US 8,346,925 B2Granted

Apparatus for providing security over untrusted networks

AssigneeRound Rock Research, LLC

InventorsJames M Holden, Stephen E Levin, James O Nickel, Edwin H Wrench

Life of this patent

Estimating the term…

Loading patent…

Abstract

A network security apparatus adapted to provide for secure communications across data networks, including untrusted networks. In one embodiment, the security apparatus comprises one or more components disposed within the software stack of a computerized device, the components including an association process adapted to establish security associations between devices on the network, and an encryption key generation process adapted to generate one or more encryption keys. In one variant, the keys are specifically for use with temporary or ad hoc security associations. The one or more keys are exchanged according to a key exchange protocol after the device is authenticated or authenticates another device. In one implementation, the device comprises a portable device such as a laptop computer.

Claims22

Dependent claims

Network security apparatus comprising a processor and a computer readable apparatus having a storage medium with at least one computer program stored thereon, the at least one computer program comprising a plurality of computer executable instructions that when executed by the processor are configured to communicate with a computerized host device and other network security apparatus on a network having components that may be individually secure or non-secure, the apparatus comprising:

a message process disposed on the computer readable apparatus that is adapted to, when executed by the processor, exchange first security association information including a digital certificate between the security apparatus and at least one of said other security apparatus on the network via one or more messages, said digital certificate comprising a first encryption key;
a cryptographic material management process disposed on the computer readable apparatus, said cryptographic material management process adapted to, when executed by the processor, package cryptographic material comprising at least one second encryption key for distribution to said at least one other security apparatus;
and
an association process disposed on the computer readable apparatus that is configured to, when executed by the processor, establish a security association between said network apparatus and said at least one other network security apparatus based at least in part on said first security association information;
wherein said apparatus further comprises a key exchange protocol disposed on the computer readable apparatus, said key exchange protocol being adapted to, when executed by the processor, exchange said at least one second encryption key between said network security apparatus and said at least one other security apparatus using at least one message generated by said message process.

2 more elements

A portable computerized device adapted for secure communications over an untrusted network, the device comprising:

a network security apparatus comprising a processor and a computer readable apparatus having a storage medium with at least one computer program stored thereon, the at least one computer program comprising a plurality of computer executable instructions that when executed by the processor are configured to communicate with other network security apparatus on said network, the network security apparatus comprising:
a message process disposed on the computer readable apparatus that is adapted to, when executed by the processor, exchange first security association information between the security apparatus and at least one of said other security apparatus on the network via one or more messages;
a cryptographic material management process disposed on the computer readable apparatus, said management process being adapted to, when executed by the processor, package cryptographic material comprising at least one encryption key for distribution to said at least one other network security apparatus;
an association process disposed on the computer readable apparatus that is configured to, when executed by the processor, establish an ad hoe security association between said network apparatus and said at least one other network security apparatus based at least in part on said first security association information;
a key exchange protocol disposed on the computer readable apparatus, said key exchange protocol being adapted to, when executed by the processor, exchange said at least one encryption key between said network security apparatus and said at least one other security apparatus using at least a request and reply message exchange;
and
a block ciphering algorithm disposed on the computer readable apparatus that is adapted to, when executed by the processor, cipher data to be transmitted between said network security apparatus and said at least one other security apparatus;
wherein said network security apparatus is disposed within a software stack of said portable device.

5 more elements

a cryptographic material generation process disposed on the computer readable apparatus, said cryptographic material generation process being configured to, when executed by the processor, generate cryptographic material comprising at least one encryption key;
a message process disposed on the computer readable apparatus that is configured to, when executed by the processor, exchange first security association information between the security apparatus and at least one of said other security apparatus on the network via one or more messages;
and
an association process disposed on the computer readable apparatus that is configured to, when executed by the processor, establish a security association between said network apparatus and said at least one other network security apparatus based at least in part on said first security association information;
wherein said apparatus further comprises a key exchange protocol disposed on the computer readable apparatus, said key exchange protocol being configured to, when executed by the processor, exchange said at least one encryption key between said network security apparatus and at least one other security apparatus using at least one message generated by said message process;
and
wherein the security association information comprises a digital certificate, the digital certificate comprising a public encryption key.

4 more elements

a cryptographic material generation process disposed on the computer readable apparatus, said generation process being configured to, when executed by the processor, generate cryptographic material comprising at least one encryption key;
a message process disposed on the computer readable apparatus that is configured to, when executed by the processor, exchange first security association information between the security apparatus and at least one of said other security apparatus on the network via one or more messages;
and
an association process disposed on the computer readable apparatus that is configured to, when executed by the processor, establish a security association between said network apparatus and said at least one other network security apparatus based at least in part on said first security association information;
wherein said apparatus further comprises a key exchange protocol disposed on the computer readable apparatus, said key exchange protocol being configured to, when executed by the processor, exchange said at least one encryption key between said network security apparatus and at least one other security apparatus using at least one message generated by said message process;
wherein said material generation process is further configured to, when executed by the processor, generate at least one random number for use in association with said at least one encryption key;
and
wherein said at least one random number is transmitted along with said at least one encryption key as part of said key exchange protocol.

