US 2010/0064133 A1 · SECURE NETWORK ARCHITECTURE

Abstract

The present invention provides a star-connected network (C1-C4, P1-P8) having a number of peripheral nodes (P1-P8) and a central control arrangement (C1-C4). Each peripheral node has means for restricting communications across the network to the central control arrangement using a respective encrypted connection unless the peripheral node has received explicit authorization from the control arrangement to set up a direct connection with another peripheral node. The central control arrangement comprises: means for establishing an encrypted connection with each peripheral node; means for exchanging control packets with two or more peripheral nodes using two or more respective encrypted connections in order to set up an authorized connection between two peripheral nodes; a database storing security policy information specifying what connections between peripheral nodes are allowable; and authorization means for authorizing connections which are allowable according to the stored security policy information using the control packet exchanging means.

Claims12

Dependent claims

A star-connected network having a number of client nodes and a server node, for permitting the client nodes to establish indirect communication sessions with one another wherein:

each client node is restricted in terms of which types of direct communications it can set up across the network to being able to set up direct communications to the server node using a respective encrypted connection but not being able to set up communications directly with any other of the client nodes and is operable to request initiation of an indirect communications session to the server node via a respective encrypted connection, the session request specifying one or more session parameters including an application identifier associated with the application initiating the indirect communication session;
and wherein the server node comprises:
a connection controller for establishing an encrypted connection with each client node;
a store storing, in respect of each permitted current session initiated by an application running on a client node, a session parameter set including an application identifier;
a routing controller for routing packets between two client nodes using two respective encrypted connections;
and
a firewall for allowing or blocking said packets depending on whether or not each such packet includes an application identifier associated with or contained in a stored session parameter set.

4 more elements

A method of operating a star-connected network having a number of client nodes and a server node to permit the client nodes to establish indirect communication sessions with one another, the method comprising:

restricting each client node in terms of which types of direct communications it can set up across the network to being able to set up direct communications to the server node using a respective encrypted connection but not being able to set up communications directly with any other of the client nodes,
establishing an encrypted connection between an initiating client node and the server node;
generating at the initiating client node a session request to initiate an indirect communications session with a target client node, the target client node being another one of the client nodes, and sending this session request to the server node via the encrypted connection between the initiating client node and the server node, the session request specifying one or more session parameters including an application identifier associated with the application running on the initiating client node responsible for initiating the indirect communication session;
determining whether or not to permit the session based on stored security policies and, if the session is permitted,
establishing an encrypted connection between the server node and the target client node;
storing, in respect of the permitted session, a session parameter set including an application identifier associated with the application responsible for initiating the session;
and
routing packets including the application identifier between the initiating and target client nodes using the respective encrypted connections.

5 more elements

Dependencies are inferred from the claim text.

Secure network architecture

Life of this patent

Secure network architecture

Life of this patent

Abstract

Claims12