Platform and method for automated moving target defense
View Patent ↗The present invention is a system and method for machine-to-machine communication in a Zero Trust environment. The instant invention describes a platform implementation that disables threat actors and their methods that target workload credentials. The platform is an Automated Moving Target Defense (AMTD) platform that creates sidecars that contain algorithms for creating secure keys from user specified dynamic elements, a machine alias ID (MAID), an encryption library, and an envoy proxy. The sidecars are utilized to control access to, and secure messaging traffic between, entities in a non-trusted environment.
1. A system for secure message traffic communication comprising:
an automated moving target defense (AMTD) platform server device initiating a sidecar container at two or more message traffic endpoints;
each of said sidecar containers querying a central location to retrieve identical Code Hidden in Plain Sight (CHIPS) algorithms and one or more dynamic secret elements;
each of said sidecar containers querying a central location to retrieve both lease and time-to-live timing values;
each of said sidecar containers creating an identical ephemeral symmetric secret value;
each of said sidecar containers utilizing said ephemeral symmetric secret values to create an original Machine Alias ID (MAID) at each of said message traffic endpoints;
each of said sidecar containers active to modify or update each of said original MAIDs upon expiration of lease and time-to-live timing values utilizing said identical CHIPS algorithm in each sidecar to create rotated MAIDs;
said AMTD creating an identity trust chain where each Sidecar rotates its machine alias ID (at a defined number of sessions or an expiration of a defined time period) to a new alias derived from its original machine ID alias, one or more of its previous machine ID aliases, its current machine ID alias, and a pre-established time value;
each of said sidecar containers active to encrypt message workload utilizing said ephemeral symmetric secret value;
said AMTD platform transmitting said message workload among said message traffic endpoints;
each endpoint sidecar receiving said message workload decrypting said message workload utilizing said ephemeral symmetric secret and providing said message workload to a user.
2. The system of claim 1 , where the sidecar container comprises at least one CHIPs algorithm, one or more MAIDs, and AES256 encryption library file, and an envoy proxy.
3. The system of claim 2 , where each sidecar container is deployed to two or more servers or networked locations for facilitate transmission of message workload traffic.
4. The system of claim 1 , where each of said sidecars initializes identical MAID values at the beginning of a secure communication action.
5. The system of claim 1 , where each message workload transmission is recorded in a MAID session log in an electronic storage element in said AMTD server.
6. The system of claim 1 , further comprising said AMTD server creating and managing a customer workload session count meter to track message workload traffic.
7. The system of claim 1 , where said CHIPS algorithms remain within each Sidecar and are never exposed or transmitted.