Patent Application
20050114663
1. The Field of the Invention
The invention generally relates to the field of sending and receiving network data. More specifically, the invention relates to network data security between two points on a network.
2. The Relevant Technology
Modern computer networks allow for the transfer of large amounts of data between clients within the network. Network clients, such as computers and other electronic devices, are often interconnected using a hub or router. A group of clients linked together in a central location is often referred to as a local area network (LAN). LANs can be interconnected through a wide area network (WAN). One example of a WAN is the ubiquitous Internet. Using a WAN, a user on one LAN can send data to a user on a separate LAN.
Many modern networks communicate by packaging data into data packets. The data packets generally include a header and a payload. The packet header generally includes routing information. The routing information may include information such as an originating client and a destination client. Each of the clients on the network may be assigned a unique number representing a physical address where packets may be sent. This number may be, for example, an IP address or a media access control (MAC) address. The payload generally includes the data that is intended to be transmitted between clients on the network.
Commonly, networking is accomplished using a model known as the Open Systems Interconnection (OSI) model or protocol stack. The OSI model defines a networking framework for accomplishing network communications. The OSI model includes seven layers on clients in the network. These seven layers are understood by those of skill in the art, and include from the highest level to the lowest level: the application layer, the presentation layer, the session layer, the transport layer, the network layer, the data link layer, and the physical layer. At the application layer, data is used in end user processes. Data is packaged by one or more of the other layers of the OSI model prior to being sent using the physical layer. Packaging includes organizing data into packets where the packets include parts such as a header and payload. The header includes information including routing information directing devices receiving the data packets where to send the data packets and for what devices the data packets are intended, information about protocols used to package the data packets, and similar information. The payload part of the data packet includes the information requested or for use by a device in a network. The physical layer defines the actual sending of the data on the network such as by electrical impulses, fiber-optic light beams, radio signals etc. Thus, at the physical layer, actual voltages, light levels and radio levels or frequencies are defined as having certain logical values.
The interconnectivity of LANs presents the challenge of preventing unauthorized users from gaining access to clients. Additionally, the large amounts of data that can be transmitted in modern networks often requires the ability to analyze large amounts of network traffic to troubleshoot network problems. There is also often the need to document and categorize network traffic, including information such as to where the network traffic is being directed and the most active times on network.
One way of monitoring network traffic to prevent unauthorized interception of the network traffic, to analyze the network traffic for troubleshooting, and to document network traffic, involves the use of a tap. The tap may be connected to a link that is associated with or a part of, the hub or router. Commonly available taps are passive devices that simply allow for monitoring network traffic. In one example, a copy, or all data on the network passes through the tap. The taps do not act as an interactive client on the network. The taps may be further connected to a data analyzer, or an intrusion detection system (IDS) that monitors for unauthorized clients on the network.
While taps are useful for providing access to and gathering network traffic, which enables it to be analyzed and monitored, they have the unfortunate drawback of, in many cases, representing a hole or leak in the network. An unauthorized user may connect a network analyzer or other network traffic collection device to the tap, allowing the aunauthorized user to capture and misappropriate the network traffic. This may result in the loss of sensitive information such as trade secrets, financial information or other protected data. Commonly, the only protection afforded to the tap may be by nature of the physical location where the tap resides, such as in a locked closet or other secure location. Thus, any unauthorized user who gains access to the physical location may be able to misappropriate the network traffic.
While these problems have been framed in the context of a tap connection on a router or hub, similar problems plague other network connections as well, thus the solutions and advantages achieved by embodiments of the present invention are not limited to communications between a tap and another device. Other devices commonly used on networks to interconnect devices on the networks are hubs and routers. As discussed previously, hubs and routers provide a means for interconnecting a group of clients on a network. The hubs and routers generally provide ports where clients can connect for sending and receiving network data. A hub operates by receiving data and repeating that data to other ports on the hub. A hub serves as an especially vulnerable point in a network where network data may be misappropriated. By connecting to one of the ports that repeats the data on the network, an intruder may misappropriate network data. Routers are somewhat more secure in that a router routes information on a network to a port where a device for which the data is intended is located. Nonetheless, an intruder may be able to connect to a router by spoofing (i.e. pretending to be) an address allowed by the router to be on the network. The intruder will then have access to data intended for the address which the intruder has spoofed. Thus, hubs and routers represent another leak where network data may be misappropriated.