5 more elements

A portable computerized device configured for secure communications over an entrusted network, the device comprising:

network security apparatus comprising a processor and a computer readable apparatus having a storage medium with at least one computer program stored thereon, the at least one computer program comprising a plurality of computer executable instructions that when executed by the processor are configured to communicate with other network security apparatus on said network, the apparatus comprising:
a cryptographic material generator disposed on the computer readable apparatus, said cryptographic material generator being configured to, when executed by the processor, generate cryptographic material comprising at least one encryption key;
a message process disposed on the computer readable apparatus that is configured to, when executed by the processor, exchange first security association information between the security apparatus and at least one of said other security apparatus on the network via one or more messages;
an association process disposed on the computer readable apparatus that configured to, when executed by the processor, establish a temporary security association between said network apparatus and said at least one other network security apparatus based at least in part on said first security association information;
a key exchange protocol disposed on the computer readable apparatus, said key exchange protocol being configured to, when executed by the processor, exchange said at least one encryption key between said network security apparatus and at least one other security apparatus using at least a request and reply message exchange;
and
an encryption process disposed on the computer readable apparatus that is configured to, when executed by the processor, encrypt said at least one encryption key using at least a private key;
wherein said network security apparatus is disposed within a software stack of said portable device.

5 more elements

A portable computerized device configured for secure communications over an untrusted network, the device comprising:

network security apparatus comprising a processor and a computer readable apparatus having a storage medium with at least one computer program stored thereon, the at least one computer program comprising a plurality of computer executable instructions that when executed by the processor are configured to communicate with other network security apparatus on said network, the apparatus comprising:
a cryptographic material generator disposed on the computer readable apparatus, said cryptographic material generator being configured to, when executed by the processor, generate cryptographic material comprising at least one encryption key;
a message process disposed on the computer readable apparatus that is configured to, when executed by the processor, exchange first security association information between the security apparatus and at least one of said other security apparatus on the network via one or more messages;
an association process disposed on the computer readable apparatus that configured to, when executed by the processor, establish a temporary security association between said network apparatus and said at least one other network security apparatus based at least in part on said first security association information;
and
a key exchange protocol disposed on the computer readable apparatus, said key exchange protocol being configured to, when executed by the processor, exchange said at least one encryption key between said network security apparatus and at least one other security apparatus using at least a request and reply message exchange;
wherein said network security apparatus is disposed within a software stack of said portable device;
and
wherein said cryptographic material generator is further configured to, when executed by the processor, generate said at least one encryption key and another key different from said at least one encryption key.

6 more elements

Dependencies are inferred from the claim text.

Facts

Application: 12/965,606Filed 10 Dec 2010 · division
Priority: 30 Jul 1996
Published: US 2011/0202758 A118 Aug 2011
Granted: 1 Jan 2013
Term ends: Not estimatedThe source records don’t support an estimate.

Classification30 codes

H04L 63/061
For supporting key management in a packet data network: for key exchange, e.g. in peer-to-peer networks
G06F 21/31
Authentication, i.e. establishing the identity or authorisation of security principals: user authentication
G06F 21/606
Protecting data: by securing the transmission between two devices or processes
G06F 21/85
Protecting input, output or interconnection devices: interconnection devices, e.g. bus-connected or in-line devices

Family

Application08/688,543Parent of this continuation-in-part · filed 30 Jul 1996
Application09/127,280Parent of this continuation · filed 31 Jul 1998
US 5,832,228 AParent of this continuation-in-part · filed 3 Nov 1998
Application09/924,214Parent of this continuation · filed 7 Aug 2001
US 6,272,538 B1Parent of this continuation · filed 7 Aug 2001
Application10/877,791Parent of this continuation · filed 25 Jun 2004
US 6,760,768 B2Parent of this continuation · filed 6 Jul 2004
Application11/776,418Parent of this division · filed 11 Jul 2007
US 2011/0202758 A1Pre-grant publication · published 18 Aug 2011
US 7,917,630 B2Parent of this division
US 7,475,137 B2Parent of this continuation
Application11/776,418Parent of this continuation
Application09/127,280Parent of this continuation-in-part
US 2002/0035635 A1Published application
US 2005/0010766 A1Published application
US 2007/0250708 A2Published application
US 2008/0016226 A1Published application
US 8,346,925 B2This patent

From the US filing history. Foreign family members aren’t listed.