Granted Patent B2

US 8,621,594 · App. 13/100,788 · Granted Dec 31, 2013

Abstract

Claims (63)

1. A secure network communication method, the method comprising:

accessing, by a secure switch, a secure network communication agreement between a first entity and a second entity;

generating, by the secure switch, a first virtual private proxy and a second virtual private proxy;

establishing a first secure connection between the first virtual private proxy and the first entity;

prohibiting remote connections to the first entity other than the first secure connection;

establishing a second secure connection between the second virtual private proxy and the second entity;

establishing a logical connection between the first virtual private proxy and the second virtual private proxy; and

generating an alarm when transaction data transmitted over the logical connection is not in compliance with the agreement.

2. The method of claim 1 , wherein establishing the first secure connection occurs in response to receiving a connection request from a private session manager.

3. The method of claim 1 , wherein generating the alarm further comprises:

generating alarm data selected from a portion of the transaction data that is not in compliance with the agreement, a portion of the agreement associated with the alarm, data indicative of a source of the transaction data that is not in compliance with the agreement, and data indicative of a time associated with the alarm.

4. The method of claim 1 , further comprising:

evaluating whether the transaction data is explicitly allowed by the agreement; and

generating the alarm when the transaction data is not explicitly allowed by the agreement.

5. The method of claim 1 , further comprising:

evaluating whether the transaction data is explicitly forbidden by the agreement; and

generating the alarm when the transaction data is explicitly forbidden by the agreement.

6. The method of claim 5 , wherein transaction data that is explicitly forbidden by the agreement includes data selected from executable data, data indicative of a signature of a malicious program, and data indicative of an intrusion attempt.

7. The method of claim 1 , wherein the agreement specifies a parameter selected from a timeout value, a transport protocol, a transport security protocol, and a document exchange protocol.

8. The method of claim 1 , further comprising:

receiving first electronic commerce information for the first entity and second electronic commerce information for the second entity; and

modifying the agreement based on the first electronic commerce information and the second electronic commerce information.

9. A secure switch, comprising:

a processor configured to access storage media including program instructions, executable by the processor, the program instructions including instructions to:

access an agreement for secure network communication between a first entity and a second entity, the agreement based on a first profile for the first entity and a second profile for the second entity;

generate a first virtual private proxy and a second virtual private proxy;

establish a first secure connection between the first virtual private proxy and the first entity;

exclude all remote connections to the first entity other than the first secure connection;

establish a second secure connection between the second virtual private proxy and the second entity;

establish a logical connection between the first virtual private proxy and the second virtual private proxy; and

monitor, for compliance with the agreement, transaction data arriving at the first virtual private proxy and the second virtual private proxy for transmission over the logical connection between the first entity and the second entity.

10. The secure switch of claim 9 , wherein the program instructions include instructions to:

recognize a violation of the agreement when the transaction data is not in compliance with the agreement;

generate alarm data associated with the violation, wherein the alarm data is selected from a portion of the transaction data that is not in compliance with the agreement, a portion of the agreement associated with the violation, an indication of a source of the transaction data associated with the violation, and a time associated with the violation.

11. The secure switch of claim 9 , wherein the program instructions include instructions to:

when the transaction data violates the agreement, block transmission of the transaction data between the first entity and the second entity.

12. The secure switch of claim 9 , wherein the program instructions include instructions to:

when the transaction data complies with the agreement, allow transmission of the transaction data between the first entity and the second entity.

13. The secure switch of claim 9 , wherein the first profile includes electronic commerce information for the first entity and the second profile includes electronic commerce information for the second entity.

14. The secure switch of claim 13 , wherein the program instructions include instructions to:

receive the first profile for the first entity and the second profile for the second entity; and

modify the agreement based on the first profile and the second profile.

15. The secure switch of claim 14 , wherein the instructions to modify the agreement include instructions to generate the agreement.

16. Non-transitory storage media including program instructions for implementing secure network communications at a secure switch, the program instructions including instructions executable to:

access an agreement for secure network communication between a first entity and a second entity, the agreement based on a first profile for the first entity and a second profile for the second entity;

generate a first virtual private proxy and a second virtual private proxy;

establish a first secure connection between the first virtual private proxy and the first entity;

exclude all remote connections to the first entity other than the first secure connection;

establish a second secure connection between the second virtual private proxy and the second entity;

establish a logical connection between the first virtual private proxy and the second virtual private proxy;

monitor, for compliance with the agreement, transaction data arriving at the first virtual private proxy and the second virtual private proxy for transmission over the logical connection;

when the transaction data is not in compliance with the agreement, recognize a violation of the agreement and generate alarm data associated with the violation; and

when the transaction data complies with the agreement, allow transmission of the transaction data between the first entity and the second entity.

17. The storage media of claim 16 , wherein the program instructions include instructions executable to:

when the transaction data is not in compliance with the agreement, block transmission of the transaction data between the first entity and the second entity.

18. The storage media of claim 16 , wherein the alarm data include data selected from a portion of the transaction data that is not in compliance with the agreement, a portion of the agreement associated with the violation, an indication of a source of the transaction data that is not in compliance with the agreement, and a time of the violation.

19. The storage media of claim 16 , wherein the program instructions include instructions executable to:

receive the first profile for the first entity and the second profile for the second entity; and

modify the agreement based on the first profile and the second profile,

wherein the agreement specifies information selected from a timeout value, a transport protocol, a transport security protocol, and a document exchange protocol.

20. The storage media of claim 16 , wherein the program instructions include instructions executable to:

receive a connection request from a private session manager; and

disclose an identifier for the first virtual private proxy only to the private session manager.

Assignments (11)