Patent Application
20050240991
This invention relates to methods and apparatus for securing data transmitted to or from a trusted data terminal or network.
As used herein, “trusted” means relatively secure from interference from an open network, and “secure” means the highest level of security, free from interference even from corrupted trusted networks. Transmission of data to trusted networks or terminals involves a never ending battle between “hackers” and providers of arrangements for preventing hackers from transmitting hacker data to a trusted terminal or network such as a protected personal computer (PC) or a private intranet network by intercepting hacker data before it can cause harm or preventing a hacker from an unauthorized reading of trusted data.
In accordance with the principles of the prior art, the primary arrangements of choice for foiling hackers is the use of firewalls between an open network and a trusted network and/or the use of encryption to prevent the unauthorized interception of data and to prevent unauthorized messages from being accepted by the trusted network or terminal. The problem with the first arrangement is that current hardware arrangements make it possible to update and thereby corrupt the programs in the firewall once the protections around the firewall software have been breached. Encryption has its own problems in the sense that keys for the users must be maintained secret and different keys are required for communications by different users.
Accordingly, a problem of the prior art is that the arrangements for providing data transmission between sources in an open network and sources in a trusted network or terminal are inadequate and/or inefficient.
The above problem is solved and an advance is made over the teachings of the prior art in accordance with this invention wherein a multimedia boundary controller is interposed between the open network and the trusted network or terminal; at the heart of this boundary controller is an encryption/decryption device with a private key, or keys, of sufficient length so as to make unauthorized decryption of control messages from a supplier of security software essentially impossible. In accordance with one feature of the preferred embodiment, each private key is stored in a durable memory that can be read or written only within a secure processing unit (SPU). Control messages, including software updates, from a primary supplier of control software and data for the SPU which controls the operation of the multimedia boundary controller can be transmitted over the open multimedia network but require decryption using the private key(s) of the SPU. Advantageously, hackers cannot gain access to the control software and data of the SPU unless they are able to steal the private key(s) from the primary supplier or can perform the extremely difficult task of encrypting or decrypting messages without initially knowing the private key(s).
Many operations of the multimedia boundary controller are controlled by an open processing unit, access to which is controlled by an isolation unit that in turn is controlled by the secure processing unit. Security engines contain firewall software to block contaminating data from reaching the trusted network or device, and are interposed between the open network and the trusted network. Accordingly, hackers that succeed in accessing the open processing unit and contaminating its content can be prevented from spreading contamination by isolation of the open processing unit at the request of the SPU. Declaration of contamination in the open processing unit, to the SPU, can be done by the open processing unit, the SPU, the security engines, or human intervention at the local security interface of the boundary controller. By isolating the open processing unit, the SPU can prevent contaminated software from sending information to either the open or the trusted networks that are connected to the multimedia boundary controller. The SPU can also control the forced initialization of the open processing unit from protected software in the secure or trusted memory of the SPU. Such protected software could include methods of decontamination of the open processing unit.
Other operations that are more controlled than those assigned to the open processing unit can be performed by a trusted processor in the SPU. For example, software that implements corporate policy in the trusted network, such as periodic scans of open memory for viruses, could be assigned to the trusted processor. This software would be supplied by the owner of the trusted network or some other party and not necessarily by the supplier of the multimedia boundary controller. The trusted processor would be under final control of the secure processing unit and could be halted from operation or forced to initialize from secure memory if it were declared corrupted by the secure processor or a setting of the local security interface of the boundary controller.
A limited number of highly controlled, basic operations can be assigned to the secure processor. For example, the secure processor can implement a basic call processing engine that operates without the assistance of the trusted processor or the open processing unit. The basic call processing engine can support a limited interconnection of voice calls through the multimedia boundary controller, for example access to E-911 centers, when one or both of the open processing unit or trusted processor are declared contaminated. Communication between the secure processor of the SPU (SP of SPU) and the local security interface and the supplier of the multimedia boundary controller are also considered basic operations that are available at all times.
In accordance with one preferred embodiment of Applicants' invention, an open network security engine is provided in line with the data from and to the open multimedia network. The open network security engine implements firewall processes, for example, to intercept viruses being transmitted to the trusted multimedia network or data terminal. In addition, a trusted network security engine, which can contain different firewall protections, is provided in series with a communications to the trusted multimedia network or terminal. This trusted security engine can implement additional firewall rules aimed at the type of data likely to be transmitted to or from the trusted multimedia network or terminal.
In the preferred embodiment, a human interface, a local security interface, is provided to display the present status of the security settings of the multimedia boundary controller and to change these settings by, for example, pushing switches or buttons, or through some other commonly used input interface.
The open processing unit and the secure processing unit communicate via packet exchanges. The isolation unit is used under the control of the secure processing unit to prevent unwanted data from reaching or leaving the open processing unit. The open processing unit 101 and a trusted processor 310 (
In addition, the secure processing unit provides a series of well-defined processing operations including emergency call processing, basic information transfer, basic overload control, and fundamental responsibility for the uncorrupted sanity of the entire multimedia boundary controller. The well-defined processing operations provide a fail-safe foundation for continued emergency communication and recovery after corruption of the open processing unit or the trusted processor within the SPU. For example, well-known methods of sanity testing can be implemented between the secure processing unit and other processing elements in the multimedia boundary controller. An algorithmic challenge can be issued to a processing unit with the expectation that an acceptable response to the challenge will be returned from the processing unit within a defined period of time. An incorrect or delayed response will cause the SPU to force the processing unit to initialize to a known state using software supplied from the secure memory of the processing unit. The secure processing unit is shown in more detail in
The nature of the open communications network is such that unauthorized parties may be able to intercept or interject messages between the trusted network and other parties. For example, unsolicited email messages with virus attachments are a common problem in an open network such as the Internet but trusted networks must often connect with the Internet to allow communication with parties that are not directly connected to the trusted network. An example of a trusted network is a corporate wide-area network that is used to interconnect multiple locations in a company, but that is also used to allow communication with the Internet. Security engines in the multimedia boundary controller are designed to block invalid communication between an open and a trusted network; the SPU in the multimedia boundary controller is designed to stop the spread of corruption that does reach in from the open network. If for example, the SPU determines through a message from a security engine that the open processing unit is attempting to send email messages with attached virus software, the SPU can isolate the open processing unit from the open and trusted networks and force it to be reinitialized with software taken from trusted or secure memory within the SPU. Open memory, which is assumed to now hold a virus, can be examined by software running from the SPU to remove the virus or declare the open memory as ‘isolated from access’ until human intervention can recover uncorrupted data.
The multimedia boundary controller communicates with the trusted multimedia network 220. The open multimedia network 210 communicates with simple communication devices 212 and communicating computing devices 214. Similarly, the trusted multimedia network communicates with communication device 222 and communicating computing device 224. The secure processing unit controls the trusted network security engine 146 and the open network security engine 142 via a local control/response interface 116.
As a result of the ability to carry out the above-described functions, the secure processing unit can securely control operation of an entire multimedia boundary controller making it difficult for corruption to be inserted into any part of the controller; making it possible to isolate elements that do become corrupted, helping to prevent spread of the corruption; making it possible to initialize elements with uncorrupted images from secure memory, allowing a return to an uncorrupted state; all while continuing a secure, primary level of processing functionality.
The above description is of one preferred embodiment of Applicants'invention. Other embodiments will be apparent to those of ordinary skill in the art without departing from the scope of the invention. The invention is limited only by the attached claims.
