Methods for internet communication security
The present disclosure relates to network security software cooperatively configured on plural nodes to authenticate and authorize devices, applications, users, and data protocol in network communications by exchanging nonpublic identification codes, application identifiers, and data type identifiers via pre-established communication pathways and comparing against pre-established values to provide authorized communication and prevent compromised nodes from spreading malware to other nodes.
1. A product for securing communications of a plurality of networked computing devices, the product comprising a non-transitory computer-readable storage medium having computer-readable program code embodied therein, the computer-readable program code executable by a processor to perform communication management operations, the communication management operations comprising:
i) consuming a first network packet to obtain a first payload and a destination port number, the destination port number assigned to a destination port on one of the plurality of networked computing devices;
ii) confirming the first payload conforms to at least one of a data model pre-assigned to the destination port number;
iii) after confirmation that the first payload conforms to the data model for the destination port, forming a second network packet comprising a second payload, and at least one of a local program identification code, and a data model identification code; and
iv) executing at least one instruction to send the second network packet to network security software to the destination port on the one of the plurality of networked computing devices via a secure communication pathway.
2. The product of claim 1 , wherein the secure communication pathway is encrypted by series of rotated cryptographic keys.
3. The product of claim 1 , wherein the communication management operations further comprise verifying that a local program to which the local program identification code refers is specifically authorized to receive data to the destination port.
4. The product of claim 1 , wherein at least a portion of the communication management operations are configured to be performed in a processor-accessible kernel space.
5. The product of claim 1 , wherein the one of the plurality of networked computing devices is a remote computing device.
6. The product of claim 1 , wherein the local program identification code is an identification code for local network security software, the local network security software performing at least one of the communication management operations.
7. The product of claim 1 , wherein the consumed first network packet is received from a first NIC, wherein the secure communication pathway is configured to not traverse the first NIC.
8. The product of claim 1 , wherein the consumed first network packet is received at a first port, wherein the second network packet is sent from a second port, the second port different from the first port.
9. The product of claim 1 , wherein the second payload comprises part or all of the first payload.
10. The product of claim 1 , wherein the second payload is at least partially derived from the first payload.
11. The product of claim 1 , wherein the data model comprises at least one data type.
12. The product of claim 1 , wherein the data model comprises at least one data range.
13. The product of claim 1 , wherein the data model comprises a list of at least one allowed command type.
14. The product of claim 1 , wherein the data model comprises at least one prohibited command type.
15. The product of claim 1 , wherein the communication management operations further comprise intercepting a network connection request from a first port assigned to the local program, the network connection request comprising a second port number for a network security software port on the one of the plurality of networked computing devices.
16. The product of claim 15 , wherein the second network packet is addressed to the second port number.
17. The product of claim 1 , wherein the communication management operations further comprise: translating, prior to forming the second network packet, the second payload to a pre-established format expected by the one of the plurality of networked computing devices.
18. The product of claim 17 , wherein the communication management operations comprise determining the pre-established format based on data model identification code.
19. The product of claim 1 , wherein the secure communication pathway is formed by further communication management operations, the further communication management operations comprising:
a) sending a nonpublic first identification code to the network security software via a pre-established communication pathway;
b) receiving, in response to the sending, a nonpublic second identification code for the one of the plurality of networked computing devices; and
c) comparing the nonpublic second identification code with a pre-established value for the one of the plurality of networked computing devices.
20. The product of claim 19 , wherein the pre-established communication pathway has a one-to-one correspondence to an n-tuple comprising the local program identification code, the destination port number, and a data model identification code.
21. The product of claim 19 , wherein the further communication operations comprise:
a) sending the local program identification code to the network security software via the pre-established communication pathway;
b) receiving, in response to the sending, a remote application identification code for a remote application program; and
c) comparing the remote application identification code with a pre-established value for the remote application program.
22. The product of claim 21 , wherein the further communication management operations comprise:
a) sending the data model identification code for the pre-established communication pathway to the network security software via the pre-established communication pathway;
b) receiving, in response to the sending, the data model identification code; and
c) comparing the received data model identification code with a pre-established value for the pre-established communication pathway.
23. The product of claim 22 , wherein the local program identification code and the data model identification code are sent to the one of the plurality of networked computing devices in a single network packet.
24. The product of claim 22 , wherein the comparing the nonpublic second identification code, the comparing the remote application identification code, and the comparing the received data model identification code are performed prior to any communication of application data to the remote application program.
25. The product of claim 22 , wherein the formed second network packet comprises the data model identification code.
26. The product of claim 22 , wherein the remote application identification code and/or the data model identification code are located in a higher-than-OSI layer three and lower-than-OSI layer seven portion of the second network packet.
27. The product of claim 22 , wherein the comparing the nonpublic second identification code, the comparing the remote application identification code, and/or the comparing the received data model identification code are configured to be initiated in kernel space accessible by the processor.