Patent Application
20230125556
The following U.S. patent Publications do not qualify as prior art under 35 USC 102(b)(1)(A) because their Jan. 28, 2021 publications are (1) one year or less before the effective filing date of the claimed invention, and (2) by the inventor or a joint inventor: U.S. Pub. 2021/0026535; U.S. Pub. 2021/0026976; U.S. Pub. 2021/0028940; U.S. Pub. 2021/0028943; U.S. Pub. 2021/0029092; U.S. Pub. 2021/0029125; and U.S Pub. 2021/0029126, the disclosures all of which are incorporated herein by reference to the extent not inconsistent with this application.
The present disclosure generally relates to a secure autonomic recovery from an unusable data structure via a trusted device in a secure peer-to-peer data network.
This section describes approaches that could be employed, but are not necessarily approaches that have been previously conceived or employed. Hence, unless explicitly specified otherwise, any approaches described in this section are not prior art to the claims in this application, and any approaches described in this section are not admitted to be prior art by inclusion in this section.
The Internet Protocol (IP) has enabled the Internet to evolve from a set of connected research institutions and universities to a world wide web of connected IP devices that enables worldwide communications between user-controlled devices (“user devices”), Internet of Things (IoT) devices (devices that do not require user control), and server devices providing ever-increasing cloud-based based services such as social networking services, business transaction services, media distribution services, data storage services, etc. The enormous success of the Internet is based on the deployment of IP routing protocols that enable a “source” device (having a corresponding “source IP address”) that is connected to the Internet to reach a “destination” device (having a corresponding “destination IP address”) that also is connected to the Internet.
This universal reachability also has introduced severe security threats to each and every IP device that is connected to the Internet, because any “threat device” originating at a “source” IP address (e.g., a malfunctioning network device infected by malware or a network device operated by a malicious user) can threaten any “target device” at a “destination” IP address in an attempt to steal private data, disrupt the target device, etc. Hence, this universal reachability has resulted in losses on the order of billions (or even trillions) of dollars in losses due to attacks on targeted devices, including attacks on personal devices, as well as attacks on large-scale corporate, government, and/or military networks. Individuals and institutions collectively have expended billions of dollars in network security in an attempt to thwart or mitigate against online attacks, yet malicious users still have been able to overcome network security attempts.
Security threats also can arise from an inability to efficiently establish and maintain a secure backup and recovery of a data file that has encountered corruption (e.g., file system corruption) and that is thus unusable. Existing systems suffer from requiring user interaction in establishing a backup and recovery system, for example in the case of application-based backup and recovery systems; further, such application-based backup and recovery systems often fail to provide a secure encryption of files without active user intervention, resulting in potential theft of unencrypted data stored during a backup operation onto a removable storage device that is not stored in a secure location. Cloud-based services have suffered cyber-attacks that have been able to successfully obtain sensitive user data, including personal identity information, financial information including social security numbers, etc.
Reference is made to the attached drawings, wherein elements having the same reference numeral designations represent like elements throughout and wherein:
In one embodiment, a method comprises: generating, by a secure executable container executed by a network device, a secure private key and a corresponding secure public key for secure communications in a secure peer-to-peer data network; establishing, by the secure executable container, a trusted two-way relationship with a second network device within the secure peer-to-peer data network based on the secure executable container receiving a second secure public key generated by the second network device and the second network device receiving the secure public key; receiving, by the secure executable container, a data structure and encrypting the data structure into a first encrypted data structure using the secure private key; autonomically replicating, by the secure executable container via the secure peer-to-peer data network, the data structure based on securely sending a copy of one of the data structure or the first encrypted data structure to the second network device based on the second secure public key; and autonomically executing, by the secure executable container, a secure recovery of the copy from the second network device via the secure peer-to-peer data network, in response to detecting an unusability of the first encrypted data structure stored in the network device.
In another embodiment, one or more non-transitory tangible media are encoded with logic for execution by a machine and when executed by the machine operable for: generating, by a secure executable container executed by the machine implemented as a network device, a secure private key and a corresponding secure public key for secure communications in a secure peer-to-peer data network; establishing, by the secure executable container, a trusted two-way relationship with a second network device within the secure peer-to-peer data network based on the secure executable container receiving a second secure public key generated by the second network device and the second network device receiving the secure public key; receiving, by the secure executable container, a data structure and encrypting the data structure into a first encrypted data structure using the secure private key; autonomically replicating, by the secure executable container via the secure peer-to-peer data network, the data structure based on securely sending a copy of one of the data structure or the first encrypted data structure to the second network device based on the second secure public key; and autonomically executing, by the secure executable container, a secure recovery of the copy from the second network device via the secure peer-to-peer data network, in response to detecting an unusability of the first encrypted data structure stored in the network device.
In another embodiment, an apparatus is implemented as a physical machine, and comprises: non-transitory machine readable media configured for storing executable machine readable code, the apparatus configured for operations as a network device; a device interface circuit configured for secure communications via a secure peer-to-peer data network; and a processor circuit. The processor circuit is configured for executing the machine readable code, and when executing the machine readable code operable for: generating, by a secure executable container executed by the processor circuit, a secure private key and a corresponding secure public key for the secure communications in the secure peer-to-peer data network; establishing, by the secure executable container, a trusted two-way relationship with a second network device within the secure peer-to-peer data network based on the secure executable container receiving a second secure public key generated by the second network device and the second network device receiving the secure public key; receiving, by the secure executable container a data structure and encrypting the data structure into a first encrypted data structure using the secure private key; autonomically replicating, by the secure executable container via the secure peer-to-peer data network, the data structure based on securely sending a copy of one of the data structure or the first encrypted data structure to the second network device based on the second secure public key; and autonomically executing, by the secure executable container, a secure recovery of the copy from the second network device via the secure peer-to-peer data network, in response to detecting an unusability of the first encrypted data structure stored in the network device.
Particular embodiments provide a secure autonomic recovery from an unusable (e.g., corrupted) data structure stored in a network device, based on a secure executable container executed in the network device recovering a copy of the original data structure (or a copy of an encrypted version thereof) via a trusted device in a secure peer-to-peer data network. The secure executable container can respond to receiving the original data structure by encrypting the data structure into a first encrypted data structure using a secure private key generated by the secure executable container, autonomically replicating the data structure based on sending a copy of the data structure (or the encrypted version) to the trusted device using a public key of the trusted device, and autonomically executing the secure recovery of the copy of the data structure (or the encrypted version) from the trusted network device in response to detecting an unusability of the data structure, for example due to a corruption of the data structure or a failure in the file system of the network device storing the data structure. The autonomic execution of the secure recovery by the secure executable container executed in the network device enables the instant decryption of the recovered data structure from the received copy, ensuring the data structure is always encrypted format “at-rest” or “in-flight” without the necessity of any user involvement.
Moreover, the autonomic execution of the secure recovery enables the corrupted data structure to be cryptographically erased and replaced by the recovered data structure (from the received copy of the data structure or the encrypted version), without the necessity of any user involvement, enabling a secure and opaque backup and recovery system that can be executed “in the background” without any user knowledge or involvement.
The example embodiments also enable a user of the network device to select one or more “trusted” network devices for secure backup and recovery of different data structures: in one embodiment, a message (e.g., a “text” message, an audio message, a picture-based message, a video message, etc.) that is sent securely as part of a messaging session (e.g., a secure “chat”) to one or more “trusted” network device of one or more destination users can be autonomically and securely recovered based on autonomic retrieval of the message stored (in encrypted form) in the first “trusted” network device; in another embodiment, an encrypted version of the data structure can be autonomically sent to one or more “trusted” network devices for secure archival storage of the encrypted version of the data structure, enabling an executable resource (e.g., a “distributed lazy loader”) in the secure executable container to autonomically execute the recovery from any one or more of the “trusted” network device.
Hence, the example embodiments enable a secure and autonomic recovery from an unusable (e.g., corrupted) data file based on autonomically executing a secure retrieval of a copy of a data structure (or encrypted version), without any user involvement. The example embodiments also enable the secure executable container to execute the secure and autonomic recovery of a plurality of data structures from multiple selected trusted network devices having received respective copies of the data structures, for example in the case of a failure in the file system in the network device (e.g., due to operating system failure). Hence, the example embodiments enable a secure and autonomic recovery of most if not all data structures managed by the secure executable container.
A description will first be provided of a network operating system providing secure encryption and secure communications, the secure peer-to-peer data network, and a secure identity management system used to establish the two-way trusted relationships, followed by a description of the secure autonomic recovery from an unusable data file via a trusted network device in the secure peer-to-peer data network.
Any and all access to any data structures to or from an external network device, or any network-based services, is exclusively via a network operating system (56 of
A fundamental problem with existing Internet technology is that the Internet was architected at the network layer (layer 3) with an Internet Protocol (IP) that merely routed data packets between a source device and a destination device, with no regard for anti-fraud protection, protecting user identities, etc. The worldwide deployment of the Internet using Internet Protocol at the network layer thus exposed network devices connected to the Internet to malicious attacks, unauthorized monitoring of user communications, and exploitation of user identities by service providers that have executed machine learning of user behaviors in order to identify targeted advertising to Internet users, including targeting addictive content.
Moreover, the use of Internet Protocol at the network layer, without any regard for anti-fraud protection or user identity protection at the network layer, resulted in implementing security-based network services (e.g., protecting owned content, building directories, building ontologies, providing security, etc.) “above” the layer 3 (network) layer, typically at the application layer; unfortunately, implementing security-based network services at the application layer cannot prevent a malicious user from reaching a target via the layer 3 Internet, especially since a malicious user often can bypass the OSI (Open Systems Interconnect) protocol stack using unencrypted “raw” data packets that can bypass a TCP/IP stack.
In contrast, the network operating system 56 according to example embodiments maintains exclusive control over all access to the secure peer-to-peer data network 5 and access to any data structure associated with the secure peer-to-peer data network 5, including any and all user metadata for any user accessing the secure peer-to-peer data network 5. Further, the network operating system 56 establishes an identity management system that requires a user to verify their identity upon initial registration in the secure peer-to-peer data network, and requires the user to establish a two-way trusted relationship with their endpoint device and any other network entity in the secure peer-to-peer data network 5.
Consequently, the network operating system 56 can provide secure communications between two-way trusted network devices in a secure peer-to-peer data network 5, where the secure peer-to-peer data network is established based on an aggregation of two-way trusted relationships.
Moreover, each network device can uniquely and securely identify itself based on its network operating system 56 cryptographically generating a secure private key and a corresponding secure public key. Hence, data storage in each and every network device in the secure peer-to-peer data network 5, as well as all network communications between each and every network device, can be secured based on sharing secure public keys between endpoint devices having established a two-way trusted relationship based on a secure verification of membership within the same “federation” according to a prescribed secure salutation protocol.
The secure storage and transmission of data structures can be extended between different “federations” of endpoint devices (established by different users having established respective two-way trusted relationships with the secure peer-to-peer data network), based on the different users establishing their own two-way trusted relationship according to the prescribed secure salutation protocol.
The peer-to-peer network in the secure private core network 10 is based on a trusted aggregation of strict two-way trusted relationships (“cohorts”) between two entities: an “entity” can be based on a physical device (e.g., an endpoint device 12 or a physical network device in the secure private core network 10 such as the MCP device 14) having a verified secure relationship with at least an individual person utilizing the physical device; the verified secure relationship also can be with an identified organization associated with the physical device (e.g., a prescribed manufacturer of an endpoint device 12 such as an IoT device, a service provider offering services based on purchase or rental of an endpoint device 12, etc.); the verified secure relationship also can be with another physical device attempting a communication with the physical device (e.g., a physical device executing the MCP device 14 and/or the replicator device 16, another endpoint device 12, etc.). Hence, the secure private core network 10 requires establishment of a strict two-way trusted relationship between two physical devices (also referred to as a “cohort”), where each physical device either is operated by a user, or is a physical device associated with an identified organization (including a corresponding physical device executing the MCP device 14).
Since an individual person (or identified organization) may utilize one or more endpoint devices 12 for network communications, the secure private core network 10 can identify an individual person (or identified organization) based on the allocation of a “federation” identifier (illustrated as “F1”) 18 that has a verified secure relationship with one or more physical network devices (e.g., “A” 12, “A1” 12, etc.) that are utilized by the individual person (or identified organization) for communications within the secure data network 5; hence, the secure data network 5 also is referred to herein as a “secure peer-to-peer data network” based on the trusted aggregation of two-way trusted relationships. As described below, the federation ID 18 is generated by an endpoint device 12 during initial registration of a user (e.g., individual person or identified organization) using a secure random number generator that results in a universally unique identifier (UUID) of at least one-hundred twenty eight (128) bits: an example 128-bit UUID can be implemented as proposed by the Internet Engineering Task Force (IETF) (see RFC 4122).
Each physical device, including each endpoint device 12, is uniquely identified in the secure private core network 10 based on its corresponding endpoint object 22. The endpoint object 22 for each physical device can specify its corresponding endpoint ID 20, the federation ID 18 of the federation 34 to which the physical device belongs, a corresponding lifecycle policy “L” 24, and a corresponding distribution policy “D” 26, described below. The endpoint object 22 for each physical device also can identify a corresponding device type, for example a “human interface” (user interface device), a “thing” (e.g., IoT device, mass storage device, processor device), or a core network component (e.g., an MCP device 14, a replicator device 16, a directory server 28, a community server 30, etc.); hence, a particular device type as specified in the endpoint object 22 can cause the corresponding physical device (e.g., an endpoint device 12), to be allocated or granted selected attributes within the secure private core network 10. Each endpoint object 22 is securely stored in its corresponding physical device in which it represents, and also can be securely stored in other physical devices upon establishment of a two-way trusted relationship, described below.
A federation object 32 is a data structure that has its own unique federation ID 18 and comprises one or more endpoint objects 22: the federation object 32 is established upon secure registration of the first endpoint device 12 and establishment of its corresponding endpoint object 22. As described previously, an individual person (or identified organization) may utilize one or more endpoint devices 12 for network communications; hence, each endpoint object 22 is added to the federation object 32 in response to determining that the corresponding endpoint device (e.g., “A1”) 12 has a two-way trusted relationship with a user (or organization) that has previously executed a secure registration with another endpoint device (e.g., “A”) 12 in the same federation 32, described below. Hence, the secure private core network 10 can identify an individual person (or identified organization) based on a corresponding federation ID 18 that identifies a collection (i.e., “federation”) 34 of one or more endpoint devices 12 having been verified by the secure private core network 10 as each having a secure relationship with the identified person or user. Hence, a “federation entity” (or simply “federation”) 34 as described herein is a logical entity in the secure data network 5, expressed in the secure private core network 10 by its corresponding federation object 32, that uniquely identifies the federation of secured endpoint devices 12 (identified by respective endpoint objects 22) that have a two-way trusted relationship with an individual user or organization. The secure private core network 10 establishes a trusted aggregation of strict two-way trusted relationships between two entities, where each endpoint device 12 of each federation 34 has its own permanent (i.e., unchangeable) and cryptographically-unique endpoint ID 20.
