Agile node isolation through using packet level non-repudiation for mobile networks
OwnerJonathan Grierinventor
Life of this patent
Estimating the term…
Abstract
Apparatus, systems and methods for agile network isolation through use of packet level non-repudiation (PLNR) are provided. Using a fast cryptography to verify that incoming packets are undeniably being received from the identified source, real-time attack notifications can be independently verified and shared among the network devices to remove compromised nodes from the network. The ability to collaborate among nodes without trust may be achieved via PLNR, to share attack notifications in real-time may be achieved via Telling Attack Layer (TATL), and to establish the identity of an attack in a permanent and binding way may be achieved via DISCOvery (DISCO).
Claims13
A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
- receive an Internet Protocol (IP) packet that includes a header and an authentication header (AH),
- deconstruct the packet to obtain the AH , wherein the AH includes a public key associated with a sender of the packet, and associated with a certificate and the AH includes a signature associated with a sender of the packet;
- determine that a status of the certificate is enabled and perform additional processing on the packet;
- wherein:
- the additional processing includes authenticating the signature located within the AH;
- the IP packet comprises an IP header and an IP payload;
- and
- the AH is disposed between the IP payload and a destination address within the IP header.
A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
- receive an Internet Protocol (IP) packet that includes a header and an authentication header (AH), the AH includes a public key associated with the sender of the packet and associated with a certificate and a signature,
- deconstruct the IP packet to obtain another IP packet, which includes another AH, associated with another certificate and an identification of a threat;
- authenticate the certificate, subsequent to authenticating the certificate, authenticate the signature and the another AH within the IP packet and the identification of the threat and determine that a status of the another certificate is enabled.
A system for isolating a compromised node within a mobile network, the system comprising:
- at least two nodes communicating through a wide area network (WAN);
- wherein one of the at least two nodes is the compromised node;
- wherein the other of the at least two nodes includes a non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
- receive a packet over the WAN from the compromised node,
- determine that the packet includes a header and an authentication header (AH) and a threat;
- wherein at least a portion of the AH is associated with a certificate that is used to authenticate the received packet and a portion of the AH is associated with a signature that is used to further authenticate the received packet when the packet is authenticated using the certificate;
- wherein the threat is a threat received by the compromised node;
- and,
- in response to determining that the packet includes a threat, generate a control packet to isolate the compromised node from the network.
Dependencies are inferred from the claim text.