Methods for internet communication security
The present disclosure relates to network security software cooperatively configured on plural nodes to authenticate and authorize devices, applications, users, and data protocol in network communications by exchanging nonpublic identification codes, application identifiers, and data type identifiers via pre-established communication pathways and comparing against pre-established values to provide authorized communication and prevent compromised nodes from spreading malware to other nodes.
1. A product for securing communications of a plurality of networked computing devices, the product comprising a non-transitory computer-readable storage medium having computer-readable program code embodied therein, the computer-readable program code executable by a first computing device of the plurality of networked computing devices to perform communication management operations, the communication management operations comprising:
i) forming a configured communication pathway by configuring a pre-established communication pathway to exclusively communicate application data between a first user-application on the first computing device and a second user-application on a second computing device of the plurality of networked computing devices, the first user-application operated by a first user and the second user-application operated by a second user, the configuring comprising:
a) sending a first configuration packet from the first computing device to the second computing device via the pre-established communication pathway, the first configuration packet containing a nonpublic first device identifier for the first computing device in an application layer portion of the first configuration packet;
b) receiving a second configuration packet from the second computing device, the second configuration packet containing a nonpublic second device identifier for the second computing device in an application layer portion of the second configuration packet;
c) confirming, in a kernel space of the first computing device, that the second computing device is authorized to communicate with the first user-application, comprising: matching the nonpublic second device identifier to a preconfigured nonpublic second device code for the second computing device;
d) further sending a third configuration packet from the first computing device to the second computing device via the pre-established communication pathway, the third configuration packet containing a nonpublic first user-application identifier in an application layer portion of the third configuration packet, wherein the nonpublic first user-application identifier is exclusive to the first user-application and the second user-application;
e) further receiving a fourth configuration packet from the second computing device, the fourth configuration packet containing a nonpublic second user-application identifier in an application layer portion of the fourth configuration packet; and
f) further confirming, in the kernel space of the first computing device, that the second user-application is authorized to receive outgoing application data from the first user-application via the configured communication pathway, comprising: further matching the nonpublic second user-application identifier to a preconfigured nonpublic second user-application code, wherein the preconfigured nonpublic second user-application code is exclusive to the second user-application and the first user-application;
ii) preventing any transport layer ports used by the configured communication pathway from being used by any other communication pathway;
iii) verifying that incoming application data received via the configured communication pathway conforms to a plurality of content requirements, the plurality of content requirements comprising:
a) a data type;
b) a data range; and
c) a command type authorized to be present in the incoming application data; and
iv) passing the verified incoming application data to the first user-application;
wherein the nonpublic first user-application identifier is unique to the first user-application, the first user, and the plurality of content requirements;
wherein the preconfigured nonpublic second user-application code is unique to the second user-application, the second user, and the plurality content requirements; and
wherein files containing values for the nonpublic first device identifier, the preconfigured nonpublic second device code, the nonpublic first user-application identifier, and the preconfigured nonpublic second user-application code are sent to the first computing device and to the second computing device from a provisioning server prior to performing the communication management operations.
2. The product of claim 1 , wherein the plurality of content requirements comprises a command type that is prohibited from being present in the incoming application data.
3. The product of claim 1 , wherein the communication management operations further comprise:
i) interrupting, on the first computing device, a connection request from the first user-application that requests a connection with a transport layer destination port that is assigned to the second user-application, the connection request comprising a destination port number for the destination port;
ii) decrypting an encrypted read-only file and identifying a data record in the file that contains the destination port number in a destination port number field of the identified data record in the file, the file stored locally on the first computing device; and
iii) verifying, in the kernel space of the first computing device, that the nonpublic first user-application identifier is present in a local user-application identification field of the identified data record and that the received nonpublic second user-application identifier is present in a remote user-application identification field of the identified data record.
4. The product of claim 3 , wherein the identified data record is the only data record in the file that contains the destination port number in the destination port number field.
5. The product of claim 3 , wherein the communication management operations prevent all user-applications on the first computing device from directly connecting to remote computing devices.