An endpoint device 12 in a federation 34 can generate content as a message object 36 that can be securely stored in one or more endpoint devices 12 in the federation 34. A message object can have different types including messages created within the secure private core network 10 (e.g., a notification object generated by an endpoint device 12 in the secure private core network 10), user created content from a user device 12 (e.g., a text message, an image, a media file, a media stream, etc.), or machine-created content from an IoT device (e.g., a sensor-based data record or media stream, an actuator message, etc.). A message object 36 is identified by a corresponding 256-bit unique message identifier 38 (illustrated in
The federation object 32 can be implemented as a collection of the endpoint objects 22, message objects 36, and conversation objects that specify the same federation ID 18 as owner of the objects. In other words, the ownership within the same federation 34 is established based on storage of the same federation ID 18: within each endpoint object 22; within the message identifier 38 of each message object 36; and/or within the conversation identifier 44 of each conversation object 42. Hence, the federation object 32 can be implemented based on the federation ID 18 providing a reference to the owned endpoint objects 22, message objects 36, and conversation objects that can be stored at different locations within the memory circuit (94 of
Hence, each federation 34 in the secure data network 5 is a collection of one or more secured endpoint devices 12 (identified in the secure private core network 10 by its corresponding endpoint object 22) each of which have a two-way trusted relationship with an individual user or organization: each federation 34 is allocated a corresponding federation object 32 having a corresponding unique federation ID 18 that uniquely identifies the federation 34 in the secure data network 5. The federation object 32 can be stored in a memory circuit (94 of
An endpoint device “A1” 12 can initiate a prescribed secure salutation protocol with another endpoint device “A” 12 in order to establish a two-way trusted relationship between the two endpoint devices “A” and “A1” 12 in the federation “F1” 34, resulting in exchange of public encryption keys for pairwise sharing of encrypted content that cannot be decrypted by any intermediate device (e.g., a replicator device 16 in between two devices 12); hence, the addition of a new endpoint device (e.g., a new smartphone, a new smart tablet or laptop computer, etc. “A1”) 12 by a user into the federation “F1” 34 enables the new endpoint device “A1” to execute a prescribed secure salutation protocol with at least one other endpoint device (e.g., endpoint device “A” 12), enabling the newly added endpoint device “A1” 12 in the federation “F1” 34 to establish a two-way trusted relationship with the other endpoint device (e.g., endpoint device “A” 12”). An example salutation protocol is illustrated in U.S. Patent Publication No. 2021/0029126.
The establishment of a two-way trusted relationship between the two endpoint devices 12 within the federation “F1” 34 enable the two endpoint devices 12 to execute autonomic synchronization of any portion of the data structures 22, 36, and 42 between any other endpoint device (e.g., “A1”) 12 within the federation “F1” 34.
In particular, each physical network device (including each endpoint device 12) includes an autonomic synchronizer (52 of
The autonomic synchronizer 52 is configured for executing pairwise synchronization between trusted peer devices 12 in response to each update to a data object. In particular, each and every data object that is created and stored in the secure data network 5 comprises a creation timestamp indicating a time that the data object was created, and a “last change” timestamp (i.e., update timestamp) indicating the last time the data object was updated. Hence, the autonomic synchronizer 52 can execute, in cooperation with a corresponding autonomic synchronizer 52 in a trusted peer device, a pairwise update of an older copy of each data object to the most recently available update based on comparing the relative update timestamps.
The autonomic synchronizer 52 of an endpoint device (e.g., “A”) 12 utilizes a “database version number” for each other trusted physical network device (e.g., “A1”, “R1”, “B”, “C”, “MCP”) in which the endpoint device “A” 12 has established a trusted relationship, resulting in a corresponding pairwise relationship in the database version number between trusted peer devices 12. In response to the trusted peer devices 12 connecting to each other (e.g., either directly via a P2P data link or via the secure private core network 10), the autonomic synchronizers 52 in the trusted peer devices 12 can track their respective database version numbers and in response can update their database versions along with the associated database changes.
Since different endpoint devices can be “online” or “offline” at different instances, a “disconnected” endpoint device (e.g., “A1”) can develop changes or “versions” that “drift apart” from the synchronized versions among the trusted peer devices that are connected to the secure private core network 10, for example where a federation owner is updating a message object (e.g., a note or memorandum) 36 using the “disconnected” endpoint device (e.g., “A1”). Hence, the autonomic synchronizer 52 of an endpoint device (e.g., “B”) 12 can respond to reconnection with the secure private core network 10 (or a trusted peer device 12 via a P2P data link) by comparing its “database version number” (e.g., the database version number associated with its peer “A”) and determine if synchronization is needed.
The autonomic synchronizer 52 also can track changes of all locally-stored data objects based on creating a hash of a database state: the database state represents all locally-stored data objects as tuples of a data object identifier and the “last change” timestamp. Example locally-stored data objects that can be generated by a federation owner on an endpoint device 12, and replicated and synchronized with other endpoint devices 12, can include: endpoint objects 22: conversation objects 42; message objects 36; outcasted endpoints, conversations and messages that are removed from a federation 34; membership of federations in conversations (e.g., subscriber lists 50); cohorts within a federation; voting state for conversations and messages; a vault file system within a federation; password recovery information for participants in password recovery; “shared” configuration between devices within a federation; etc.
Hence, any one or more of the endpoint devices 12 of a first federation (e.g., “F1”) 34 can cause the secure private core network 10 to execute autonomic synchronization of any portion of the data structures 22, 36, and 42 in any other federation (e.g., “F2” or “F3”) 34 in which the first federation has established a two-way trusted relationship, based on the subscriber list 50 in a given conversation object 42: the autonomic synchronization is executed in a secure manner that ensures that all data structures always stored securely in a non-transitory machine readable medium, and that all data structures are always transmitted securely, for example via a wireless (or wired) transmission medium.
For example, any data object (e.g., 22, 36, and/or 42) that is generated and stored within an endpoint device 12 (e.g., “A”) can be encrypted using its public key (e.g., “KeyP1_A”); any data object that is sent from an originating endpoint device 12 (e.g., “A”) to a cohort (e.g., “B”) (either within its federation “F1” 34 or in another federation “F2” 34) for secure storage can be encrypted using the originator private key (e.g., “prvKeyP1_A”) and the cohort public key (e.g., “Key_B”), and further encrypted using a temporal key prior to transmission to the cohort. The cohort can decrypt the transmitted data object based on the temporal key (described below) and store the object that was encrypted using the originator private key (e.g., “prvKeyP1_A”) and the cohort public key (e.g., “Key_B”).
As described below, the verified secure relationship is established via a “two-way trusted relationship” that is verified by the MCP device 14 via the first party (e.g., an individual person, organization, or another physical device) and via the second party (e.g., via the physical network device); in other words, no third-party authentication (e.g., by a certifying authority outside the authority of the secure private core network 10) is permitted in the secure private core network 10, nor is any one-way verification permitted in the secure private core network 10; hence, the trusted aggregation of multiple two-way trusted relationships establishes the hybrid peer-to-peer overlay network in the secure private core network 10.
The secure private core network operations 56 can be executed by each of the physical network devices in the secure data network 5 (including each of the endpoint devices 12) executing machine-executable code that can be implemented in each physical network device in the form of a self-contained “network operating system” (NOS) 56. The “network operating system” 56 can be implemented for deployment on various network device platforms, for example as a native operating system (e.g., for an IoT device or a physical network device dedicated for use in the secure data network 5), or as an executable “app” that can be installed and executed on a device utilizing an operating system such as Android, iOS, Microsoft Windows 10, or any other Unix-based operating system.
The network operating system 56 can include machine-executable code for executing numerous security-based operations in the secure data network 5, including establishment of a secure peer-to-peer (P2P) network transport 74 based on a dynamic generation of a unique encrypted temporal key for each and every data packet that traverses the secure data network 5, providing secure network services 76, providing security policy enforcement 78, and providing application programming interfaces (APIs) 80.
Example secure network services 76, illustrated for example in
The APIs provide prescribed commands that are available to the application layer resources 58 for execution of the secure private core network operations 56; moreover, the APIs 58 separate application logic from the need for any domain knowledge of the underlying data network that is implementing the secure data network 5. Hence, the example implementation 54 enables application developers to create the application layer resources 58 without any need of domain knowledge, and without any need to learn any security-based protocols, since the secure private core network operations 56 can ensure that the secure data network 5 provides a secure network that can prevent network intrusion.
A problem in prior deployments of cyber security is that no known security system for a user network device maintained cryptographic security of a data packet having an encrypted payload that is received via a data network. To the contrary, at most a resource in a user network device would decrypt the encrypted payload to recover a decrypted payload, and store the decrypted payload as a local data structure in a memory circuit of the user network device. Hence, the storage of the decrypted payload “at rest” within a memory circuit of the user network device exposed the decrypted payload to a potential cyber-attack.
Although existing encryption applications enabled a user to execute encryption of locally-stored data structures on his or her user network device, such encryption applications are executed at the “application layer”, resulting in the exposure of the decrypted data packet at the operating system level until a user executes the encryption application in the user network device for encryption of the locally-stored data structures.
Access to the secure private core network 10 by any physical network device 88 requires installation and instantiation of the network operating system 56. Further, the network operating system 56 operates as a secure executable container that only allows access to an internal executable code, access to an “at-rest” or “in-flight” stored data structure, or access to the secure data network 5 only via one or more of the prescribed APIs 80.
Hence, the network operating system 56 prevents any executable resource in a physical network device 88 (or a user of the physical network device 88) from accessing any unencrypted form of any “at-rest” first secure data structures encrypted and stored by the network operation system 56 in the physical network device 88, without authorized access via a prescribed API 80. The network operating system 56 also prevents any executable resource in the physical network device 88 (or a user of the physical network device 88) from accessing any unencrypted form of any “in-flight” second secure data structures encrypted and stored by the network operation system 56, without authorized access via a prescribed API 80. The network operating system 56 also prevents any executable resource in the physical network device 88 (or a user of the physical network device 88) from accessing the secure peer-to-peer data network, without authorized access via a prescribed API 80 required by the network operating system 56.
Hence, the network operating system 56 establishes a “closed” access system that requires authorized access via one or more of the APIs 80.
As illustrated in
The security policy enforcement 78 provides an enforcement of application-level and user level “manners and semantics” that ensures compliance with digital rights and user relationship rights in the secure private core network 10. In one example, if an errant application (or user) attempted to modify content it did not have rights to (e.g., a user in the federation “F2” 34 attempted to modify content in a message ID 38 generated by the user of the federation “F1” 34 as identified by the federation ID “F1” 18 in the message ID 38), the security policy enforcement 78 can block the attempt to modify the content. As apparent from this example, the security policy enforcement 78 can prevent unauthorized manipulation of media content that has resulted in a proliferation of “deep fake” videos.
The security policy enforcement 78 also provides an enforcement of user digital rights, where at any time a user in the federation “F1” 34 can amend or delete instantaneously any one content item owned by the user (i.e., that includes the corresponding federation ID “F1” as part of its message ID 38): the security policy enforcement 78 can cause all autonomic synchronizers 52 that have a cohort relationship with the federation “F1” to instantly amend or delete the content item identified by its message ID 38.
The security policy enforcement 78 also can enforce various trust levels between an identified cohort, for example a progression from a transient trust (based on location proximity or common interests) to a permanent trust relationship; the security policy enforcement 78 also can enforce a revoked trust (“outcasting”), where the security policy enforcement 78 can respond to a user of the federation “F1” 34 wishing to revoke a relationship with the user of the federation “F2” 34; in this case, the security policy enforcement 78 can provide various warnings regarding revoking a relationship (“outcasting”), including loss of shared data, loss of shared contacts, etc.; as such, the security policy enforcement 78 can encourage dispute resolution between two parties to encourage that societal contracts are fulfilled.
The security policy enforcement 78 also can enforce proper semantic behaviors in the secure private core network 10, including ensuring API calls (by the APIs 80) are presented in the appropriate sequence (i.e., not out-of-order), and that a user of a federation 34 performs social-based operations in the secure private core network 10 in the appropriate order, e.g., a user cannot “join” a conversation without having been invited to join the conversation, and a user cannot “leave” a conversation without first being joined as a member, etc.
Hence, the example implementation 54 can ensure reliable establishment of cohorts, and can enforce security policies that ensure preservation of media rights and maintaining mutual trust between users via their federations 34.
A fundamental problem in the Internet is that prior to deployment of Dynamic Host Configuration Protocol (DHCP), IP addresses at first were allocated (in prescribed address ranges or “blocks”) to organizations, and specific IP addresses could be fixed to a specific location (e.g., an office); hence, an Internet Protocol (IP) address had been used to identify a business, a business location (e.g., office location), a person (e.g., an individual utilizing an office having a network connection), and/or a physical network device (e.g., a personal computer operated by the person within the office and utilizing the network connection). However, the use of DHCP, NAT/PAT, wireless access on a guest network, etc., demonstrates than an IP address does not, in fact, accurately represent any one of a business, a location, a person, or a physical network device.
Another fundamental problem in the Internet is that it is built from its Border Gateway Protocol (BGP) core outward to BGP peers that operate as respective Autonomous Systems (ASs), to establish a BGP mesh network, each AS subdividing out from there toward a network edge; hence, a network is not considered “converged” until any one IP address (source address) can route a data packet to any other destination IP address. In addition to causing scaling problems as more networks and more devices are added to the Internet, this universal reachability from any source IP address to any destination IP address also introduces severe security threats since any “threat device” originating at a “source” IP address can threaten any “target device” at a “destination” IP address. In other words, anyone can obtain unrestricted access to the Internet via a threat device using a “source” IP address, and target devices at destination IP addresses need to expend significant resources to prevent intrusion by the threat device.
These security threats are magnified by orders of magnitude by cloud computing services using data centers worldwide for replication of data for cloud-based services: a successful attack on any one of the millions of IP addresses in use by a cloud computing service has the potential to disrupt the entire worldwide cloud computing service for millions of customers of the cloud computing service. Attempts to implement a “zero trust network” (e.g., at a utility company, a gas pipeline company, etc.) in order to avoid a cyber-attack are ultimately ineffective because a “threat device” still has Internet-based access to numerous entry points within the “zero trust network”, which can be in the range of millions of IP addresses that the zero trust network relies on for cloud-based services: in other words, a zero trust network utilizing cloud-based services can have an attack surface area of over one million IP address.
The secure private core network 10 is implemented with the following security features and operations: the secure private core network 10 can provide full privacy for each endpoint device 12; the secure private core network 10 can ensure free association of users or their associated endpoint devices 12 (i.e., no third party can force a disassociation or disconnection between two associated users that have formed an association between each other); the secure private core network 10 can enable the protection of ownership of all content by users (i.e., user content cannot be “stolen” by another user); and the secure private core network 10 can eliminate the necessity for centralized services, controls, costs, such as found in a cloud-based computing system. The secure private core network 10 also can prevent unauthorized monetization of users' data, and also can facilitate integrated money exchange.