One embodiment of the invention includes a method for establishing a secure point to point link. The method includes initiating a trusted link by authenticating a trusted partner. Authenticating a trusted partner may involve, for example, verifying a key sent from the trusted partner or exchanging keys with the trusted partner. The method also includes encrypting data to be sent on the trusted link. Encrypting may be done, for example, by using a hardware embedded encryption key or random or pseudorandom encryption key generated by a random or pseudorandom generator using a hardware embedded key. The method also includes sending the encrypted data on the trusted link. The method further includes policing the trusted link by verifying that the trusted partner remains connected to the trusted link and that other un-trusted clients are not connected to the trusted link. If the trusted partner becomes disconnected, or if an un-trusted client is connected to the trusted link, the method includes ceasing to send data on the trusted link.
Another embodiment of the invention includes a secure network interface device for use in a secure point to point link. The network interface device includes a first interface configured to receive encrypted network traffic. The network interface device also includes logic to decrypt the encrypted network traffic. The logic includes a hardware embedded encryption key matched to a network device that sends the encrypted network traffic. The a network interface device also includes a second interface adapted to connect to a host and to deliver the decrypted network traffic to the host device.
Yet another embodiment of the invention includes a secure network traffic distribution device for use in a secure point to point link. The secure network traffic distribution device includes an input configured to receive network traffic. The secure network traffic distribution device also includes an encryption module attached to the input. The encryption module includes a first hardware embedded encryption key used to encrypt network traffic. The first hardware embedded encryption key is matched to a device that is configured to receive encrypted network traffic from the secure network traffic distribution device. The secure network traffic distribution device also includes an output port coupled to the encryption module. The output port is configured to transmit encrypted network traffic.
Some embodiments of the invention allow for secure point to point communication by sending data only between known devices on the network. As a further security measure, encryption, in some cases of both payload data and header data, prevents reading of the network traffic. Thus unauthorized or un-trusted devices are not able to misappropriate network traffic.
These and other advantages and features of the present invention will become more fully apparent from the following description and appended claims, or may be learned by the practice of the invention as set forth hereinafter.
To further clarify the above and other advantages and features of the present invention, a more particular description of the invention will be rendered by reference to specific embodiments thereof which are illustrated in the appended drawings. It is appreciated that these drawings depict only typical embodiments of the invention and are therefore not to be considered limiting of its scope. The invention will be described and explained with additional specificity and detail through the use of the accompanying drawings in which:
Embodiments of the present invention establish a secure or trusted point to point link by using a trusted point to point link between a pair of trusted devices. To maintain the trusted point to point link, methods disclosed herein operate by authenticating points in the link, encrypting data sent across the link, and policing the link to ensure that trusted partners are not removed or replaced with unauthorized devices. If an unauthorized device is added to or discovered in the link, embodiments of the invention will cease communication to prevent unauthorized interception of the network traffic. These secure point to point links can be used in combination with taps to substantially prevent unauthorized access to network data.
Secure network taps configured and used as disclosed herein provide the benefit of permitting convenient access to network data for purposes of monitoring or analyzing by authorized users, while substantially preventing unauthorized users from gaining such access. The secure point to point links can also be used with secure switches, routers and hubs for creating networks where secure links exist between network interface devices connected to the switches, routers or hubs. Secure host bus adapters provide one way of creating secure points in a point to point link. For example, secure host bus adapters may be added to a router, hub, client or other network device.
Referring now to
The connection points and trusted partners may exchange passwords or keys only available to trusted partners or connection points. This exchange may be accomplished in a number of ways. Some embodiments of the invention use an out of band data link, where authentication data is sent separately from high-speed data. The term “high-speed data,” as used herein, does not refer to any particular defined bandwidth or frequency of data. Rather, high-speed data refers to data typically transmitted on a network such as the data typically transmitted for the benefit of the various hosts on a network. High-speed data may be, for example, captured network traffic. In one example, an authentication connection dedicated to authentication data may be used to exchange passwords or keys. In this example, authentication logic, which is used to transmit and receive authentication information, is connected to the authentication connection. Logic as used herein may be programming code and/or associated hardware. Further, the logic may include analog circuitry and processing and is not necessarily limited to digital functions.
