End point secured network
View Patent ↗The disclosed embodiments include a method for receiving data packets at a host system. In one embodiment, the method includes the steps of: intercepting a data packet, at a data link layer, that is being sent to an input/output (I/O) port of the host system using a hardware device that is located between a hardware network interface and the input/output port of the host system; reading, using the hardware device, at least one parameter from the data packet; determining, by the hardware device using instructions written in memory of the hardware device, whether the at least one parameter meets an authentication criteria, wherein the host system is unable to write to the memory of the hardware device; and in response to determining that the at least one parameter meets an authentication criteria, forwarding, by the hardware device, the data packet to the input/output port of the host system.
1. A method for receiving data packets at a host system, the method comprising:
intercepting a data packet, at a data link layer, that is being sent to an input/output (I/O) port of the host system using a hardware device that is located between a hardware network interface and the input/output port of the host system, wherein the hardware device is internally coupled to the host system;
reading, using the hardware device, at least one parameter from the data packet;
determining, by the hardware device using instructions written in memory of the hardware device, whether the at least one parameter meets an authentication criteria, wherein the authentication criteria includes verifying that the data packet is received from a second host system having a second hardware device that is manufactured by a same manufacture as the hardware device and uses a same scheme as the hardware device, and wherein the host system is unable to write to the memory of the hardware device, and the hardware device executes the instructions written in the memory of the hardware device at an abstraction layer below the host system to prevent access by the host system to the authentication criteria;
in response to determining that the at least one parameter does not meet an authentication criteria, not forwarding, by the hardware device, the data packet to the input/output port of the host system; and
in response to determining that the at least one parameter meets an authentication criteria, forwarding, by the hardware device, the data packet to the input/output port of the host system.
2. The method of claim 1 , further comprising:
prior to reading the at least one parameter, decrypting the data packet using a global key.
3. The method of claim 1 , further comprising:
prior to reading the at least one parameter, decrypting the data packet using a common key derived from a public key and a private key.
4. The method of claim 1 , wherein the host system is unaware of the determining the at least one parameter meets the authentication criteria.
5. The method of claim 1 , wherein the authentication criteria includes a source address.
6. The method of claim 1 , wherein the memory of the hardware device is read-only memory.
7. The method of claim 1 , wherein the instructions written in the memory of the hardware device is written by an external device.
8. A method for sending data packets from a host system, the method comprising:
intercepting a data packet, at a data link layer, that is being sent from an input/output (I/O) port of the host system using a hardware device located between a hardware network interface and the input/output port of the host system, wherein the hardware device is internally coupled to the host system;
reading, using the hardware device, at least one parameter from the data packet;
determining, by the hardware device using instructions written in memory of the hardware device, whether the at least one parameter meets an authentication criteria, wherein the host system is unable to write to the memory of the hardware device, and the hardware device executes the instructions written in the memory of the hardware device at an abstraction layer below the host system to prevent access by the host system to the authentication criteria; and
in response to determining that the at least one parameter meets an authentication criteria, encrypting the data packet using a common key previously established with a destination hardware device, the destination hardware device being manufactured by a same manufacture as the hardware device and using a same scheme as the hardware device, and forwarding the data packet to a network.
9. The method of claim 8 , further comprising:
encrypting the encapsulated data packet.
10. The method of claim 8 , wherein the memory of the hardware device is configured to only be written to by an external device.
11. An apparatus comprising:
a communication interface for communicating with a host system;
memory configured to store instructions, wherein the memory is configured such that the host system cannot make any modifications to the instructions in the memory of the apparatus, and the apparatus executes the instructions stored in the memory of the apparatus at an abstraction layer below the host system to prevent access by the host system to an authentication criteria;
a processor configured to execute the instructions stored in the memory to:
intercept a data packet at the data link layer that is being sent to an input/output (I/O) port of the host system;
read at least one parameter from the data packet;
determine, using data and instructions written in the memory, whether the at least one parameter meets the authentication criteria, wherein the authentication criteria includes verifying that the data packet is receive from a second host system having a second hardware device that is manufactured by a same manufacture as the hardware device and uses a same scheme as the hardware device, and wherein the host system is unable to write to the memory of the apparatus;
in response to determining that the at least one parameter does not meet an authentication criteria, not forwarding, by the hardware device, the data packet to the input/output port of the host system; and
in response to a determination that the at least one parameter meets an authentication criteria, forwarding the data packet to the input/output port of the host system.
12. The apparatus of claim 11 , wherein the apparatus is a network interface controller.
13. The apparatus of claim 11 , wherein the apparatus is a network switch.
14. The apparatus of claim 11 , wherein the processor is further configured to:
prior to reading the at least one parameter, decrypt the data packet using a global key.
15. The apparatus of claim 11 , wherein the processor is further configured to:
prior to reading the at least one parameter, decrypt the data packet using a common key derived from a public key and a private key.
16. The apparatus of claim 11 , wherein the memory is read-only memory.
17. The apparatus of claim 11 , wherein the authentication criteria includes a source address.
18. The apparatus of claim 11 , wherein the host system has no knowledge of the instructions being executed by the apparatus.
19. The apparatus of claim 11 , wherein the instructions written in the memory of the apparatus are configured to only be written to the memory by an external device.