The secure private core network 10 is implemented as a hybrid peer-to-peer overlay network that does not contain any centralized controls as found in a cloud-based computing system; to the contrary, the secure private core network 10 can be composed based on aggregating a large number of small, decentralized, networks that are built by endpoint devices 12 at the “edge” of the network. Moreover, the secure private core network 10 can inherently implement security as a core policy (i.e., a “base tenant” of the secure private core network 10), where each decentralized network has a limited number of network nodes, and every user must “opt-in” before communicating with another network node.
Hence, the secure private core network 10 can initiate a two-device secure data network 5 between two endpoint devices 12 (e.g., between two individuals sharing data between two smart phones via a P2P link), and can aggregate additional devices 12 for eventual formation of a worldwide secure data network.
The secure private core network 10 comprises a single MCP device 14 that is implemented by a physical network device (e.g., an endpoint device 12) such as a user device, or a high-end computing device (e.g., a server device owned by a private network provider such as a 5G service provider, etc.) executing the executable application resource “MCP” 58 illustrated in
The MCP device 14 operates as a prescribed management agent in the secure peer-to-peer data network 5. Hence, only one MCP device 14 is executed in the secure data network 5 at a given time, even though an isolated secure data network 5 can have its own MCP device 14: hence, a physical network device must halt execution of its MCP device 14 prior to joining another secure data network 5 (e.g., executing a merge operation with a larger, pre-existing secure private core network 10 hosted by a 5G service provider). The MCP device 14 can manage subscriptions and registrations by individuals or businesses to the secure data network 5, accounting, load balancing (executed by the load balancer 62), endpoint-replicator assignment (including tracking endpoint—replicator connections for replicator queries), and software update compatibility enforcement. The MCP device 14 also can coordinate with AI-based assist operations provided for example by the AI-based security service 64 (e.g., connection assist using the navigator service 70, salutation assist, conversation assist using the community server 30, revocation assist, zeroization assist, etc.).
The MCP device 14 is connected to each and every replicator device 16, and can maintain a mapping of every endpoint device 12 to a state (either offline or connected to an identified replicator device 16).
The replicator device 16 can be deployed as an executable application layer resource 58 that can be executed on any physical network device. Each replicator device 16 can establish a secure two-way trusted relationship with the MCP device 14 using a prescribed secure salutation protocol that includes negotiation of a public key pair; each replicator device 16 also can establish a secure two-way trusted relationship with all other available replicator devices 16 (using a prescribed secure salutation protocol that includes negotiation of a public key pair) to form a pairwise topology 98 (i.e., one logical hop between each replicator); each replicator device 16 can provide connections between endpoint devices 12 using various secure network transport operations, including crypto tunnelling described below. Hence, each endpoint device 12 can be connected to another endpoint device by zero logical hops (pure peer-to-peer (P2P) connection “A-A1” in
The directory server 28 can be executed by MCP device 14. The directory server 28 is configured for managing ontologies of data structures (e.g., caching intermediate results), storing tags, federation IDs etc. (for projections, e.g., parallel searches by the distributed search (DS) agent 82 of one or more physical network devices such as endpoint devices 12).
The community server 30 can be executed by the MCP device 14 and/or any endpoint device 12; the community server 30 is configured for hosting posts within a public and/or private community in the secure private core network 10.
The guardian service 66 can be executed as part of the secure network services 76 and can manage protection of data during transmission or reception (“in-flight”) and while stored on a machine-readable non-transitory storage medium (“at rest”), including maintaining persistence of endpoint objects 22, conversation objects 42, and message objects 36 according to the associated lifecycle policy “L” 24 and distribution policy “D” 26.
The navigator service 70 can be executed as part of the secure network services 76 and can manage connectivity graphs for how to connect cohorts; the navigator service 70 also can warn the sentinel service 68 of detected threats, and the navigator service 70 can respond to threats detected by the sentinel service 68.
The sentinel service 68 can be executed as part of the secure network services 76 and can detect threats in real time, mitigate against detected threats (e.g., warning user, automatic mitigation operations, etc., notifying the navigator service 70), etc.
The guardian service (i.e., guardian security agent) 66, sentinel service (i.e., sentinel security agent) 68, and navigator service (i.e., navigator security agent) 70 executed as part of the AI-based security service 64 in the secure network services 76 are scalable in that every physical network device can execute the various services 66, 68, and 70 at a scale corresponding to the associated application operations 58 of the physical device executing the associated application layer resources 58; hence, executable agents 66, 68, and 70 operating in one endpoint device (e.g., “A” 12) can securely communicate and share metadata (e.g., feature data such as cyber-attack feature data, wireless network feature data, etc.) with agents operating in other physical network devices (e.g., “R1”, “R100”, the MCP device 14, endpoint device “B” 12) to localize and identify potential threats and prevent any attacks within the secure private core network 10. Hence, the AI-based security service 64 can manage user metadata in order to enhance user security, as opposed to monitoring user metadata for monetizing.
The distributed search (DS) agent 82 can execute projections: in relational algebra a projection refers to a subset of columns of information; hence, a distributed search (DS) agent 82 can apply a subset of information from a data structure (e.g., a federation ID 18, endpoint ID 20, message ID 38, conversation identifier 44, endpoint object 22, message object 36, conversation object 42 or a hypercontent component thereof), to decompose a mapping of a database lookup into a set of queries and subqueries; the generation of a projection enables execution of parallel distributed searches. A projection can be created by a distributed search (DS) agent 82 executed by any physical network device within the secure data network 5. A projection generated by a distributed search (DS) agent 82 can have a defined scope (or “extent”), for example, local, within a federation 34, within a conversation, global, etc.; a projection also can have different types (e.g., one-time, until a deadline, etc.), and can be named with arbitrary names (e.g., contact lookup, signet scan, etc.). Each projection defines an arbitrary number of “projection entries” that are used to match fields using various search techniques, and to select which fields associated with the matches should be returned; the fields can be arbitrary types of information in the secure data network 5 (e.g., signet, endpoint ID 20, email address, tag, message ID 38, conversation identifier 44, titles, names, hypercontent, URLs, etc.), and the values for matches can be exact matches or regular expressions (“regex”) comprising a sequence of characters that have a matching pattern. Each projection entry can select a number of fields that should be returned when matches select information: if no matches are found for a projection entry then no record is returned; for matches, values for the fields selected are returned along with the associated projection entry tag.
Hence, a distributed search (DS) agent 82 can execute a projection that has a scope that limits the extent of a search: the scope can be limited at different locations: for example a scope can limit a search by an endpoint device 12 to a common word usage, old passwords, etc.; a scope can limit a search by a replicator device 16 to GIF image searches, for example; a scope can limit a search by the MCP device 14 to limited fields to preserve privacy of users of the endpoint devices 12, for example limiting searches to a hash of a user email (and not the actual email which is not made available to the MCP device 14), federation ID 18, endpoint ID 20; a scope also can limit a search by the directory server 28 and/or the community server 30. Projections can be executed once, continuously, periodically, until a prescribed “event” deadline (e.g., time expiration, project deadline reached, etc.).
A distributed search (DS) agent 82 also can obtain metadata from other agents executed in the secure private core network 10 to extract feature graphs for assistance in AI-based decisions such as recommendations whether to accept connection requests or conversation requests, keyboard word suggestions, etc.
Hence, the implementation of the secure private core network 10 as a cloudless hybrid peer-to-peer overlay network enables every person and every device to be securely connected, and as such is a realization of “Metcalf's Law” that the value of a telecommunications network is proportional to the square of the number of connected users of the system. The implementation of the secure private core network 10 as a cloudless hybrid peer-to-peer overlay network can extend security features and security operations that mimic social networks without technical constraints, and the use of AI enables the secure private core network 10 to fit policy and interaction requirements of individual users (i.e., people), as opposed to requiring people to adapt to technical constraints.
Hence, the aggregation of two-way trusted relationships in the secure private core network 10 ensures that any attack surface area within the secure data network 5 is limited to two devices at any time, requiring any “threat device” to successfully hack the secure keys of the two peer devices before being able to compromise only the pairwise-encrypted content shared only between the two peer devices; hence, any further attack would require the threat device to successfully hack a next pair of secure keys, etc.
The secure private core network 10 also can include a sensor network comprising one or more sensor devices (e.g., Internet of Things-based sensor devices): each sensor device has a trusted relationship with at least another sensor device, or a trusted relationship with another entity that enables the sensor device to associate with a single individual, a PAN, a room area network, etc.
Depending on implementation, the secure data network 5 can be established as an aggregation of decentralized secure networks. Each decentralized network can be connected to another decentralized network by one or more private dedicated optical fiber connections (“dark fiber pairs”) that are part of a private backbone network: the private backbone network can utilize one or more optical network carriers on diverse fiber paths in order to provide a regionally redundant connectivity over large geographic areas (e.g., providing connectivity between eastern United States, southwest United States, Midwest United States, etc.). Sub-oceanic fiber paths and/or satellite communications also can be used to extend the private backbone network in one geographic region to a worldwide private backbone network. The private backbone network also can be managed by a “bare metal infrastructure” where any server devices executing any network-based operations are single-tenant server devices, i.e., the server devices are reserved for the exclusive use of the private backbone network only, with no use by a third-party tenant permitted (as opposed to existing cloud computing systems that can “share tenants” on a single network device). Further, all data in the private backbone network is always encrypted by default, regardless of whether the data is stored on a non-transitory machine-readable storage medium (i.e., “at rest”), or whether the data is undergoing wired or wireless transmission (i.e., “in transit”).
Each apparatus (e.g., 12, 14, 16, 28, 30, and or 88 of
Any of the disclosed circuits of the devices (e.g., 12, 14, 16, 28, 30, and or 88) (including the device interface circuit 90, the processor circuit 92, the memory circuit 94, and their associated components) can be implemented in multiple forms. Example implementations of the disclosed circuits include hardware logic that is implemented in a logic array such as a programmable logic array (PLA), a field programmable gate array (FPGA), or by mask programming of integrated circuits such as an application-specific integrated circuit (ASIC). Any of these circuits also can be implemented using a software-based executable resource that is executed by a corresponding internal processor circuit such as a microprocessor circuit (not shown) and implemented using one or more integrated circuits, where execution of executable code stored in an internal memory circuit (e.g., within the memory circuit 94) causes the integrated circuit(s) implementing the processor circuit to store application state variables in processor memory, creating an executable application resource (e.g., an application instance) that performs the operations of the circuit as described herein. Hence, use of the term “circuit” in this specification refers to both a hardware-based circuit implemented using one or more integrated circuits and that includes logic for performing the described operations, or a software-based circuit that includes a processor circuit (implemented using one or more integrated circuits), the processor circuit including a reserved portion of processor memory for storage of application state data and application variables that are modified by execution of the executable code by a processor circuit. The memory circuit 94 can be implemented, for example, using a non-volatile memory such as a programmable read only memory (PROM) or an EPROM, and/or a volatile memory such as a DRAM, etc.
Further, any reference to “outputting a message” or “outputting a packet” (or the like) can be implemented based on creating the message/packet in the form of a data structure and storing that data structure in a non-transitory tangible memory medium in the disclosed apparatus (e.g., in a transmit buffer). Any reference to “outputting a message” or “outputting a packet” (or the like) also can include electrically transmitting (e.g., via wired electric current or wireless electric field, as appropriate) the message/packet stored in the non-transitory tangible memory medium to another network node via a communications medium (e.g., a wired or wireless link, as appropriate) (optical transmission also can be used, as appropriate). Similarly, any reference to “receiving a message” or “receiving a packet” (or the like) can be implemented based on the disclosed apparatus detecting the electrical (or optical) transmission of the message/packet on the communications medium, and storing the detected transmission as a data structure in a non-transitory tangible memory medium in the disclosed apparatus (e.g., in a receive buffer). Also note that the memory circuit 94 can be implemented dynamically by the processor circuit 92, for example based on memory address assignment and partitioning executed by the processor circuit 92.
The operations described with respect to any of the Figures can be implemented as executable code stored on a computer or machine readable non-transitory tangible storage medium (i.e., one or more physical storage media such as a floppy disk, hard disk, ROM, EEPROM, nonvolatile RAM, CD-ROM, etc.) that are completed based on execution of the code by a processor circuit implemented using one or more integrated circuits; the operations described herein also can be implemented as executable logic that is encoded in one or more non-transitory tangible media for execution (e.g., programmable logic arrays or devices, field programmable gate arrays, programmable array logic, application specific integrated circuits, etc.). Hence, one or more non-transitory tangible media can be encoded with logic for execution by a machine, and when executed by the machine operable for the operations described herein.
In addition, the operations described with respect to any of the Figures can be performed in any suitable order, or at least some of the operations in parallel. Execution of the operations as described herein is by way of illustration only; as such, the operations do not necessarily need to be executed by the machine-based hardware components as described herein; to the contrary, other machine-based hardware components can be used to execute the disclosed operations in any appropriate order, or at least some of the operations in parallel.
The example embodiments enable the secure establishment of universally-unique identities in a secure peer-to-peer data network 5 that is established based on an aggregation of two-way trusted relationships, all under the control of the AI based security suite 64. The secure establishment of universally-unique identities is based on establishing a unique federation identifier for a “requesting party” (e.g., user, business entity, etc.) once a two-way trusted relationship has been established between the requesting party and the secure peer-to-peer data network, and establishing a permanent and unique endpoint identifier for a network device used by the requesting party for joining the secure peer-to-peer data network. The endpoint identifier is associated with the federation identifier to establish that the requesting party has ownership of the corresponding network device, where the “ownership” establishes a two-way trusted relationship between the requesting party and the corresponding network device based on the requesting party retaining possession and control of the network device; hence, the endpoint identifier (associated with the federation identifier) can uniquely identify the network device in the secure peer-to-peer data network as an “endpoint device” that is associated with the requesting party based on a two-way trusted relationship between the requesting party and the endpoint device.
The requesting party can add additional network devices as distinct endpoint devices that are associated with the federation identifier based on a corresponding two-way trusted relationship between the requesting party and the corresponding network device, under the control of the AI based security suite. Hence, a requesting user can aggregate a “federation” of trusted endpoint devices for use within the secure peer-to-peer data network.
Moreover, each endpoint device can uniquely and securely identify itself based on the AI based security suite cryptographically generating a secure private key and a corresponding secure public key associated with the requesting party utilizing the endpoint device. Hence, data storage in each and every network device in the secure peer-to-peer data network, as well as all network communications between each and every network device, can be secured by the guardian security agent based on sharing secure public keys between endpoint devices having established a two-way trusted relationship based on a secure verification of membership within the same “federation” according to a prescribed secure salutation protocol under the control of the AI based security suite.
