Methods for zero trust security with high quality of service
The present disclosure relates to network security software cooperatively configured on plural nodes to monitor, alert, authenticate, and authorize devices, applications, users, and data protocol in network communications by exchanging nonpublic identification codes, application identifiers, and data type identifiers via pre-established communication pathways and comparing against pre-established values to provide authorized communication and prevent compromised nodes from spreading malware to other nodes.
1. An edge device comprising a network interface controller (NIC) , a hardware processor, a communication parameters file, and software components executable by the hardware processor, the software components comprising:
i) a networking stack;
ii) an application program comprising an API command to the networking stack; and
iii) a network security program executable to perform communication management operations, the communication management operations comprising:
a) authorizing one or more networking stack functions triggered by the API command, comprising:
I) obtaining an application identifier and process owner associated with an instance of the application program, and further obtaining a port number and a NIC address associated with the API command;
II) parsing the communication parameters file to obtain a nonpublic application code and a nonpublic user code associated with the port number paired with the NIC address; and
III) confirming the nonpublic application code corresponds to the application identifier and further confirming the nonpublic user code corresponds to the process owner; and
b) forming a configured network communication pathway between the application program instance and a remote program operated by a remote user on a remote device, comprising:
I) sending a first configuration packet from the device to the remote device, the first configuration packet containing a nonpublic device identifier for the device in a portion of the first configuration packet;
II) receiving a second configuration packet from the remote device, the second configuration packet containing a first remote parameter in a first portion of the second configuration packet and a second remote parameter in a second portion of the second configuration packet; and
III) matching the first remote parameter to a nonpublic remote application code that is associated with the port number in the communication parameters file, and further matching the second remote parameter corresponds to a nonpublic remote user code that is associated with the port number in the communications parameter file,
wherein the communication management operations further comprise: preventing the port number from being used by any communication pathway except for the configured network communication pathway.
2. The device of claim 1 , wherein the API command is a bind command.
3. The device of claim 1 , wherein the API command is a connect command.
4. The device of claim 1 , wherein the configured network communication pathway is at least partially encrypted.
5. The device of claim 1 , wherein the network security program is installed during production of the device.
6. The device of claim 1 , wherein the obtaining is performed in a kernel space of the edge device.
7. The device of claim 1 , wherein the confirming is performed in a kernel space of the edge device.
8. The device of claim 1 , wherein the communication management operations further comprise: preventing all user-applications on the edge device from directly connecting to remote computing devices.
9. The device of claim 1 , wherein the communication management operations further comprise:
i) receiving a series of further network packets, the series of further network packets comprising (a) application data, and (b) encrypted parameters in application layer portions of the further network packets;
ii) decrypting the encrypted parameters using decryption keys to obtain decrypted parameters; and
iii) verifying that the decrypted parameters match the nonpublic remote application code prior to passing the application data to the application program.