According to other embodiments, the authentication information may be sent on the trusted link 112, thus obviating the need for a separate authentication link. Sending authentication information on the trusted link 112 may be accomplished in a number of different ways. For example, when a trusted partner 118 is first connected to the trusted link 112, high-speed data flows from the trusted partner 118 to the first connection point 102, thus allowing the first connection point to authenticate the trusted partner 118. If the trusted partner 118 is an acceptable device to send network traffic to, the high-speed data flow reverses and flows from the first connection point 102 to the trusted partner 118 thus allowing for transfer of network traffic.
Encryption keys that are embedded in the hardware of the first connection point 102 and the trusted partner 118 are used to encrypt network traffic that can be sent on the trusted link 112. Encrypting may include scrambling the network traffic by using an algorithm that utilizes the hardware embedded encryption key. By embedding the encryption keys in the hardware, as opposed to implementing the encryption keys in software, the encryption algorithm can be made more secure and efficient. In another example, a random or pseudorandom encryption key is generated using a generation algorithm that makes use of. a hardware embedded encryption key. Devices that do not specifically have certain information embedded in the hardware of the device are not able to generate the correct random or pseudorandom encryption key. The random or pseudorandom encryption key is created each time a trusted partner 118 is connected to the trusted link 112. In addition to being used to encrypt network traffic, the random or pseudorandom encryption key may also be used in the authentication process. If a partner cannot create the correct random or pseudorandom encryption key, the first connection point 102 recognizes that the partner is not, a trusted partner. As such, if a trusted partner 118 is disconnected and replaced with an unauthorized device 116, the unauthorized device 116 nonetheless can be recognized as an unauthorized device when the first connection point 102 attempts to authenticate the unauthorized device 116.
The first connection point 102 includes an encryption module 104. The module 104 may be embodied, for example, as programming code and/or associated computer hardware. The encryption module 104 encrypts both the payload 106 and the header 108 of data packet 110 such that the data packet 110 is unreadable by ordinary network devices. This encryption is done using an encryption algorithm that uses for example, a hardware embedded encryption key or randomly generated encryption key. Exemplary encryption algorithms include encryption algorithms using keys, public/private keys and the like.
The data packet 110 shown in
In one embodiment, the first connection point 102 polices the trusted link 112 using policing logic by constantly or periodically monitoring the trusted link 112 for suspicious activity. When the first connection point 102 discovers the existence of the unauthorized device 116, the first connection point 102 may cease communications across the trusted link 112. This prevents the unauthorized interception of network traffic. Once the unauthorized device 116 has been removed from the trusted link 100, the first connection point 102 can reauthenticate the trusted partner 118 and reestablish communications across the trusted link 112.
In one embodiment, an unauthorized device 116 that attempts to misappropriate the network traffic may be discovered by using digital diagnostics. For example, a device, such as the first connection point 102, may monitor the trusted link 112 to determine that a trusted partner 118 has been unplugged from the trusted link 112 or that another device is attempting to be plugged into the trusted link 112. In the case where the trusted link 112 is an optical link, loss of optical signal power may indicate that an unauthorized device 116 has been added to the trusted link 112 or that the physical layout has been changed, such that an optical fiber has been bent away from a trusted partner 118. Alternately, the first connection point 102 may periodically authenticate the trusted partner 118. As used herein, the term “periodically” refers to the act being performed more than once or in successive instances and does not necessarily imply regular or uniform intervals. Illustratively, a trusted partner 118 periodically exchanges or sends authentication information on an out of band or authentication connection.