The following description summarizes the establishment of the secure peer-to-peer data network 5 as a trusted aggregation of two-way first-party trusted relationships, also referred to as “cohorts”. Each two-way first-party trusted relationship requires a requesting party “X” to send a relationship request directly to a recipient party “Y” (the first “way” of the two-way first-party trusted relationship), i.e., no “requesting agent” can act on behalf of the requesting party “X” without explicit authorization from the requesting party “X” to send the request; similarly, no “receiving agent” can act on behalf of a recipient party “Y” without explicit authorization from the recipient party “Y”. The relationship request can include a secure public key “Key_X” associated with the requesting party “X” (i.e., the requesting party “X” owns a private key “prvKey_X” corresponding to the secure public key “Key_X”), as opposed to relying on any trust in a secure certificate issued by a third party certifying authority. The recipient party “Y” can decide to accept the request or deny the request; if the recipient party “Y” decides to accept the relationship request, the recipient party “Y” can store the secure public key “Key_X” and send to the requesting party “X” an acknowledgment that contains the secure public key “Key_Y” of the recipient party “Y” (i.e., the recipient party “Y” owns a private key “prvKey_Y” corresponding to the secure public key “Key_Y”). The acknowledgment can be encrypted using a temporal key generated by the recipient party “Y”: the recipient party can encrypt the temporal key using the secure public key “Key_X”, and add to the encrypted acknowledgment (containing the secure public key “Key_Y”) the encrypted temporal key. Encryption can be executed, for example, using data encryption standard (DES), TripleDES, RSA, Advanced Encryption Standard (AES), ECIES, etc.
Hence, the requesting party “X”, in response to receiving the encrypted acknowledgment containing the encrypted temporal key, can recover the temporal key based on decryption using the corresponding private key “prvKey_X”, and decrypt the encrypted acknowledgment using the recovered temporal key to obtain the secure public key “Key_Y”. Hence, the two-way first-party trusted relationship between the parties “X” and “Y”, or “cohort” between “X” and “Y”, can be securely maintained based on the secure storage of data (“at rest”) using the key pairs “Key_X” and “Key_Y”; secure communications between the endpoint devices 12 associated with the cohort “X” and “Y” also can be secured based on encrypting each data packet prior to transmission using a temporal key, where the temporal key also is encrypted (using the key of the destination device) to form an encrypted temporal key that is supplied with the encrypted data packet for decryption at the destination.
The aggregation of cohorts between two endpoint devices 12 (pairs of pairs of pairs) ensures that the attack surface area in the secure data network 5 is no more than two (“2”) devices, regardless of the size of the secure data network 5. Use of encrypted temporal keys ensures that every transmitted data packet has a different key needed for decryption following transmission. Every data structure stored in the secure data network 5 has a different encryption with a different key, such that the “prize” for hacking a stored data file is only the one hacked data file.
A new subscriber “P1” as a “requesting party” can enter via the device interface circuit 90 of the physical network device 88a a command that causes the processor circuit 92 to start (“instantiate”) the executable application executing the secure private core network operations 56 on the physical network device 88a as an endpoint device “A” 12, causing an account management service executed in the secure network services 76 to prompt the new subscriber “P1” to register by entering an external network address such as a valid email address of the new subscriber “P1” (e.g., “P1@AA.com”), a mobile number used to receive text-based or image-based messages, etc., where the external network address is used by the requesting party “P1” for reachability via an external data network 96 distinct from the secure peer-to-peer data network 5.
In response to the secure network services 76 (executed by the processor circuit 92 in the physical network device 88a) receiving in the request by the user “P1” to register the physical network device 88a as an endpoint device “A” 12, including the external network address (e.g., “P1@AA.com”) of the user “P1”, the processor circuit 92 of the physical network device 88a executing the account management service in the secure network services 76 on the endpoint device “A” 12 can respond to the external network address entry (e.g., email address) by causing the secure network services 76 to generate a unique private key “prvKeyP1_A” and a corresponding secure public key “KeyP1_A” for the requesting party “P1” on the new endpoint device “A” 12. The account management service executed in the secure network services 76 by the processor circuit 92 on the endpoint device “A” 12 can generate and send a registration request (containing the secure public key “KeyP1_A” and the external network address (e.g., email address “P1@AA.com”)) 106a to a prescribed destination 108 associated with the secure private core network 10 (e.g., a destination email address “registerme@whitestar.io” owned by the secure private core network 10) that is reachable outside the secure private core network 10 via the external data network 96 (e.g., the Internet, a 5G carrier, etc.). Hence, the device interface circuit 90 of the physical network device 88a can output, via the external data network 96, the registration request 106a received from the processor circuit 92 executing the NOS 56 for transmission, via the external data network 96, to a physical network device 88b hosting a messaging service (e.g., email server “@AA.com”) for the subscriber “P1”; the messaging server 88b can forward the message 106a, via the external data network 96, to a physical network device 88c hosting a messaging service (e.g., email server “@whitestar.io”) associated with the secure private core network 10 of the secure peer-to-peer data network 5.
The prescribed destination 108 of the registration request 106a can be hosted by the same physical network device 88c receiving the registration request 106a from the transmitting messaging server 88b or a different physical network device (e.g., 88d) in the secure private core network 10 (e.g., within a replicator device 16). The physical network device (e.g., 88c or 88d) hosting the prescribed destination 108 can cause its processor circuit 92 to execute a distributed search (DS) agent 82 in order to execute fraud control using the AI-based security service 64, including determining whether the external network address (e.g., email address “P1@AA.com”) specified in the registration request 106a has been previously been used for any registration in the secure private core network 10, whether the external network address has been previously outcasted or “banned” by another subscriber or any AI-based security service 64 as owned by an untrusted party, etc.; the distributed search (DS) agent 82 (executed in the physical network device 88c or 88d) having received the registration request 106a can limit the scope in the availability of the external network address to prevent the MCP device 14 from obtaining any external network address (e.g., email address) “in the clear”, for example based on limiting any validation of email addresses to only hashes of email addresses, described below.
In response to detecting that the external network address (e.g., email address) in the registration request is a new external network address and does not appear to be fraudulent, the distributed search (DS) agent 82 (executed in the physical network device 88c or 88d) that executed the fraud control can validate that the external network address can be trusted: in response, the distributed search (DS) agent 82 can cause the secure private core network 10 to generate and send a validation response (e.g., email message, text message, etc.) 114a to the external network address of the new subscriber “P1” (e.g., email “P1@AA.com” hosted by the physical network device 88b) via the external data network 96, where the validation message 114a can include the secure public key “KeyP1_A” generated by the secure network services 76 on the new device “A” 12: the secure public key “KeyP1_A” supplied in the registration request can be expressed in the validation message 114a in different forms, for example a QR code, a URL, or a text string.
Hence, the new subscriber “P1” can utilize the physical network device 88a (or another physical network device 88, as appropriate) to retrieve the validation response from the messaging server 88b “out of band” (i.e., outside the secure private core network 10): the validation response 114a specifies instructions enabling the new subscriber “P1” to submit the secure public key “KeyP1_A” for validation by the secure network services 76 executed on the new device “A” 12, for example in the form of a machine readable QR code, a URL link, or a machine-readable text string.
In response to the secure network services 76 executed on the new device “A” 12 (by the processor circuit 92 of the physical network device 88a) verifying the secure public key “KeyP1_A” in the validation response 114a sent to the to the external network address of the new subscriber “P1” (e.g., “P1@AA.com”), the secure network services 76 can verify the identity of the new subscriber “P1” using the new device “A” 12 as a legitimate owner of the external network address (e.g., “P1@AA.com”) that has been determined as trusted through the above-described fraud control testing. The secure network services 76 executed on the new device “A” 12 also can respond to verifying the secure public key “KeyP1_A” by registering the physical network device 88a as the endpoint device “A” 12 based on auto-generating (crypto-generating) a verified identity in the form of a federation ID “F1” 18 that is allocated to the email address “P1@AA.com” used by the subscriber “P1”, thereby establishing a trusted relationship between the trusted email address “P1@AA.com” and the endpoint device “A” 12. The network operating system 56 executed in the endpoint device “A” 12 (within the physical network device 88a) executes registration also based on prompting the new subscriber “P1” to create a new password for entry into the secure data network 5, and by auto-generating (crypto-generating) an endpoint ID 20 for the endpoint device “A” 12 that is a 128 bit UUID (e.g., “EID_A”; “E1” in
If the physical network device 88a is to be shared with a second user (e.g., “P3”), then the network operating system 56 can establish a second “profile” for the second user “P3”, enabling the second user “P3” to register via the identity management system as described herein for creation of a different federation ID (e.g., “F6”) 18 and a different endpoint ID (e.g., “E6”) 20 for the same physical network device; in this case, the endpoint object 22 specifying the endpoint ID (e.g., “E6”) 20 for the physical device used by the second user “P3” can include a reference indicating the physical network device is shared separately by two federations (e.g., “F1” and “F6”); as apparent from the foregoing, there is no sharing between the two federations sharing the same physical network device unless a two-way trusted relationship is established between the two federations (e.g., “F1” and “F6”) according to the prescribed secure salutation protocol.
Hence, the network operating system 56 executed in the endpoint device “A” 12 (by the processor circuit 92 of the physical network device 88a) can store in the memory circuit 94 of the endpoint device “A” 12 a federation object 32 that comprises the federation ID 18 and the endpoint object 22 having an endpoint ID “E1” 20 that uniquely identifies the endpoint device “A” 12 in the secure private core network 10. The federation object 32 stored in the endpoint device “A” 12 identifies the federation “F1” 34 within the secure private core network 10.
The network operating system 56 executed in the endpoint device “A” 12 also can generate a cryptographic nonreversible hash of the external network address (e.g., email address “P1@AA.com”), for example “HASH[P1@AA.com]”, that is considered in the secure private core network 10 an acceptable identifier for the federation 34 that is also identified by the federation ID “F1”. The nonreversible hash of the external network address guarantees anonymity of the user “P1” while maintaining absolute identity control; hence, an email address of an existing federation 34 can be protected against subsequent registration requests based on utilizing the nonreversible hash of the email address.
The network operating system 56 executed in the endpoint device “A” 12 can identify the MCP device 14 as a prescribed management agent in the secure peer-to-peer data network 5, establish a connection with the MCP device 14 (e.g., via an IPv4 and/or IPv6 address that is created and/or obtained by the network operating system 56 executed in the endpoint device “A” 12), and generate and supply in operation 124 a registration message 126a comprising its cryptographic nonreversible hash (e.g., its hashed email address “HASH[P1@AA.com]”), its federation ID “F1” 18, and its endpoint ID “EID_A” that is owned by the federation ID “F1” (e.g., “HASH[P1@AA.com]→F1” and “F1→[‘EID_A’]”) (the network operating system 56 executed in the endpoint device “A” 12 also can include its public key “KeyP1_A”). The registration message 126a also can include one or more network addresses (e.g., IPv4/IPv6 addresses) obtained and used by the endpoint device “A” 12 for communications via a data network 96 as a multi-hop transport layer (60 of
The processor circuit 92 of the physical network device 88e executing the MCP device 14 can respond to receiving the registration message 126a by causing its distributed search (DS) agent (82 of
In response to the distributed search (DS) agent 82 finding no other matches, the MCP device 14 in operation 132 can register the new federation 34. Hence, the registration message 126a enables the MCP device 14, as the prescribed management agent for the secure data network 5, to associate the federation ID “F1” 18 as owning the cryptographic hash “HASH[P1@AA.com]” and the endpoint identifier “EID_A” 20; the registration message 126a further enables the MCP device 14 to associate the secure public key “KeyP1_A” with the endpoint identifier “EID_A” 20 owned by the federation ID “F1” 18. As described below, the registration message enables the MCP device 14 to generate and store in operation 132 a data structure, referred to as a device identity container or “signet”, that comprises the secure public key “KeyP1_A” of the endpoint device “A” 12, the “alias” used by the endpoint device “A” 12, a list of one or more network addresses (e.g., IPv4/IPv6 addresses) usable by the endpoint device “A” 12 for communications via an underlying data network 96 used as a multi-hop transport layer 60, and the endpoint ID “EID_A” 20 of the endpoint device “A” 12. Hence, the “signet” for the endpoint device “A” can provide a secure identification of the endpoint device “A” 12 that belongs to the federation “F1” 34 in the secure data network 5. If desired, the “signet” for the endpoint device “A” 12 also can include the federation ID “F1” 18.
In an alternate embodiment, the network operating system 56 executed in the endpoint device “A” 12 can generate the “signet” (containing the secure public key “KeyP1_A”, the alias associated with the secure public key “KeyP1_A”, the endpoint ID “EID_A”, and any IPv4/IPv6 addresses in use by the endpoint device “A”, and optionally the Federation ID “F1” 18), and include the “signet” in the secure registration request 126 sent to the MCP device 14 in operation 124. The MCP device can cause the projection search as described previously to verify the federation ID “F1” 18 is not already registered.
The MCP device 14, in response to determining there are no matches on the supplied identifiers “HASH[P1@AA.com]”, “F1” 18 and/or “EID_A” 20 (indicating an absence of any previous use of the cryptographic nonreversible hash), can acknowledge the registration message based on generating and sending to the endpoint device “A” 12 a secure registration acknowledgment 136 indicating that there are no other endpoints, and can include an “MCP signet” (containing at least the public key “Key_MCP” and corresponding alias of the MCP device 14, and optionally the endpoint ID and IPv4/IPv6 addresses) and the “A” signet of the endpoint device “A” for distribution to other network devices, described below; the MCP device 14 can encrypt at least the public key “Key_MCP” (and optionally the “MCP” signet and the “A” signet) with a temporal key (resulting in the encrypted data structure “ENC(Key_MCP)”), encrypt the temporal key with the secure public key “KeyP1_A” of the endpoint device “A” 12, and supply the encrypted temporal key “ENC(TK)” in the secure registration acknowledgment 136 with the encrypted data structure “ENC(Key_MCP)” to the endpoint device “A” 12. The supplied identifiers “HASH[P1@AA.com]”, “F1” and “EID_A” also can be supplied by the MCP device 14 to the directory server 28 for subsequent projection searches in the secure private core network 10.
The network operating system 56 of the endpoint device “A” 12 can receive the secure registration acknowledgment 136 containing a first encrypted portion (“ENC(TK)”) and a second encrypted portion “ENC(Key_MCP)”. The supply of the encrypted temporal key “ENC(TK)” with the encrypted acknowledgment “ENC(Key_MCP)” in the secure registration acknowledgment 136 enables the network operating system 56 executed in the endpoint device “A” 12 to decrypt the temporal key “TK” using its private key “prvKeyP1_A”, decrypt the acknowledgment using the decrypted temporal key “TK”, and obtain the secure public key “Key_MCP” of the MCP device 14. Hence, the sharing of secure public keys between the endpoint device “A” 12 and the MCP device 14 establishes a two-way trusted relationship between the endpoint device “A” 12 and the MCP device 14 in the secure private core network. If received from the MCP device 14, the network operating system 56 of the endpoint device “A” 12 can store the “MCP” signet for subsequent communications with the MCP device 14, and can further store the “A” signet for distribution to other devices for initiating the secure salutation protocol, described below.
Hence, at this stage the federation object 32 contains only the endpoint object 22 having an endpoint ID “E1” 20 that uniquely identifies the endpoint device “A” 12 used for initial registration with the secure private core network 10.
