection for dedicated communications prior to the sending the second network packet, comprising:
a) sending the nonpublic identifier that is unique to the program code executable by the first computing device and the nonpublic user-identifier for the process owner running the program code executable by the first computing device to the network security software via the encrypted TCP connection;
b) receiving, in response to the sending the nonpublic identifier that is unique to the program code executable by the first computing device and the nonpublic user-identifier for the process owner running the program code executable by the first computing device, an identification code that is unique for the end-user application program on the second computing device and a nonpublic user-identifier of the end-user application program on the second computing device in an application layer portion of a fourth network packet; and
c) comparing, in the kernel running on the first computing device, the remote application identification code with a pre-established value for the end-user application program and the nonpublic user-identifier of the end-user application program with a pre-established value for the user of the end-user application.

### Claim 16 (depends on 15)

The product of claim 15, further comprising: configuring the encrypted TCP connection for dedicated communications prior to the sending the second network packet, comprising:
a) sending the identifier for the one or more formatting requirements to the network security software via the encrypted TCP connection;
b) receiving, in response to the sending the identifier for the one or more formatting requirements, the identifier for the one or more formatting requirements in the application layer portion of the fourth network packet; and
c) comparing, in the kernel running on the first computing device, the received identifier for the one or more formatting requirements with a pre-established value for the identifier for the one or more formatting requirements.

### Claim 17 (depends on 16)

The product of claim 16, wherein the comparing the nonpublic second identification code, the comparing the remote application identification code, and the comparing the received identifier for the one or more formatting requirements are performed prior to the sending the second network packet.

### Claim 18 (depends on 16)

The product of claim 16, wherein the third network packet and the fourth network packet are the same network packet.

### Claim 19 (depends on 16)

The product of claim 16, further comprising:
i) decrypting an encrypted read-only second file and identifying a data record in the second file that contains the first port number in a first port number field of the identified data record in the second file, the second file stored locally on the first computing device; and
ii) obtaining from the identified data record in the second file:
a) the nonpublic first identification code;
b) the pre-established value for the second computing device;
c) the nonpublic identifier that is unique to the program code executable by the first computing device;
d) the nonpublic user-identifier for the process owner running the program code executable by the first computing device;
e) the pre-established value for the end-user application program; or
f) the pre-established value for the user of the end-user application.

### Claim 20 (depends on 19)

The product of claim 19, wherein the first file and the second file are pre-loaded on the first computing device prior to the consuming the first network packet.

### Claim 21 (depends on 19)

The product of claim 19, wherein the identified data record in the first file is the only data record in the first file containing the first port number.

### Claim 22 (depends on 19)

The product of claim 19, wherein the identified data record in the second file is the only data record in the second file containing the first port number.