Cryptographic mediation of communication channels for software applications
A method applies secure cryptographic communication between legacy applications and corresponding external services. A user device has one or more processors and memory, and runs a legacy application. The application receives input (e.g., from a user). In response to the input, the application initiates communication over a secure communication protocol to an external service not running on the user device. A client crypto-service encapsulates the communication and provides a secure encrypted tunnel to a server crypto-service, at a server system, in communication with the external service. The server system has one or more processors and memory. The server system receives the encapsulated communication at the server crypto-service and sends the communication to the external service. The server system then receives a response to the communication from the external service and returns the response, through the secure encrypted tunnel, to the user device.
1 . A method of applying secure cryptographic communication between legacy applications and corresponding external services, comprising:
at a user device running a client crypto-service and having one or more processors and memory:
receiving input directed to a legacy application;
in response to the input, and in accordance with a determination that an enforcement policy applies to the legacy application:
initiating, by the legacy application, a connection having a connection protocol over a secure communication protocol to an external service not running on the user device;
establishing, by the client crypto-service, a post-quantum Transport Layer Security (PQ-TLS) connection with a server crypto-service, at a server system, the server crypto-service communicatively connected with the external service;
sending, by the legacy application via the secure communication protocol, an encrypted communication to the external service; and
encrypting the encrypted communication in the client crypto-service to generate a double-encrypted communication, and sending the double-encrypted communication to the server crypto-service, wherein the client crypto-service provides a secure encrypted tunnel, via the PQ-TLS connection, to the server crypto-service;
at the server system running the server crypto-service and having one or more processors and memory:
forwarding the connection protocol to the external service;
receiving the double-encrypted communication at the server crypto-service, and decrypting the double-encrypted communication to retrieve the encrypted communication; and
sending the encrypted communication to the external service, wherein the external service decrypts the encrypted communication using the connection protocol.
2 . The method of claim 1 , wherein communication between the client crypto-service and the server crypto-service uses a quantum-resistant cryptographic algorithm.
3 . The method of claim 1 , wherein the input is from a user at the user device.
4 . The method of claim 1 , wherein the secure communication protocol uses Transport layer Security (TLS).
5 . The method of claim 1 , wherein the external service runs at the server system.
6 . The method of claim 1 , wherein the server crypto-service communicates with the external service through a load balancer.
7 . The method of claim 6 , wherein the load balancer is part of the server crypto-service, which communicates with the external service over a secure channel.
8 . The method of claim 1 , further comprising, at the user device:
intercepting outbound communication from the user device by a local network filter and redirecting the outbound communication to the client crypto-service.
9 . The method of claim 1 , wherein the client crypto-service and the server crypto-service select a security protocol according to a cryptographic policy and communicate using the selected security protocol.
10 . The method of claim 9 , wherein selecting the security protocol further comprises measuring network congestion and selecting the security protocol to compensate for limited network bandwidth.
11 . The method of claim 9 , wherein selecting the security protocol further comprises querying a database of known network communication vulnerabilities, and switching to an alternative security protocol in response to determining that a previously selected security protocol is designated as vulnerable.
12 . The method of claim 9 , wherein selecting the security protocol further comprises querying a database of available security protocols and switching to an alternative security protocol that was not previously available.
13 . The method of claim 1 , wherein the client crypto-service opens the secure encrypted tunnel to the server crypto-service in response to the initiated connection from the legacy application.
14 . The method of claim 1 , wherein the client crypto-service opens the secure encrypted tunnel to the server crypto-service prior to the initiated connection from the legacy application.
15 . A secure cryptographic communication system, comprising:
a user device running a client crypto-service and having one or more processors and memory; and
a server system running a server crypto-service and having one or more processors and memory; wherein
the user device is configured to:
receive input directed to a legacy application;
in response to the input, and in accordance with a determination that an enforcement policy applies to the legacy application:
initiate, by the legacy application, a connection having a connection protocol over a secure communication protocol to an external service not running on the user device;
establish, by the client crypto-service, a post-quantum Transport Layer Security (PQ-TLS) connection with the server crypto-service, the server crypto-service communicatively connected with the external service;
send, by the legacy application via the secure communication protocol, an encrypted communication to the external service; and
encrypt the encrypted communication in the client crypto-service to generate a double-encrypted communication, and send the double-encrypted communication to the server crypto-service, wherein the client crypto-service provides a secure encrypted tunnel, via the PQ-TLS connection, to the server crypto-service; and
the server system is configured to:
forward the connection protocol to the external service;
receive the double-encrypted communication at the server crypto-service, and decrypt the double-encrypted communication to retrieve the encrypted communication; and
send the encrypted communication to the external service, wherein the external service decrypts the encrypted communication using the connection protocol.
16 . The secure cryptographic communication system of claim 15 , wherein the user device is configured to:
intercept outbound communication from the user device by a local network filter and redirecting the outbound communication to the client crypto-service.
17 . The secure cryptographic communication system of claim 15 , wherein the client crypto-service and the server crypto-service select a security protocol according to a cryptographic policy and communicate using the selected security protocol.
18 . The secure cryptographic communication system of claim 17 , wherein selecting the security protocol further comprises measuring network congestion and selecting the security protocol to compensate for limited network bandwidth.
19 . The secure cryptographic communication system of claim 17 , wherein selecting the security protocol further comprises querying a database of known network communication vulnerabilities, and switching to an alternative security protocol in response to determining that a previously selected security protocol is designated as vulnerable.
20 . The secure cryptographic communication system of claim 15 , wherein the client crypto-service opens the secure encrypted tunnel to the server crypto-service prior to the initiated connection from the legacy application.