The same user “P1” can register a physical network device 88f as a new device “A1” 12 based on installing and instantiating the network operating system 56 on the physical network device 88f, and entering the same external network address (e.g., email address “P1@AA.com”) of the subscriber “P1” in response to a prompt by the account management service executed in the secure network services 76 of the network operating system 56; the account management service executed in the secure network services 76 on the physical network device 88f can respond to reception of the external network address (e.g., email address “P1@AA.com”) by causing the secure network services 76 to generate a unique private key “prvKeyP1_A1” and a public key “KeyP1_A1” for the user “P1” on the new device “A1” 12, and generate and send the registration request (containing the secure public key “KeyP1_A1”) 106b to the prescribed destination (e.g., “registerme@whitestar.io”) 108 associated with the secure peer-to-peer data network 5.
As described previously, receipt of the registration request 106b causes a physical network device (e.g., 88c or 88d) executing the distributed search (DS) agent 82 in the secure per-to-peer data network 5 to execute fraud control, for example based on determining an inordinate number of registration requests 106. The distributed search (DS) agent 82, having received the registration request, can limit the scope of searching the external network address (e.g., the email address) to prevent the MCP device 14 from obtaining the external network address “in the clear”, and can generate and send a validation response 114b to the external network address (e.g., email address “P1@AA.com”) of the subscriber “P1”, where the validation response can include the secure public key “KeyP1_A1” generated by the secure network services 76 on the new device “A1” 12.
The subscriber “P1” can receive the validation response 114b that specifies instructions (e.g., QR code, URL, text string, etc.) for submitting the included secure public key “KeyP1_A1” for validation. In response to the secure network services 76 executed on the new device “A1” 12 verifying the secure public key “KeyP1_A1” in the validation response 114b, the secure network services 76 executed on the new device “A1” 12 can (temporarily) auto-generate a federation ID “FA1” 18 that is allocated to the external network address (e.g., email address “P1@AA.com”) used by the subscriber “P1”, establishing a secure relationship between the external network address (e.g., email address “P1@AA.com”) and the endpoint device “A1” 12. The network operating system 56 executed in the endpoint device “A1” 12 also can respond to verifying the secure public key “KeyP1_A1” in the validation response 114b by prompting the subscriber “P1” to create a new password for entry into the secure data network 5 via the new device “A1” 12, and by auto-generating (crypto-generating) an endpoint ID 20 for the endpoint device “A1” 12 that is a 128 bit UUID (e.g., “E2” in
Hence, the network operating system 56 executed in the endpoint device “A1” 12 can store in the memory circuit 94 of the endpoint device “A1” 12 the federation object 32 that comprises the endpoint object 22 specifying the federation ID “FA1” 18 and having an endpoint ID (e.g., “EID_A1”) 20 that uniquely identifies the endpoint device “A1” 12 in the secure private core network 10. The federation object 32 stored in the endpoint device “A1” 12 identifies the federation ID “FA1” 18 within the secure private core network 10.
The network operating system 56 executed in the endpoint device “A1” 12 also can generate a cryptographic nonreversible hash of the external network address (e.g., the email address “P1@AA.com”), e.g., “HASH[P1@AA.com]”, connect to the MCP device 14 (e.g., via an IP address that is made available to the network operating system executed in the endpoint device “A1” 12), and supply a registration message 126b (operation 124 of
The registration message 126b generated by the endpoint device “A1” 12 can specify the cryptographic nonreversible hash “HASH[P1@AA.com]”, its federation ID “FA1” 18, and its endpoint ID “EID_A1” that is owned by the federation ID “FA1” (e.g., “HASH[P1@AA.com]→FA1” and “FA1→[‘EID_A1’]”) (the network operating system 56 executed in the endpoint device “A” 12 also can include its public key “KeyP1_A1”). The network operating system 56 executed in the endpoint device “A1” 12 also can add to the registration message 126b one or more network addresses used for communications via an underlying data network 96 used as a multi-hop transport layer (60 of
The MCP device 14 can respond to reception of the registration message from the endpoint device “A1” 12 by causing its distributed search (DS) agent 82 to execute in operation 130 of
In response to determining a match on the cryptographic nonreversible hash “HASH[P1@AA.com]”, the distributed search (DS) agent 82 can cause the MCP device 14 to generate an “A1” signet containing the public key “KeyP1_A1”, the corresponding alias for the public key “KeyP1_A1”, the endpoint ID “EID_A1”, and the list of zero or more IPv4/IPv6 addresses for reaching the endpoint device “A1”. The MCP device 14 can generate and output to the endpoint device “A1” 12 in operation 142 a secure endpoint acknowledgment 144 indicating another endpoint device “A” 12 exists in its federation 34; the acknowledgment can include the “A” signet of the endpoint device “A” 12 that is already a member of the same federation 34, the “A1” signet for use by the endpoint device “A1” 12 for sharing with other network devices, and the “MCP” signet of the MCP device 14. As described previously, the “A” signet of the endpoint device “A” 12 can include: the secure public key “KeyP1_A” of the endpoint device “A” 12, an “alias” used by the endpoint device “A” 12, reachability information such as a list of one or more IPv4/IPv6 addresses usable by the endpoint device “A” 12, and the endpoint ID 20 of the endpoint device “A” 12.
As described previously, the MCP device 14 can encrypt the endpoint acknowledgment (containing the “A” signet of the endpoint device “A” 12, the “A1” signet of the endpoint device “A1” 12, and at least the secure public key “Key_MCP” or the “MCP signet) with a temporal key, encrypt the temporal key with the secure public key “KeyP1_A1” of the endpoint device “A1” 12, and supply the encrypted temporal key in the secure endpoint acknowledgment 144 to the endpoint device “A1” 12. The supplied identifiers “HASH[P1@AA.com]”, “F1” and “EID_A1” also can be supplied to the directory server 28 for subsequent projection searches in the secure private core network 10.
The encrypted temporal key in the secure endpoint acknowledgment 144 received by the endpoint device “A1” 12 enables the guardian security agent 66 in the network operating system 56 executed in the endpoint device “A1” 12 to decrypt the temporal key, decrypt the acknowledgment, and obtain at least the secure public key “Key_MCP” of the MCP device 14 (and optionally the “MCP” signet).
The guardian security agent 66 in the network operating system 56 executed in the endpoint device “A1” 12 can respond to the decrypted acknowledgment (specifying another endpoint is a member of the same federation 34, and that contains the “A” signet for the endpoint device “A” 12 and the “A1” signet) by initiating a prescribed secure salutation protocol with the endpoint device “A” 12. In particular, the secure network service 76 executed in the endpoint device “A1” 12 can generate and send, based on the received “A” signet and “A1” signet, a secure salutation request 148 that contains the “A1” signet identifying its endpoint ID “EID_A1” 20 and requesting a relationship with the endpoint device “A” 12; the salutation request can be encrypted using the secure public key “KeyP1_A” of the endpoint device “A” 12; as described previously, the “A1” alias included with the salutation request can include the alias (associated with the secure public key “KeyP1_A”), and also can include the secure public key “KeyP1_A1” of the endpoint device “A1” 12, and optionally the IPv4/IPv6 addresses for reaching the endpoint device “A1” 12.
The endpoint device “A” 12 can “automatically” respond back with the endpoint device “A1” 12, for example the network operating system 56 executed in the endpoint device “A1” 12 can infer that the endpoint device “A” 12 and the endpoint device “A1” 12 are in the same federation based on a determined match of the hashed external network addresses (e.g., email addresses: for example, a search by a distributed search (DS) agent 82 on a hash of the email address can return the endpoint IDs for both the endpoint device “A” 12 and the endpoint device “A1” 12.
Hence, the network operating system 56 executed in the endpoint device “A” 12 can respond to the salutation request by sending a secure salutation reply (e.g., a salutation acceptance) 150 that includes the endpoint object 22 of the endpoint device “A” 12: the salutation reply 150 can be encrypted as described above using a temporal key that is further encrypted using the secure public key “KeyP1_A1”, for formation of a secure salutation reply (e.g., secure salutation acceptance). The network operating system 56 executed in the endpoint device “A” 12 also can store the “A1” signet.
Hence, the network operating system 56 executed in the endpoint device “A1” 12 can determine from the endpoint object 22 of the endpoint device “A” 12 specified in the secure salutation reply 150 received that the endpoint object 22 specifies a federation ID “F1” 18: the federation ID “F1” 18 in the endpoint object 22 in the salutation acceptance 150 causes the network operating system 56 in the endpoint device “A1” 12 to determine that the endpoint device “A” 12 pre-existed in the secure private core network 10; hence, the network operating system 56 in the endpoint device “A1” 12 can establish a two-way trusted relationship with the endpoint device “A” 12 based on exchange of the public keys “KeyP1_A” and “KeyP1_A1”, and in response re-associate its federation ID from “FA1” to “F1” in its endpoint object 20, and discard the initial federation ID “FA1”. Consequently, the network operating system 56 in the endpoint device “A1” 12 adopts the federation ID “F1” 18, thus establishing the identity of the owner of the devices “A” and “A1” as federation“F1” 34. Hence, the endpoint device “A1” 12 in its corresponding endpoint object 22 adopts the identity, user name, user image, etc. of the same user as in the endpoint device “A” 12 (as identified by its corresponding endpoint ID 20).
Hence, the secure private core network 10 can establish that the federation “F1” 34 owns the endpoint devices “A” and “A1” 12; moreover, a cohort is established between the endpoint devices “A” and “A1” 12 based on sharing cryptographic keys, such that any content created on one endpoint (e.g., endpoint device “A” 12) can be autonomically and securely replicated to the other endpoint (e.g., endpoint device “A1” 12) by the autonomic synchronizer 52. Since the synchronization process in the secure private core network 10 is aware of all the federations 34, any connection by an existing endpoint device 12 in a federation 34 to a new endpoint device 12 or a new federation 34 can cause autonomic replication of the connection to the other devices in the existing federation 34 or the new federation 34 by the associated autonomic synchronizer 52.
According to example embodiments, an identity management system can utilize signets for establishment of two-way trusted relationships in a secure peer-to-peer data network based on ensuring each identity is verifiable and secure, including each federation identity that creates a verified association with an identified external network address used by a requesting party, and each endpoint identifier that is cryptographically generated and associated with a federation identity, enabling a federation identity to own numerous endpoint identifiers for aggregation of two-way trusted relationships in the secure peer-to-peer data network. Additional details regarding the identity management system are disclosed in commonly-assigned, copending application Ser. No. 17/343,268, filed Jun. 9, 2021, entitled “IDENTITY MANAGEMENT SYSTEM ESTABLISHING TWO-WAY TRUSTED RELATIONSHIPS IN A SECURE PEER-TO-PEER DATA NETWORK”, the disclosure of which is incorporated in its entirety herein by reference.
Device identity containers (“signets”) also can be used for establishing the secure storage and transmission of data structures across different “federations” of network devices, including endpoint devices (established by different users having established respective two-way trusted relationships with the secure peer-to-peer data network), and replicator devices, according to the prescribed secure salutation protocol under the control of the AI based security suite 64. Hence, crypto-signed switching can be enabled between two-way trusted network devices in a secure peer-to-peer data network, according to the prescribed secure salutation protocol under the control of the AI based security suite. Additional security-based operations can be deployed in a scalable manner in the secure peer-to-peer data network, based on the distributed execution of the AI-based security suite 64.
The guardian security agent 66 can secure (i.e., encrypt) all “at-rest” data structures as first secure data structures for secure storage in the network device, for example based on encrypting each “at-rest” data structure with a corresponding private key: for example, the guardian security agent 66 executed in the endpoint device “A” 12 can secure the “at-rest” data structures using the private key “prvKeyP1_A” that can be dynamically generated by the guardian security agent 66 during initialization of the network operating system 56. The guardian security agent 66 (executed, for example, by the endpoint device “A” 12) also can secure “in-flight” data structures as second secure data structures based on dynamically generating a temporal key “TK”, and encrypting the temporal key 68 with a public key (e.g., “Key_B”) of a destination device (e.g., the endpoint (device “B” 12, ensuring secure communications in the secure peer-to-peer data network 5. Additional details regarding encrypting “at rest” data structures and “in-flight” data structures are described below, and are also disclosed in the above-incorporated U.S. Publication No. 2021/0028940.
In particular, the guardian security agent 66 of a source network device (e.g., an endpoint device “A” 12) can encrypt an “in-flight” data packet into a secure data packet based on dynamically generating a unique temporal key (e.g., “TK”) used for encrypting a data packet payload into an encrypted payload, and encrypting the unique temporal key into an encrypted temporal key (e.g., “ENC(Key_B)[TK]”) using a secure public key (e.g., “Key_B”) of a destination device (e.g., endpoint device “B” 12) identified within a destination address field (e.g., “DEST=B”). In other words, the guardian security agent 66 of the source endpoint device dynamically generates a new temporal (e.g., time-based) key “TK” for each secure data packet to be transmitted, ensuring no temporal key is ever reused; moreover, the encrypted temporal key ensures that only the destination device can decrypt the encrypted temporal key to recover the temporal key used to encrypt the payload.
The guardian security agent 66 of a source network device (e.g., an endpoint device “A” 12) also can digitally sign the packet (containing the encrypted payload and encrypted temporal key) using the endpoint device A's private key “prvKeyP1_A” to generate a source endpoint signature. Hence, the guardian security agent 66 can generate the secure data packet for secure “in-flight” communications in the secure peer-to-peer data network 5.
The source endpoint signature generated by the guardian security agent 66 in the source network device (e.g., the endpoint device “A” 12) enables the guardian security agent 66 of a receiving network device (e.g., the replicator device “R1” 16, and/or the endpoint device “B” 12 of
Hence, the guardian security agent 66 of a receiving network device (e.g., the replicator device “R1” 16 or the endpoint device “B” 12 in
The guardian security agent 66 of each of the replicator devices “R1” and “R100” 16 also can enforce crypto-signed switching based on validation of a replicator signature. In particular, following validation of the secure data packet 158, the guardian security agent 66 of the replicator device (e.g., “R1”) 16 can cryptographically sign the secure data packet, using its private key “prvKey_R1” to generate a replicator signature for secure transmission to its trusted peer replicator device “R100” 16 as a secure forwarded packet (e.g., 164a) containing the secure data packet (e.g., 158a) and the replicator signature, ensuring no network node 162 in the underlying external data network 96 can decrypt the secure data packet (e.g., 158a) contained in the secure forwarded packet (e.g., 164a).
Similarly, the guardian security agent 66 of a replicator device (e.g., “R100”) 16 can determine that the cryptographically-signed secure forwarded packet (e.g., 164a of
Hence, the guardian security agent 66 can validate identities for establishment and enforcement of all two-way trusted relationships, including during execution of the prescribed secure salutation protocol as described previously.
The secure network services 76 executed in each physical network device 88 also includes a sentinel service 68. The sentinel service 68 is implemented in each physical network device 88 as executable code (e.g., an executable “agent”) within the secure network services 76; hence, the sentinel service 68 also can be referred to herein as a sentinel agent 68.
