# US 2021/0344719 A1 · Secure invocation of network security entities

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2021/0344719 A1
- Document ID: US20210344719A1
- Status: Published application
- Kind: A1
- Application number: 17/285,426
- Filed: 2018-11-07
- Published: 2021-11-04
- Earliest claimed: 2017-11-08
- Assignees: CSP Inc.
- Applicants: Csp, Inc.
- Inventors: Timothy F. OBER; Gary S. SOUTHWELL
- Web page: https://patentgrep.com/patent/US20210344719A1

## CPC

- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- G06F 8/61: Installation
- G06F 9/455: Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
- G06F 9/45533: {Hypervisors; Virtual machine monitors}
- G06F 9/45558: {Hypervisor-specific management and integration aspects}
- G06F 21/33: using certificates
- G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine
- G06F 21/606: {by securing the transmission between two devices or processes}
- H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
- H04L 63/0245: {Filtering by information in the payload}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- G06F 2009/45587: {Isolation or security of virtual machine instances}
- G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A method of enforcing, deploying and invoking network security includes identifying a plurality of computing entities adapted for invocation on a network entity in an interconnected network, such that each network entity is adapted to launch and execute at least one network conversant app. An agent deploys the identified security entity on a target network entity or node, such that the security entity is responsive to the security agent previously deployed on the network entity. Upon deployment and launch, a security manager in communication with each of the security entities receives an indication of security entity operation. The security entity is thereafter enabled to scrutinize network traffic by evaluating the identified data upon ingress or egress to determine a security event, and to communicating with the security manager to provide consistent continued instantiation of the security entity.

## Claims

### Claim 1

A method of enforcing network security, comprising:
identifying a plurality of computing entities adapted for invocation on a network entity in an interconnected network, each network entity adapted to launch and execute at least one network conversant app;
identifying a manner of execution of each of the computing entities, the manner of execution defining supporting resources employed in the execution;
identifying, based on the manner of execution, a security entity corresponding to each identified computing entity, the security entity operable to identify data associated with the computing entity;
deploying the identified security entity on a network entity, the security entity responsive to a security agent previously deployed on the network entity;
receiving, at a security manager in communication with each of the security entities, an indication of security entity operation; and
evaluating the identified data upon ingress or egress to determine a security event; and
communicating with the security manager to provide consistent continued instantiation of the security entity.

### Claim 2 (depends on 1)

The method of claim 1 wherein deploying the security entity further comprises:
installing the security agent via at least one of a pre-installed, read only flash and boot-strap key material for enabling secure communications with the security manager; and
commencing the agent based on an instruction from the security manager, the agent having a trusted execution environment.

### Claim 3 (depends on 2)

The method of claim 2 further comprising securely deploying the security entity on the network entity having the commenced security agent by:
performing a secure handshake with the security manager;
determining if the security entity has been previously loaded; and
based on the determination, transmitting the security entity to the network entity based on a public key exchange with the security manager.

### Claim 4 (depends on 3)

The method of claim 3 further comprising:
copying the security entity to a temporary store on the network entity;
receiving a public key portion of a public key pair from the security manager;
authenticating the copied security entity based on a public key corresponding to the received public key pair; and
upon successful authentication, copying the authenticated security entity to a persistent image area on the network entity for execution.

### Claim 5 (depends on 4)

The method of claim 4 further wherein the public key portion obviates the need for transmission of a password credential for authenticating or decrypting the security entity.

### Claim 6 (depends on 4)

The method of claim 4 further comprising:
generating an index corresponding to an authenticated version of the security entity;
storing the generated index pending successful authentication of the security entity;
moving the security entity from an unauthenticated repository to an authenticated repository upon successful authentication; and
deleting the generated index upon transferring an unencrypted version of the security entity to a launchable image area.

### Claim 7 (depends on 1)

The method of claim 1 wherein the manner of execution includes hypervisors, containers and dedicated operating systems.

### Claim 8 (depends on 2)

The method of claim 2 wherein the security entity is a container.

### Claim 9

A network device for secure deployment of security entities, comprising:
a network entity having an interface to a security manager for identifying a plurality of computing entities adapted for invocation on a network entity in an interconnected network, each network entity adapted to launch and execute at least one network conversant app, the security manager further operable to:
identify a manner of execution of each of the computing entities, the manner of execution defining supporting resources employed in the execution; and
identify, based on the manner of execution, a security entity corresponding to each identified computing entity, the security entity operable to identify data associated with the computing entity;
the network entity responsive to the security manager to deploy the identified security entity, the security entity responsive to a security agent previously deployed on the network entity;
the network entity configured for enforcing a network policy by:
receiving, at a security manager in communication with each of the security entities, an indication of security entity operation;
evaluating the identified data upon ingress or egress to determine a security event; and
communicating with the security manager to provide consistent continued instantiation of the security entity.

### Claim 10 (depends on 9)

The device of claim 9 wherein deploying the security entity further comprises:
installing the security agent via at least one of a pre-installed, read only flash and boot-strap key material for enabling secure communications with the security manager;
commencing the agent based on an instruction from the security manager, the agent having a trusted execution environment.

### Claim 11 (depends on 10)

The device of claim 10 wherein the network entity further comprises an agent, the agent configured to
perform a secure handshake with the security manager;
determine if the security entity has been previously loaded; and
based on the determination, receive the transmitted the security entity at the network entity based on a public key exchange with the security manager.

### Claim 12 (depends on 11)

The device of claim 11 wherein the agent is further operable to
copy the security entity to a temporary store on the network entity;
receive a public key portion of a public key pair from the security manager;
authenticate the copied security entity based on a public key corresponding to the received public key pair; and
upon successful authentication, copy the authenticated security entity to a persistent image area on the network entity for execution.

### Claim 13 (depends on 12)

The device of claim 12 further wherein the public key portion obviates the need for transmission of a password credential for authenticating or decrypting the security entity.

### Claim 14 (depends on 12)

The device of claim 12 wherein the agent is further configured to:
generate an index corresponding to an authenticated version of the security entity;
store the generated index pending successful authentication of the security entity;
move the security entity from an unauthenticated repository to an authenticated repository upon successful authentication; and
delete the generated index upon transferring an unencrypted version of the security entity to a launchable image area.

### Claim 15 (depends on 9)

The method of claim 9 wherein the manner of execution includes hypervisors, containers and dedicated operating systems.

### Claim 16 (depends on 10)

The method of claim 10 wherein the security entity is a container.

### Claim 17

A computer program product on a non-transitory computer readable storage medium having instructions that, when executed by a processor, perform a method for enforcing network security, the method comprising:
identifying a plurality of computing entities adapted for invocation on a network entity in an interconnected network, each network entity adapted to launch and execute at least one network conversant app;
identifying a manner of execution of each of the computing entities, the manner of execution defining supporting resources employed in the execution;
identifying, based on the manner of execution, a security entity corresponding to each identified computing entity, the security entity operable to identify data associated with the computing entity;
deploying the identified security entity on a network entity, the security entity responsive to a security agent previously deployed on the network entity;
receiving, at a security manager in communication with each of the security entities, an indication of security entity operation; and
evaluating the identified data upon ingress or egress to determine a security event; and
communicating with the security manager to provide consistent continued instantiation of the security entity.