In the embodiment shown in
As shown in
During operation of tap 400, the network traffic passes through the firewall 402 into a RJ-45 connector 406. The network traffic passes through a relay 408 that is configured such that, if there is no system power to the optical tap 400, the network traffic is routed through the relay 409, the RJ-45 connector 407 and to the Ethernet switch 404. In this way, the data link is never broken even when the tap 400 is without power. When the tap 400 is powered, the network traffic passes through the relay 408 to a transformer 410. The transformer 410 provides, in this example, the isolation and common mode filtering required to support category five UTP cables for use in Ethernet 100/1000 base T duplex applications. The transformer 410 facilitates simultaneous bi-directional transmission on a twisted pair by performing echo cancellation. The network traffic is passed from the transformer 410 to a physical layer device 412. The physical layer device 412 is part of layer 1 of 7 in the OSI model. The physical layer device 412 defines the protocols that govern transmission media and signals. A suitable PHY chip for use as part of the physical layer device 412 is made by Broadcom Corporation, of Irvine, Calif. The chip, part number BCM5464S, has four fully integrated 10BASE-T/100BASE-TX/1000BASE-T Gigabit Ethernet transceivers. The network traffic is passed from the physical layer device 412 to a fanout buffer 414. The fanout buffer, in one embodiment, is a logical chip that takes one differential signal as an input and creates a number of duplicate outputs. In this way, multiple copies of a tapped signal may be output. In one embodiment, up to five duplicate outputs may be implemented on a single fanout buffer. From fanout buffer 414, the network traffic is routed into two different directions.
In the example shown in
A second output of the fanout buffer 414 is fed into the second physical device 413 which is then fed into a transformer 411, relays 409 and to a RJ-45 connector 407. Data going from the Firewall to the Ethernet switch uses this data path while data from the Ethernet switch to the Firewall uses the data path from fanout buffer 415 to PHY 412 to transformer 410 to relays 408 to RJ-45 connector 406.
In the example shown in
The secure tap 400 also includes means for performing the function of managing the encryption and decryption module 422 on the FPGA 420. Corresponding structure is shown where the FPGA 420 is connected to a CPU module 434 that is further connected to a management port 436 that comprises a network connector. A management computer 438 may be connected to the management port 436 for controlling the FPGA 420. In one embodiment, Gn the hardware embedded encryption keys described previously may be in firmware, such as a flash ROM. Through the management port, the hardware embedded encryption keys may be changed or updated. Additionally, other types of tap management may be performed through the management port 436.
The embodiment shown in
Embodiments of the present invention are not limited to secure links between a network tap and a secure NIC, secure network analyzer or similar device. Other embodiments of the invention extend to secure network traffic distribution devices embodied for example in
Referring now to
The FPGA 920 can be connected to a programmable integrated circuit (PIC) 970. The PIC 970 measures temperature, supply voltages and holds specific product data. Such product data may include product operating parameters, model numbers, output and input specifications and so forth.
In one embodiment of the invention, the FPGA 920 has various connections to a CPU module 934. One such connection may be through a PCI bus 980. The CPU module 934 may communicate various commands to the FPGA 920 through the PCI bus 980, such as how the secure tap 900 should be configured, how to route packets in a package distribution machine 950, communication of encryption keys to encryption module 952, control information for the physical layer devices 912 and 913, the relays 908 and 909, etc. In addition, or as an alternative, to receiving configuration information from an RJ-45 configuration port 936 a serial port 982 or other device may be used to configure IP addresses and control the secure tap 900.
The CPU module may also include a parallel port 984 for communicating with and/or reprogramming the FPGA 920. The parallel port 984 transmits code to a complex programmable logic device (CPLD) 986, which is a programmable circuit similar to an FPGA but smaller in scale. The CPLD 986 may transmit the code to an EEPROM 988 where the code would be loaded into the FPGA 920 at the appropriate time.
The term “high-speed data,” as used herein, does not refer to any particular defined bandwidth or frequency of data. Rather, high-speed data refers to data typically transmitted ran on a network such as the data typically transmitted for the benefit of the various hosts on a network. High-speed data may also be referred herein as in-band data which is a reference to the communication band typically used by host systems to communicate data. High-speed and in-band data are distinguished from out-of-band data which is typically used to transmit data from transceiver to transceiver for the use of the transceivers. While a host may subsequently receive the out-of-band data, the host usually receives the out-of-band data from a transceiver through an IC bus such as an I2C or MDIO bus. This is contrasted to high-speed data which is typically received by a host from a transceiver through some type of high-speed data interface. Notably, a host may also produce the out-of-band data and transmit the out-of-band data to a transceiver on an IC bus.