The navigator security agent 70 of an endpoint device (e.g., the endpoint device “A” 12) can enable secure communications to be established through a firewall (e.g., “FW1” 152 of
In particular, the crypto-signed switching described herein is based on the MCP device 14, as the prescribed management agent in the secure peer-to-peer data network 5, tracking a connection status 160 of every network device in the secure peer-to-peer data network 5, including each endpoint device 12 and each replicator device 16. The MCP device 14 establishes a pairwise topology (e.g., a mesh) 98 of two-way trusted replicator devices 16 based on causing the guardian security agent 66 of each replicator device 16, during registration with the MCP device 16, to execute a prescribed secure salutation protocol with each and every other replicator device 16 in the secure private core network 10.
The replicator device “R1” 16 upon joining the secure private core network 10 can generate for itself a secure private key “prvKey_R1” and a corresponding public key “Key_R1”. The replicator device “R1” 16 can securely register with the MCP device 14 as described previously.
The processor circuit 92 of the physical network device 88e executing the MCP device 14 can update a table of connection status entries 160 of all endpoint devices 12 registered with the secure private core network 10; the table also can store connection status entries 160 for registered replicator devices 16. Each connection status entry 160 for an endpoint device 12 can specify a corresponding next-hop replicator identifier (if available) for each corresponding endpoint device 12, or an “offline” state indicating the endpoint device 12 is not reachable in the secure data network 5. The connection status entry 160 enables the MCP device 14 to identify a replicator device 16 that an endpoint device 12 should connect to (e.g., based on load balancing, locality, etc.). As described below, the connection status entries 160 enables the MCP device 14 to identify a “next hop” replicator device for reaching a destination endpoint device 12. Since the MCP device 14 is attached to every replicator device 16, each replicator device 16 has a corresponding connection status entry 160.
Hence, the MCP device 14 can respond to the secure registration of the replicator device “R1” 16 by sending a secure acknowledgment: the secure acknowledgment can contain one or more signets (e.g., the “R100” signet and the “R1” signet) containing secure public keys of existing replicator devices (e.g., “R100”).
In response to receiving the secure acknowledgement containing the “R100” signet, the network operating system 56 executed in the replicator device “R1” can establish a two-way trusted relationship with at least the replicator device “R100” 16 using its corresponding “R100” signet containing its corresponding public key “Key_R100”, enabling formation of the pairwise topology 98 of two-way trusted replicator devices 16.
In particular, the processor circuit 92 of the physical network device 88 executing the replicator device “R1” 16 can validate the secure acknowledgment as described herein, and establish a two-way trusted relationship with the replicator device “R100” 16 according to the prescribed secure salutation protocol by sending a secure salutation request using the public key “Key_R100”; the replicator device “R1” 16 also can include in the secure salutation request its “R1” signet containing its public key “Key_R1”. The replicator device “R100” 16 in response can either automatically accept the secure salutation request (based on decrypting using its private key “prvKey_R100”, and based on and the replicator device “R100” 16 receiving the “R1” signet from the MCP device 14), alternately the replicator device “R100” 16 can verify with the MCP device 14 that the replicator device “R1” 16 is a trusted replicator device, and in response generate and send to the replicator device “R1” 16 a secure salutation reply for establishment of the two-way trusted relationship between the replicator device “R1” 16 and the replicator device “R100” 16.
The replicator device “R1” 16 can repeat the establishing of a two-way trusted relationship with each and every available replicator device 16, based on a corresponding signet received from the MCP device 14.
Hence, according to example embodiments the device identity containers (“signets”) provide a secure identification of replicator devices “R1” to “R100” 16, for establishment of two-way trusted relationships between the replicator devices 16 and formation of the pairwise topology 98. The establishment of a secure path based on an aggregation of trusted peer connections enable the establishment of secure network communications in the secure data network 5 via the pairwise topology 98, without any need for any additional security considerations at the application layer (58 of
The device identity containers (“signets”) also can be used to establish two-way trusted relationship between an endpoint device 12 and a replicator device 16, enabling formation of the secure data network 5 based on the aggregation of secure, two-way trusted relationships along each logical hop of the secure data network 5.
The endpoint device “A” 12 can connect to the secure private core network 10 based on generating and sending a secure replicator attachment request to the MCP device 14 via a prescribed IP address utilized for reaching the MCP device 14 via the external data network 96 (60 in
The MCP device 14 can digitally verify the signature of the secure replicator attachment request “RQ_A” (using its stored copy of endpoint device A's public key “KeyP1_A”), and decrypt the replicator attachment request using the MCP private key (and the decrypted temporal key). The load balancer (62 of
In response to the load balancer 62 identifying the replicator device “R1” 16 for allocation to the endpoint device “A”, the MCP device 14 can generate a secure replicator attachment response based on generating a replicator attachment response that includes the “R1” signet of the replicator device “R1” 16: as described previously, the “R1” signet of the replicator device “R1” 16 can include the secure public key “Key_R1” of the replicator device “R1” 16, a corresponding alias to be used by the replicator device “R1” 16 to identify the public key “Key_R1” that is in use, reachability information such as a list of one or more IP addresses usable by the replicator device “R1” 16, and a replicator ID 20 of the endpoint device replicator device “R1” 16.
The replicator attachment response (including the “R1” signet of the replicator device “R1” 16) can be secured based on the MCP device 14 generating a new temporal key used for encrypting the replicator attachment response, encrypting the temporal key using the endpoint device A's public key “KeyP1_A”, attaching the encrypted temporal key to the encrypted replicator attachment response, and digitally signing the packet (containing the encrypted replicator attachment response and encrypted temporal public key) using the MCP private key “prvKey_MCP”.
The endpoint device “A” 12 can respond to reception of the secure replicator attachment response by digitally verifying the signature of the secure replicator attachment response (using its stored copy of the MCP device public key “Key_MCP”), decrypting the secure replicator attachment response using its private key “prvKeyP1_A” to decrypt the temporal key, and the decrypted temporal key, to recover the “R1” signet for the replicator device “R1” 16. As indicated previously, the “R1” signet of the replicator device “R1” 16 can include: the secure public key “Key_R1” of the replicator device “R1” 16, an “alias” used by the replicator device “R1” 16, reachability information such as a list of one or more IP addresses usable by the replicator device “R1” 16, and the endpoint ID 20 of the replicator device “R1” 16.
The endpoint device “A” 12 can respond to reception of the “R1” signet for the replicator device “R1” 16 by generating and sending a secure attachment request to the replicator device “R1” 16 according to the prescribed secure salutation protocol (secured as described above including an encrypted temporal key and signing of the salutation request by the private key “prvKeyP1_A”). The secure attachment request can be encrypted using the secure public key “Key_R1” of the replicator device “R1” 16, and can include the alias (associated with the secure public key “Key_R1”), and also can include the “A” signet (containing the secure public key “KeyP1_A”) of the endpoint device “A” 12.
The network operating system 56 executed in the physical network device 88 executing the replicator device “R1” 16 can respond by validating the secure attachment request according to the prescribed secure salutation protocol, enabling the replicator device “R1” 16 to form a first party trust relationship with the endpoint device “A” based on sending a secure attachment acceptance that can include a corresponding endpoint object 22 that identifies the replicator device “R1” 16. The replicator device “R1” 16 can send a secure notification to the MCP device 14 indicating that the endpoint device “A” 12 has attached to the replicator device “R1” 16, causing the MCP device 14 to update the corresponding connection status entry 160 of the endpoint device “A” 12 as attached to a next-hop replicator device “R1” 16. Also note that the replicator device “R1” 16 can obtain the “A” signet from the MCP device 14 in response to identifying the endpoint device “A” 12, enabling further validation of the endpoint device “A” 12 prior to attachment.
Hence the endpoint device “A” 12 can establish a first-party trust relationship with the next-hop replicator device “R1” 16 based on creating (as a local data structure) a key pair association of its private key and the peer public key{“prvKeyP1_A”, “Key_R1”} for securely sending data packets destined for the next-hop replicator device “R1” 16 and securely receiving data packets originated by the replicator device “R1” 16. Similarly, the replicator device “R1” 16 can establish the first-party trust relationship with the attached endpoint device “A” 12 based on creating (as a local data structure) a key pair association of {“prvKey_R1”, “KeyP1_A”} for securely sending data packets destined for the attached endpoint device “A” 12 and securely receiving data packets originated by the attached endpoint device “A” 12.
The endpoint device “B” 12 (and/or “C” 12) also create a corresponding set of private/public keys, and securely register with the MCP device 14, causing the MCP device 14 to send a secure acknowledgment containing the “B” signet (generated, for example, by the MCP device 14).
The network operating system 56 executed in the endpoint device “B” can generate and send to the MCP device 14 a secure replicator attachment request that causes the MCP device 14 to allocate the replicator device “R100” 16 for attachment by the endpoint device “B” 12 (and/or “C” 12) by generating and sending back to the endpoint device “B” 12 (and/or “C” 12) a secure replicator attachment reply that includes the “R100” signet. The endpoint device “B” 12 (and/or “C” 12) can decrypt and recover the “R100” signet for the replicator device “R100” 16, and send to the replicator device “R100” 16 a secure attachment request for establishment of a first-party two-way trusted relationship with the replicator device “R100” 16. The replicator device “R100” 16 can respond to the secure attachment request from the endpoint device “B” 12 (and/or “C” 12) by generating and sending to the MCP device 14 a secure notification that the endpoint device “B” 12 (and/or “C” 12) has attached to the replicator device “R100” 16.
The endpoint device “B” 12 (of the federation “F2” 34) can respond to attaching to the replicator device “R100” 16 by sending to the replicator device “R100” 16 a secure query for reaching the owner of the federation “F1” 34, using for example an identifier received by the endpoint device “B” 12, for example based on email transmission of the endpoint identifier (implemented for example as a text string, URL string, and/or a QR code, etc.), machine scan of a QR code (generated by the endpoint device “A”) detected by a camera of the endpoint device “B”, etc.: the identifier can be any one of a hash of an email address used by the owner of the federation “F1” 34 as described above, the federation ID “F1” 18, and/or an endpoint ID (e.g., “EID_A”) 20. If needed, the replicator device “R100” 16 can execute a crypto-switching (described below) and forward a secure forwarded request to the MCP device 14.
The MCP device 14 can respond to validation of the secure forwarded request (described previously) by executing a projection search on the identifier (e.g., “F1”, “EID_A”, and/or “HASH[P1@AA.com]”), and sending a secure response that contains the “A” signet and the “A1” signet of the respective endpoint devices “A” and “A1” belonging to the federation “F1” 34. Alternately, the replicator device “R100” can respond to the secure query from the endpoint device “B” 12 based on local availability of the “A” signet and the “A1” signet for the federation “F1” 34. The MCP device 14 and/or the replicator device “R100” also can specify in the secure response an online availability based on the connection status 160, indicating for example “A online” and “A1 offline”.
Hence, the replicator device “R100” 16 can forward the secure response to the endpoint device “B” 12, enabling the endpoint device “B” to execute the prescribed secure salutation protocol with the endpoint device “A” in response to receiving the corresponding “A” signet of endpoint device “A” 12 and the indicator “A online” indicating the endpoint device “A” 12 is reachable via the secure peer-to-peer data network 5. As described previously, the endpoint device “B” 12 can generate a secure salutation request (158b of
As described previously, the secure salutation request 158b can specify an alias (“ALIAS_A”) 174 for the endpoint device “A” 12 (identified from A's signet obtained by the endpoint device “B” 12): the endpoint device “B” 12 can encrypt the payload salutation request using a dynamically-generated temporal key (TK), encrypt the temporal key (TK) using A's public key “KeyP1_A” and add the encrypted temporal key “ENC(KeyP1_A)[TK]” to the data packet that also contains the encrypted payload “ENC(TK)[PAYLOAD]”; the endpoint device “B” 12 also can digitally sign the data packet using its private key “prvKey_B” to generate a source endpoint signature, enabling other network devices in possession of the public key “Key_B” to verify the secure data packet is from the endpoint device “B” 12. Hence, the secure salutation request 158b cannot be decrypted by any device except the destination endpoint device “A” 12; consequently, the secure data packet 158b can secure the logical one-hop connection 216 between the endpoint device “B” 12 and the replicator device “R100” 16.
The replicator device “R100” 16 can validate the secure salutation request 158b, and in response determine that the destination endpoint device “A” 12 is reachable via the next-hop replicator device “R1” 16, causing the replicator device “R100” to generate and send a secure forwarded packet 164b, comprising the secure salutation request 158b, for secure transmission and delivery to its trusted peer replicator device “R1” 16. The replicator device “R1” 16 can respond to receiving the secure forwarded packet 164b by validating the secure forwarded packet 164b, and forwarding the secure data packet 158b to the destination endpoint device “A” 12 via the network socket connection “Socket_A” that provides the logical one-hop connection between the replicator device “R1” 16 and the endpoint device “A” 12.
Hence, the network operating system 56 of the endpoint device “A” can accept the secure salutation request 158b by storing the enclosed “B” signet, and generating and outputting to the endpoint device “B” 12 (via the replicator devices “R1” and “R100” 16) a secure salutation reply 158a.
The network operating system 56 executed in the endpoint device “B” also can send an online notification request for the endpoint device “A1” to its replicator device “R100”. Depending on implementation, the replicator device “R100” (if executing distributed processing on behalf of the MCP device 14) and/or the MCP device 14 can record the online notification request, and generate and send to the endpoint device “B” 12 an updated online indicator in response to the endpoint device “A1” 12 connecting to a replicator device 16.
The updated online indicator indicating the status “A1 online” from the replicator device “R100” 16 can cause the network operating system 56 executed in the endpoint device “B” 16 to initiate and send to the endpoint device “A1” a secure salutation request (as described in detail previously) that contains the “B” signet. The secure salutation request can cause the network operating system 56 executed in the endpoint device “A1” to accept the salutation request, securely store the “B” signet, and send a salutation reply to the endpoint device “B” (via the replicator devices “R1” and “R100” 16).
Hence, the endpoint device “B” can establish a two-way trusted relationship with each of the endpoint devices “A” and “A1” 12 belonging to the federation “F1” 34, based on receiving the respective “A” signet and “A1” signet, merely based on identification of the federation “F1” 34 established for the user “P1”. Similarly, the endpoint device “C” can initiate establishment of a two-way trusted relationship with the endpoint device “A” based on sending a secure salutation request within a secure data packet 158c to the endpoint device “A” via the replicator devices “R100” and “R1” (as a secure forwarded packet 164c) as described above.
The example embodiments also enable dynamic updates of each signet stored in the secure data network 5, for example if an endpoint device changes its public key (“rekeying”) and associated alias, and/or changes its IPv4/IPv6 address reachability. As described previously, a change in a data structure (including a signet) can cause an instant update among two-way trusted network devices. Hence, the endpoint device “A” can cause an instant update of its “A” signet to the replicator device “R1” and/or its peer endpoint device “A1” within the same federation 34. The updated “A” signet can be forwarded by the endpoint device “A” to the endpoint device “B” (similarly, the replicator device “R1” can forward the updated “A” signet to the MCP device 14).