6. The product of claim 3 , wherein the communication management operations redirect all requests from user-applications on the first computing device to connect to remote computing devices to a loopback interface.
7. The product of claim 3 , wherein the communication management operations executed on the first computing device further comprise:
i) receiving a series of further network packets, the series of further network packets comprising (a) the incoming application data, and (b) encrypted parameters in application layer portions of the further network packets;
ii) decrypting, in the kernel space of the first computing device, the encrypted parameters using decryption keys to obtain decrypted parameters; and
iii) confirming that the decrypted parameters match the nonpublic second user-application code prior to passing the incoming application data to the first user-application.
8. The product of claim 3 , wherein the communication management operations executed on the first computing device further comprise:
i) receiving a series of further network packets, the series of further network packets comprising (a) at least portions of the incoming application data, and (b) encrypted parameters in application layer portions of the further network packets;
ii) decrypting, in the kernel space of the first computing device, the encrypted parameters using decryption keys to obtain decrypted parameters; and
iii) confirming that the decrypted parameters match the nonpublic second user-application code prior to passing the at least portions of the incoming application data to the first user-application.
9. The product of claim 8 , wherein the series of further network packets comprise all communications of user space data via the configured communication pathway.
10. The product of claim 8 , wherein the nonpublic first user-application identifier is further exclusive to one or more content requirements for the outgoing application data.
11. The product of claim 8 , wherein the decryption keys are not applied to the incoming application data.
12. The product of claim 8 , wherein the decryption keys are a series of different single-use decryption keys.
13. The product of claim 3 , wherein the communication management operations configure the pre-established communication pathway to form the configured communication pathway prior to transmitting any of the outgoing application data.
14. The product of claim 3 , wherein the identified data record further comprises a flag in a flag field of the data record, the flag specifying whether the configured communication pathway is authorized for unidirectional or bidirectional data flow between the first user-application and the second user-application.
15. The product of claim 3 , wherein the communication management operations further comprise:
i) receiving a further network packet, the further network packet comprising (a) at least a portion of the incoming application data, and (b) an encrypted parameter in an application layer portion of the further network packet;
ii) decrypting, in the kernel space of the first computing device, the encrypted parameter using a decryption key to obtain a decrypted parameter; and
iii) confirming that the decrypted parameter matches the nonpublic second user-application code prior to passing the at least a portion of the second application data to the first user-application.
16. The product of claim 1 , wherein the communication management operations further comprise translating the outgoing application data from a first pre-established format to a second pre-established format.
17. The product of claim 1 , wherein the pre-established communication pathway is a TCP connection.
18. The product of claim 1 , wherein the nonpublic first device identifier has a size of at least 2048 bits, wherein at least 90% of the nonpublic first device identifier is a randomly generated number.
19. The product of claim 1 , wherein the nonpublic first user-application identifier comprises an application identifier for the first user-application, a process owner identifier for the first user, and a randomly generated number.
20. The product of claim 1 , wherein the configuring comprises: verifying that an authorized functional counterpart of the computer-readable program code is running on the second computing device.
21. The product of claim 20 , wherein the configured communication pathway uses a dedicated transport layer port for a process that performs at least a portion of the communication management operations in the kernel space of the first computing device.
22. The product of claim 21 , wherein the configured communication pathway uses a dedicated transport layer for a functional counterpart of the computer-readable program code on the second computing device.
23. The product of claim 1 , wherein the computer-readable program code comprises at least one kernel loadable module.
24. The product of claim 1 , wherein the first user-application is industrial control software.
25. The product of claim 1 , wherein the communication management operations further comprise: translating the incoming application data to a format expected by the first user-application.
26. The product of claim 1 , wherein the first computing device is a mobile device.
27. The product of claim 1 , wherein a portion of the communication management operations are configured for execution in an application space of the first computing device.
28. The product of claim 1 , wherein the nonpublic first device identifier, the nonpublic first user-application identifier, the nonpublic second device code, and the nonpublic second user-application code are shared secrets between the first computing device and the second computing device.
29. The product of claim 1 , wherein the communication management operations comprise: evaluating all application layer payloads in incoming network packets for conformity with the plurality of content requirements.