As illustrated in
Several different modulation schemes exist for modulating the authentication and policing data. For example, an amplitude modulated signal may communicate binary data bits from the tap 1002 to the trusted partner 1004. Other types of modulations may also be used including, but not limited to, binary phase shift keying, quadrature phase shift keying, non return to zero (NRZ) encoding, Manchester encoding and other types of keying.
The modulation scheme shown in
Referring again to
The authentication and policing data may be extracted by using a standard infrared television remote control decoder. For example, IR receivers T2525, T2527 and U2538B available from Atmel Corporation in San Jose, Calif. may be used to decode the authentication and policing data.
Various other embodiments of the invention exist. For example,
Referring now to
The encrypted optical signal is sent to a secure host bus adapter 1516. The secure host bus adapter 1516 includes a second secure SFP module 1518. The second secure SFP module 1518 includes a photodiode 1520 that receives the encrypted optical signal and converts it to an encrypted electrical signal. The encrypted electrical signal is fed into a decryption and authentication module 1522 that includes a hardware embedded key matched to the hardware embedded key of the first secure SFP module 1502. The decryption and authentication module 1522 also includes logic to decode the encrypted electrical signal into the network traffic that was originally captured by the secure tap 1504. The unencrypted network traffic may then be sent through an interface, such as an edge connector 1524 that interfaces the second secure SFP module 1518 to the secure host bus adapter 1516. The secure host bus adapter 1516 can then route the network traffic through an interface such as a PCI interface 1526, to a host device such as an IDS, network analyzer and the like.
The encryption module 1510 and decryption and authentication module 1522 may incorporate logic, including encryption algorithms, embodied in chips produced by LayerN of Austin, Tex. Authentication of the secure tap 1504 and secure host bus adapter 1516 may be accomplished by authentication logic in the decryption and authentication module 1522 of the second secure SFP module 1518 and a decryption and authentication module 1528 in the first secure SFP module 1502.
Policing of the secure link may be accomplished using digital diagnostic logic contained in the first and second secure SFP modules 1502, 1518. For example, the secure SFP modules may contain appropriate hardware and software for monitoring power on the secure link. Alternatively, the digital diagnostics may monitor other characteristics such as hardware encoded encryption keys and the like. Digital diagnostic information can include details of the specific functioning of components within SFP modules 1502, 1518 such as laser diodes 1512, 1530 and the photodiodes 1520, 1532. A memory stored on the SFP modules 1502, 1518 may include various parameters such as but not limited to the following:
Other digital signals. A host device may configure the optical module so as to make it compatible with various requirements for the polarity and output types of digital inputs and outputs. For instance, digital inputs are used for transmitter disable and rate selection functions while outputs are used to indicate transmitter fault and loss of signal conditions. The configuration values determine the polarity of one or more of the binary input and output signals. In some optical modules, these configuration values can be used to specify the scale of one or more of the digital input or output values, for instance by specifying a scaling factor to be used in conjunction with the digital input or output value.
While these digital diagnostic values may be used to optimize performance of the SFP modules 1502, 1518, they may also be used as a “digital fingerprint” for verifying the identity of a particular SFP module. Thus, secure connections can be implemented using various digital diagnostic parameters.
The present invention may be embodied in other specific forms without departing from its spirit or essential characteristics. The described embodiments are to be considered in all respects only as illustrative and not restrictive. The scope of the invention is, therefore, indicated by the appended claims rather than by the foregoing description. All changes which come within the meaning and range of equivalency of the claims are to be embraced within their scope.
This application claims the benefit of U.S. Provisional Application No. 60/524,216, filed Nov. 21, 2003 titled “Secure Network Access Devices With Data Encryption,” which is incorporated herein by reference.
| Number | Date | Country | |
|---|---|---|---|
| 60524216 | Nov 2003 | US |