The network operating system 56 of the endpoint device “B” 12 also can establish a first-party two-way trusted relationship with the endpoint device “C” 12, for example based on executing the prescribed secure salutation protocol via a peer-to-peer connection that can be established while the endpoint devices “B” and “C” 12 are in local proximity to each other (e.g., within the same wireless local area network). For example, the endpoint device “C” can dynamically generate a visually-displayable or machine-readable identifier for retrieval of the “C” signet by a camera of the endpoint device “B”. In one example, the visually-displayable identifier can be sent as a text string within an email sent to the endpoint device “B”, enabling either manual user input of the text string into the endpoint device “B”, or detection of the text string in the email by the endpoint device “B”.
In another example, the network operating system 56 of the endpoint device “B” can obtain the “C” signet of the endpoint device “C” 12, based on the network operating system 56 of the endpoint device “C” 12 dynamically generating the visually-displayable or machine-readable identifier as one or more of a text string, a bar code, and/or a QR code. In one example the visually-displayable identifier generated by the endpoint device “C” 12 can specify the federation ID “F3” 18 of the associated federation “F3” 34 to which the endpoint device “C” 12 belongs, the endpoint ID of the endpoint device “C”, and/or a hash of the email used during registration of the endpoint device “C” 12; hence, the visually-displayable or machine-readable identifier enables the endpoint device “B” to send a projection search to the MCP, enabling the MCP device to return to the endpoint device “B” the “C” signet based on the identifier specified in the visually-displayable or machine-readable identifier. The visually-displayable or machine-readable identifier also can specify the “C” signet, enabling endpoint device “B” to initiate the salutation protocol, via a local peer-to-peer connection, in response to reception of the “C” signet.
Hence, the reception of a signet enables establishment of a two-way trusted relationship with a second network device based on executing the prescribed secure salutation protocol with the second network device (“target network device”) based on the public key specified in the signet. The device identifier specified in the signet enables reachability to the second network device (“target network device”). In one example, the device identifier can be an endpoint ID, where reachability to the endpoint ID can be resolved by a replicator device 16; in another example, the device identifier can be a local and/or global IPv4/IPv6 address, for example for reachability via a local peer-to-peer data link, a local private WiFi data network distinct from the private core network 10, etc.
A received signet can be stored and arranged for display (e.g., as a QR code) on a “contact page” for a given federation entity 34, where the “contact” page can include user name, email address used for registration, phone number, etc. Hence, the signet can be displayed on the contact page for a given federation entity 34 within a contact list, enabling a user to display the signet for another user that wishes to initiate a salutation request with the federation entity 34 identified on the “contact” page.
Additional details regarding the secure communications in the secure data network 5 are described in commonly-assigned, copending application Ser. No. 17/345,057, filed Jun. 11, 2021, entitled “CRYPTO-SIGNED SWITCHING BETWEEN TWO-WAY TRUSTED NETWORK DEVICES IN A SECURE PEER-TO-PEER DATA NETWORK”, the disclosure of which is incorporated in its entirety herein by reference.
The example embodiments also enable establishment of two-way trusted relationships by an endpoint device (e.g., “A”) 12 with one or more Internet of Things (IoT) devices, for example a wireless keyboard device. The endpoint device “A” 12 can establish a two-way trusted relationship with an IoT-based keyboard, within the secure data network 5, based on the endpoint device “A” 12 receiving a corresponding device identity container specifying a secure public key and a device identifier for the second network device (e.g., the IoT-based keyboard).
According to example embodiments, an endpoint device (e.g., “C”) can be granted authority as an IoT management device that is authorized to generate one or more IoT Federations, for example based on an affiliate agreement with the service provider of the secure core network 10. For example, an IoT manufacturer or distributor, etc. can acquire an IoT management device (e.g., “C”) 12 prior to sale and/or deployment of IoT devices.
The network operating system 56 executed in the IoT management device 12 can create a cryptographically-unique 128-bit UUID as a IoT federation ID (e.g., “IoT1”), as described above for the federation IDs 18, for a prescribed IoT device “kit”, for example a prescribed collection of one or “N” more IoT devices in the IoT federation “IoT1”. The prescribed IoT device “kit” can be implemented, for example, as a single wireless keyboard device, a wireless keyboard and wireless pointer (“mouse”) device, a home video security kit that includes one or more wireless IoT cameras, an optional IoT video security controller configured for local communication and control of the wireless IoT cameras, an optional IoT-enabled mass storage device (e.g., 1 Terabyte or larger external drive), etc. Hence, each kit “j” can have a corresponding unique IoT federation ID “IoTj” (“j=1 to M”), where, the IoT federation IDs can be generated without any involvement by the MCP device 14.
The network operating system 56 executed in the IoT management device 12 also can cause each of the “N” IoT devices in the “kit” to join the federation “IoTj”, for example based on providing the federation ID “IoTj” to each of the “N” IoT devices in the “kit”: the supply of the federation ID “IoTj” can cause each IoT device in the “kit” to generate its own cryptographically-unique 128-bit UUID as a corresponding unique endpoint ID “IoTj_EPi” 20, and send an acknowledgment to the IoT management device 12 containing the unique endpoint ID “IoTj_EPi” 20. The IoT management device 12 also can supply at least the endpoint device identifiers of all the IoT devices in the kit to each of the IoT devices, enabling each of the IoT devices in the kit to learn of their “peer” IoT devices within the same kit.
Each IoT device in the “kit” can respond to reception of the federation ID “IoTj” by generating and storing its own endpoint object 22 that comprises the federation ID “IoTj” and the corresponding unique endpoint ID “IoTj_EPi” 20. Hence, each IoT device “i” in the same “kit” “j” identified by the federation ID “IoTj” (e.g., “IoT1”, “j=1”) has a corresponding endpoint ID (e.g., “IoT1_EP1”, “IoT1_EP2”, . . . “IoT1_EPN”). Each IoT device in the “kit” also can generate a secure private key and public key “Key_IoTj_EPj”. In one embodiment, an IoT device can optionally generate and forward to the IoT management device 12 an IoT signet (e.g., “Signet_IoTj_EPi”) containing the federation ID “IoTj”, the endpoint ID “IoTj_EPi”, and the corresponding public key “KeyIoTj_EPi”. Hence, the IoT management device 12 can send the respective signets “Signet_IoTi_EPi” of all the other IoT devices in the kit to each of the IoT devices, enabling each of the IoT devices “i” in the kit “j” to learn of their “peer” IoT devices within the same IoT federation “IoTj”.
The IoT management device 12 can cause each IoT device in the “kit” to display an identifier that associates the IoT device with the federation ID “IoTj”. In one example, the IoT management device 12 can cause generation of a printed label containing an alphanumeric string and/or QR code, etc., that specifies one or more of the federation ID “IoTj” and/or the corresponding unique endpoint ID “IoTj_EPi” 20 that is associated with the federation ID “IoTj”, and/or optionally the IoT signet “Signet_IoTj_EPi” that can be generated by the IoT device. If equipped with a display, each IoT device also can be configured for dynamically displaying the identifier (e.g., as a QR code) in response to a prescribed command received via the device interface circuit 90, for example via a touchscreen/key input, via a data packet specifying the prescribed command, etc.
Hence, the IoT “kit” can be deployed within a private WiFi network implemented by a network device (e.g., firewall device 152 of
The MCP device 14 can respond to the registration by the IoT device “i” of the kit (e.g., “j=1”) by executing a mapping between the federation ID “IoT1” and the one or more endpoint device identifiers “IoTj_EPi” provided in the registration message. If an IoT device is not configured to generate its own signet, the MCP device 14 can generate the signet “Signet_IoT1_EPi” for at least the registering IoT device “i”.
A user “P1” of an endpoint device “A” 12 can initiate establishment of a two-way trusted relationship with an IoT device (e.g., a wireless keyboard), for example based on a scan of an identifier provided by the IoT device (e.g., visual, electronic according to a prescribed discovery protocol using a wireless data link, etc.) by a camera of the endpoint device “A” 12. In response to receiving the identifier (e.g., federation ID “IoT1”, endpoint ID “IoT1_EP1” for IoT device “i=1”), the endpoint device “A” 12 can send a secure projection search query specifying the identifier to the replicator device “R1” 16 for delivery to the MCP device 14 (or distributed search within the replicator device “R1”). The MCP device 14 (and/or the replicator device “R1” 16) can respond to the secure projection search query by generating and sending a secure reply specifying the signets “Signet_IoT1_EP1” through “Signet_IoT1_EPN” of all the IoT devices belonging to the federation “IoT1”.
The endpoint device “A” 12 can respond to reception of the signets “Signet_IoT1_EP1” through “Signet_IoT1_EPN” of all the IoT devices belonging to the federation “IoT1” by securely storing all the IoT signets. The endpoint device “A” 12 can selectively initiate a salutation request with each available IoT device “i” that has been powered-up, for example via the wireless data network provided by the network device 152, or via a private data link in case the endpoint device “A” and the IoT devices are disconnected from any data network. Hence, the endpoint device “A” 12 can utilize local P2P data links to generate and transmit a prescribed salutation request (containing the “A” signet” and optionally the “A1” signet) to an available IoT device in an isolated region that has no wireless data network providing reachability to the secure core network 10.
The endpoint device “A” 12 can cause an IoT device to enter a “discovery mode” (e.g., based on a prescribed command sent to the IoT device) that causes the IoT device to accept the salutation request (containing the “A” signet” and optionally the “A1” signet), and establish a two-way trusted relationship with the endpoint device “A” (and optionally the endpoint device “A1” in the federation “F1” 34). Hence, each active IoT device “i” in the IoT federation “IoT1” can recognize that the federation “F1” is the owner of each of the IoT devices “i” in the IoT federation “IoT1”, enabling the user “P1” to use an endpoint device “A” or “A1” to invite one or more IoT devices into conversation objects 42, as desired, for execution of secure IoT operations between the federation 34 and the IoT devices in the IoT federation “IoT1”.
Additional details regarding use of signets to establish two-way trusted relationships between network devices is described in commonly-assigned, copending application Ser. No. 17/477,208, filed Sep. 16, 2021, entitled “ESTABLISHING AND MAINTAINING TRUSTED RELATIONSHIP BETWEEN SECURE NETWORK DEVICES IN SECURE PEER-TO-PEER DATA NETWORK BASED ON OBTAINING SECURE DEVICE IDENTITY CONTAINERS”, the disclosure of which is incorporated in its entirety herein by reference.
As described previously, the network operating system 56 can implements all executable services associated with security in the secure data network 5, including encryption of in-flight and at-rest data structures, identity protection, enforcing privatization of user metadata, secure outcasting of bad actors, intrusion prevention, etc. The network operating system 56 retains exclusive control to any access of the secure data network 5, or to any access of any in-flight and at-rest data structures associated with a user interacting with the secure data network 5. Hence, all applications and all users can interact in the secure data network 5 with trust and knowledge that all network-based services, user identities, user data, user metadata, etc., are secured in the secure data network 5.
As described below, conversation factory 110, the message factory 112 (comprising the distributed lazy loader 116) and optionally the autonomic synchronizer 52 can execute the secure autonomic replication of data structures received by the network operating system 56, for example from one or more of the application layer resources 58 (e.g., the messenger application 72) via the APIs 80, or from another trusted endpoint device (e.g., “B”) 12 via a secure data packet 158 that is secured by the guardian security agent 66 executed in the AI-based security agents 64. The conversation factory 110 and the message factory 112 (and optionally the autonomic synchronizer 52) also can autonomically execute the secure recovery of one or more data structures, having been stored in the network device 12 as encrypted “at-rest” data structures, that are detected as unusable due to corruption, file system failure, etc. Hence, the conversation factory 110, the message factory 112 (and optionally the autonomic synchronizer 52), and the guardian security agent 66 can execute an autonomic and secure recovery of unusable data structures, without any user involvement.
Referring to
As described previously, the network operating system 56 of the endpoint device “A” 12 can generate and supply in operation 124 a registration message (126a of
As described previously, the MCP device 14 in operation 134 can complete the registration of the endpoint device “A” 12 based on generating and sending a secure registration acknowledgment 136 that contains the MCP signet and the “A” signet. As described previously, the MCP device 14 in operation 142 also can execute registration of the endpoint device “A1” 12 based on sending a corresponding secure endpoint acknowledgment 144 that can contain the MCP signet, the “A1” signet, and the “A” signet that belongs to the same federation “F1” 34.
As described previously with respect to
Similarly, the guardian security agent 66 of the endpoint device “A” 12 in operation 166 can establish a two-way trusted relationship with the endpoint device “B” 12, for example in response to the guardian security agent 66 in the endpoint device “B” 12 initiating the salutation protocol based on sending to the endpoint device “A” 12 a corresponding salutation reply 158a that contains the “B” signet (comprising the public key “Key_B”); the secure salutation request 148 from the endpoint device “B” 12 can cause the guardian security agent 66 executed in the endpoint device “A” 12 to send a corresponding secure salutation reply 150 indicating acceptance of the two-way trusted relationship. The network operating system 56 of the endpoint device “A” 12 can securely store any received signets.
As apparent from the foregoing, the endpoint device “A” 12 also can establish a two-way trusted relationships with one or more IoT devices according to the prescribed salutation protocol, for example an IoT-based mass storage device that can operate as a secure backup device for the endpoint device “A” 12.
The network operating system 56 of the endpoint device “A” 12 in operation 168 can receive a request for generation of a new “conversation” of a prescribed “type” or “kind”, for example based on the messenger application 72 sending the new conversation request via a prescribed API 80. The conversation factory 110 in operation 168 can respond to the new conversation request by creating a new conversation object 42, illustrated in
The conversation factory 110 can insert into the conversation object 42 in operation 168 a subscriber list 50 that identifies at least the federation ID “F1” of the endpoint device “A” 12 (and the endpoint device “A1” 12), and additional federation identifiers (e.g., “F2”, “IoT1”, etc.) 18. The conversation factory 110 in operation 168 also can specify in operation 168 the type of conversation object 42, for example a “vault” file directory, a private “chat” conversation, etc. The conversation factory 110 in operation 168 also can add to the conversation object 42 one or more hypercontent fields that can include text, an image, etc. The hypercontent fields can include, for example a title field, an image field, and a hypercontent portion. The hypercontent portion can include one or more body parts, each including a body part ID, a body part content type, and a reference to the body part content (or the actual body part content embedded therein). Hence, the conversation object 42 can be self-describing similar to a message, and the hypercontent in the conversation object can updated dynamically, described below.
The conversation object 42 generated by the conversation factory 110 can include a creation timestamp indicating a time that the data object was created, and a “last change” timestamp (i.e., update timestamp) indicating the last time the data object was updated. The conversation object 42 also can include a type field that identifies the “type” of the conversation object 42.
The conversation factory 110 executed in the endpoint device “A” 12 in operation 168 can replicate the conversation object 42 based on sending to a trusted endpoint device (e.g., “A1”, “B”, “IoT1”, etc.) an invitation to join the conversation (identified by its conversation ID 44), where the invitation can be secured within a secure data packet generated by the guardian security agent 66 for secure “in-flight” transmission. For example, the conversation factory 110 in the endpoint device “A” 12 can replicate a conversation object “C2” 42 (of type “vault”) based on sending to the endpoint device “A1” 12 (and/or an IoT-based mass storage device in the federation “IoT1”) an invitation to join the conversation “C2” and that contains the conversation object “C2” 42; the conversation factory 110 in the endpoint device “A” 12 can replicate a conversation object “C3” 42 (of type “chat”) based on sending to the endpoint device “B” 12 an invitation to join the conversation “C3” and that contains the conversation object “C3” 42. The endpoint device “A1” 12 (and/or an IoT-based mass storage device in the federation “IoT1”) can autonomically join the conversation “C2” and store the corresponding conversation object “C2” 42 based on being within the same federation. The endpoint device “B” 12 can join the conversation “C3”, for example in response to the federation user “F2” accepting the conversation request, causing the endpoint device “B” 12 to store the conversation object “C3” 42.
As described previously, each stored data object can be encrypted for secure “at-rest” storage by each endpoint device 12. Hence, the guardian security agent 66 executed in the endpoint device “A” 12 can encrypt each conversation object 42, using its private key “prvKeyP1_A”, for secure “at-rest” storage of each conversation object 42; the guardian security agent 66 also can generate a digital signature of each encrypted conversation object 42, described in further detail below with respect to operation 172.
As described previously, each conversation object 42 can reference zero or more message objects 36, and therefore can optionally include a message reference (or message “list”) 48 of one or more message objects (e.g., “M1”, “M2”). Referring to
The guardian security agent 66 executed in the endpoint device “A” 12 responds to receiving the message objects “M1” and “M2” by encrypting in operation 172 each of the message objects “M1” and “M2” (also referred to as “data structures”) into encrypted data structures “ENC[M1]” and “ENC[M2]”, respectively, using the private key “prvKeyP1_A” previously generated by the guardian security agent 66. The guardian security agent 66 executed in the endpoint device “A” 12 in operation 172 also can generate for each “ENC[M1]” and “ENC[M2]” a corresponding cryptographic digital signature (“Sig[ENC[M1]]” and “Sig[ENC[M2]]”) using the private key “prvKeyP1_A”. Hence, the encrypted data structures “ENC[M1]” and “ENC[M2]” enable secure “at-rest” storage of the message objects “M1” and “M2” locally by the endpoint device “A” 12 (e.g., within random access memory within the memory circuit 94 of
The conversation factory 110 executed in the endpoint device “A” 12 in operation 174 can cause an autonomic replication of the data structures received in operation 170 (or the encrypted versions generated in operation 172), based on executing an autonomic synchronization of the conversation objects “C2” and “C3” 42 in the endpoint devices “A1” and “B”, respectively, that belong to the list of subscribed federations in the respective subscriber lists 50. The conversation factory 110 in operation 174 also can cause the autonomic synchronizer 52 to autonomically synchronize any of the data structures 42 and/or 36 in a destination endpoint device, for example based on the autonomic synchronizer 52 detecting that a destination endpoint device changes from an “offline” (unavailable) status to an “online” (available) status.
The updating of the conversation object “C2” 42 in the endpoint device “A1” 12 causes the conversation factory 110 in the endpoint device “A1” 12 to request its corresponding distributed lazy loader 116 to generate and send, to the endpoint device “A” 12 via the secure data network 5, a secure fetch request (secured by its guardian security agent 66) for the message object “ENC[M1]” 36 referenced in the conversation object “C2” 42. Similarly, the updating of the conversation object “C3” 42 in the endpoint device “B” 12 causes the conversation factory 110 in the endpoint device “B” 12 to request its corresponding distributed lazy loader 116 to generate and send to the endpoint device “A” 12 a secure fetch request (secured by its guardian security agent 66) for the message object “M1” 36 referenced in the conversation object “C2” 42.
Hence, the network operating system 56 executed in the endpoint device “A” 12 can continue execution of the autonomic replication of the received data structures, in response to receiving the secure fetch request from the endpoint device “A1” 12 and the secure fetch request from the endpoint device “B” 12 for the data structure “M2”.
The network operating system 56 executed in the endpoint device “A” 12 can securely replicate a copy of the encrypted data structure “ENC[M1]” for the endpoint device “A1” 12, based on securely generating and sending in operation 176 the encrypted data structure “ENC[M1]” within a secure data packet 158 (secured by its guardian security agent 66). As described previously, the guardian security agent 66 executed in the endpoint device “A” 12 can dynamically generate a temporal key “TK1”, encrypt the encrypted data structure “ENC[M1]” with the temporal key “TK1” into a second encrypted data structure “ENC[ENC[M1]]”; the guardian security agent 66 executed in the endpoint device “A” 12 also can encrypt the temporal key “TK1” into an encrypted temporal key “ENC[TK1]” using the secure public key “KeyP1_A1” of the destination endpoint device “A1” 12, resulting in an encrypted data structure comprising the second encrypted data structure “ENC[ENC[M1]]” and the encrypted temporal key “ENC[TK1]”. The guardian security agent 66 can generate a digital signature of at least the encrypted data structure (comprising the second encrypted data structure “ENC[ENC[M1]]” and the encrypted temporal key “ENC[TK1]”) using the private key “prvKeyP1_A”, and send the resulting secure data packet (comprising the second encrypted data structure “ENC[ENC[M1]]”, the encrypted temporal key “ENC[TK1]”, and the digital signature) to the endpoint device “A1” 12.
As described previously, the guardian security agent 66 executed in the endpoint device “A1” 12 in operation 178 can validate the secure data packet (based on verifying the signature using the public key “KeyP1_A”), decrypt the temporal key “TK1” using its private key “prvKeyP1_A1”, and decrypt the encrypted data structure “ENC[M1]” using the decrypted temporal key “TK1” for delivery by the distributed lazy loader 116. The distributed lazy loader 116 executed in the endpoint device “A1” 12 can thus add the encrypted data structure “ENC[M1]” to the secure storage in the “vault” conversation “C2”; the guardian security agent 66 executed in the endpoint device “A1” 12 also can further encrypt the encrypted data structure “ENC[M1]” with its own private key (e.g., “prvKey2_A1”) for additional security for “at-rest” storage of the encrypted data structure “ENC[M1]” by the endpoint device “A1” 12.
Similarly, the network operating system 56 of the endpoint device “A” 12 in operation 180 can securely send the message object “M2” (for display by a corresponding messenger application 72 in the endpoint device “B” 12) based on generating and securely sending to the endpoint device “B” 12 a corresponding secure data packet (e.g., 158a of
As described previously, the guardian security agent 66 executed in the endpoint device “B” 12 in operation 182 can validate the secure data packet (based on verifying the signature using the public key “KeyP1_A”), decrypt the temporal key “TK2” using its private key “prvKey_B”, and decrypt the data structure “M2” using the decrypted temporal key “TK2”. The distributed lazy loader 116 executed in the endpoint device “B” 12 can thus add the decrypted data structure “M2” to the secure “chat” conversation “C3”, causing the network operating system 56 to forward the decrypted data structure “M2” to the local messenger application 72 via the API 80; the guardian security agent 66 executed in the endpoint device “B” 12 also can encrypt the data structure “M2” with its own private key (e.g., “prvKey_B”) for additional security for “at-rest” storage of the data structure “M2” as an encrypted data structure “ENC[M2]” by the endpoint device “B” 12.
As described previously, a given message (e.g., “M2”) can be referenced in more than one conversation object (e.g., “C2”), enabling the message (e.g., “M2”) to be replicated to different conversation subscribers (e.g., federation “F2” 34 and federation “F3” 34) specified in the subscriber list 50 according to different policies specified by the corresponding lifecycle policy “L” 24 and the corresponding distribution policy “D” 26 in the conversation object “C2”. Hence, any one or more of the data objects 36 and/or 42 can be replicated among multiple trusted endpoint devices 12.
Referring to
The conversation factory 110 can cause the message factory 112 to attempt location of the requested data structure as referenced in the conversation object (e.g., “ENC[M1]” or “M2”) from local RAM and/or flash memory in the memory circuit 94; if the message factory 112 cannot locate the requested data structure from local RAM and/or flash memory in the memory circuit 94, the message factory 112 can request the distributed lazy loader 116 to initiate a search for the requested data structure locally or, if needed, from a two-way trusted endpoint device (e.g., “A1”, “B”, a trusted IoT-based device, etc.).
Assuming the message factory 112 and/or the distributed lazy loader 116 executed in the endpoint device “A” 12 can locate a local encrypted copy of the requested data structure (e.g., “ENC[M1]” or “ENC[M2]”), the message factory 112 and/or the distributed lazy loader 116 in operation 186 can cause the guardian security agent 66 to attempt validation of the associated stored signature(s) “Sig[ENC[M1]]” and “Sig[ENC[M2]]” that were generated and stored in operation 172. In one embodiment, the guardian security agent 66 in operation 186 can generate second/complementary signatures “Sig2[ENC[M1]]” and “Sig2[ENC[M2]]” based on digitally signing the respective encrypted data structures “ENC[M1]” and “ENC[M2]” with the public key “KeyP1_A”, and cryptographically comparing the stored signatures “Sig[ENC[M1]]” and “Sig[ENC[M2]]” with the second/complementary signatures “Sig2[ENC[M1]]” and “Sig2[ENC[M2]]”.
The guardian security agent 66 executed in the endpoint device “A” 12 can validate the stored signature(s) based on determining in operation 188 that the stored signature(s) are cryptographically equivalent to the second/complementary signatures (indicating no detected corruption), and in response retrieve in operation 190 the locally-stored encrypted data structures, decrypt and present to the requesting application in the application layer resources 58 via the API 80.
If, however, the guardian security agent 66 executed in the endpoint device “A” 12 determines in operation 188 that the stored signature(s) are not cryptographically equivalent to the second/complementary signatures by even one bit (indicating a detected corruption), and/or if the stored signature(s) or the locally-stored encrypted data structures are not available (e.g., due to a failure in the local file system), guardian security agent 66 can generate a notification causing the message factory 112 and/or the distributed lazy loader 116 in operation 192 to autonomically initiate execution of a secure recovery of a copy of the data structure (or encrypted data structure) from one of the trusted network devices having stored the copy.
For example, the network operating system 56 executed in the endpoint device “A” 12 (e.g., the message factory 112 and/or the distributed lazy loader 116, or the conversation factory 110 in the case of an unusable conversation object 42) in operation 192 can cause the guardian security agent 66 cryptographically erase the locally-unusable copy of the encrypted data structure in response to the guardian security agent 66 detecting the unusability (e.g., corruption) in operation 188, and autonomically initiate secure recovery.
The distributed lazy loader 116 in operation 192 can autonomically initiate secure recovery of a copy of the data structure based on identifying a trusted endpoint device having stored the copy of the data structure to be recovered, for example based on determining, from the conversation factory 110, one or more conversation objects 42 that reference the data structure to be recovered (e.g., “ENC[M1]” or “M2”); the conversation factory 110 can respond by providing a listing of one or more federation identifiers 18 (e.g., “F1”, “F2”, “F3”, “IoT1”, etc.) having stored the data structure to be recovered (e.g., “ENC[M1]” or “M2”). The distributed lazy loader 116 can identify the endpoint devices 12 belonging to the federation identifiers 18 (e.g., “F1”, “F2”, “F3”, “IoT1”, etc.) identified by the conversation factory 110, for example based on accessing the locally-stored signets and/or a local data structure that maps federation identifiers 18 to associated endpoint identifiers.
If the distributed lazy loader 116 determines that the data structure to be recovered is available from multiple trusted network devices (e.g., “A1”, “B”, “C”, etc.) 12, the distributed lazy loader 116 in operation 192 can select the trusted “recovery” device 12, as an optimal available recovery device 12, based on prescribed selection criteria, including for example whether a trusted “recovery” device 12 is “online” and available (as opposed to unavailable due to “offline” status), whether the trusted “recovery” device 12 is the owner of the data structure to be recovered as described previously, whether the trusted “recovery” device 12 is reachable via a local P2P connection or reachable only via the secure private core network 10, etc. The distributed lazy loader 116 also can execute a “whisper” protocol among the available trusted recovery devices 12 to identify an optimal available recovery device for the data structure to be recovered.
Referring to
The guardian security agents 66 executed in the optimal available recovery devices (e.g., “A1” for “ENC[M1]” or “B” for “M2”) can validate the received secure requests as described above for delivery to the respective distributed lazy loaders 116, enabling the respective distributed lazy loaders 116 to retrieve locally the requested copies of the data structures to be recovered. The guardian security agents 66 in the optimal available recovery devices can generate and output secure responses as described above that include the copies of the encrypted data structure “ENC[M1]” (encrypted by the endpoint device “A1” 12 using a temporal key that is further encrypted as described above) and the data structure “M2” (encrypted by the endpoint device “B” 12 using a corresponding temporal key that is further encrypted as described above.
Hence, the guardian security agent 66 executed in the endpoint device “A” 12 in operation 196 can validate the secure response received from the endpoint device “A1” 12 based on validating the signature using the public key “KeyP1_A1”, decrypting the secure response based on decrypting the temporal key using the private key “prvKeyP1_A”, and decrypting the encrypted data structure “ENC[M1]” using the decrypted temporal key for delivery to the distributed lazy loader 116 that can restore the recovered encrypted data structure “ENC[M1]” for use in the local copy of the conversation object “C2” 42.
Similarly, the guardian security agent 66 executed in the endpoint device “A” 12 in operation 198 can validate the secure response received from the endpoint device “B” 12 based on validating the signature using the public key “Key_B”, decrypting the secure response based on decrypting the temporal key using the private key “prvKeyP1_A”, and decrypting the data structure “M2” using the decrypted temporal key for delivery to the distributed lazy loader 116 that can restore the recovered encrypted data structure “M2” for use in the local copy of the conversation object “C3” 42.
Hence, the network operating system 56 executed in the endpoint device “A” 12 in operation 200 can recover the recovered encrypted data structure “ENC[M1]” and/or “M2” from the received secure responses, and decrypt as needed prior to presentation to a local application resource at the application layer resources 58 via the APIs 80. As apparent from the foregoing, the guardian security agent 66 in the network operating system 56 also can re-encrypt the recovered data structures “M1” and/or “M2” prior to local “at-rest” storage.
According to example embodiments, a network device can execute a secure autonomic recovery from an unusable data file via a trusted device in a secure peer-to-peer data network, without any user interaction required for recovery of a copy of the unusable data file. The example embodiments enable retrieval of copies of different data objects from different trusted network devices, enabling a scalable recovery of most if not all of data structures having been stored in a corrupted file system based on the autonomic and secure recovery of copies of the different data objects from different trusted recovery devices that are distributed throughout the secure peer-to-peer data network.
While the example embodiments in the present disclosure have been described in connection with what is presently considered to be the best mode for carrying out the subject matter specified in the appended claims, it is to be understood that the example embodiments are only illustrative, and are not to restrict the subject matter specified in the appended claims.
