Network security content checking
Methods, apparatus, and programs for a computer for network security content checking: in particular ones which simplify the critical element of a content checker so it can be trusted and implemented in logic.
1. A method of content checking of data transmitted between a first and a second separate computer system wherein the first and second computer systems are linked by a content checker, the method comprising:
receiving, by a network interface card supporting the content checker, data that has been transmitted from the first computer system;
encrypting, by the network interface card supporting the content checker, the received data and passing the encrypted data to logic supporting the content checker, the logic supporting the content checker directing the encrypted data to a decryption unit;
decrypting, by the decryption unit, the encrypted data and passing the decrypted data to the content checker; and
checking the decrypted data at the content checker to ensure it meets predetermined conditions prior to causing said decrypted data to be passed to the second system if it meets the predetermined conditions.
2. A method according to claim 1 in which the encryption method employs a key agreement protocol to establish encryption key values.
3. A method according to claim 2 in which the key agreement protocol is chosen such that even if the protocol messages are observed they cannot be used to determine the key.
4. A method according to claim 3 in which the key agreement protocol uses a Diffie-Hellman algorithm.
5. A method according to claim 1 in which the encryption method uses a symmetric encryption method.
6. A method according to claim 1 in which the encryption method uses XOR encryption.
7. A method according to claim 1 in which the encryption method uses an asymmetric encryption method.
8. A method according to claim 1 in which content checking is applied to data transmitted in both directions.
9. A method according to claim 8 in which distinct cryptographic keys are used for the two directions of transmission.
10. A method according to claim 8 in which cryptographic methods are employed for the two directions of transmission.
11. A method according to claim 1 in which the asymmetric key pair is generated in one of the network interface card and a device driver for the content checker and the scrambling key forwarded to the other of the network interface card and the device driver for the content checker whilst retaining the other as the unscrambling key.
12. A method according to claim 1 in which at least one of the network interface card and the device driver for the content checker is loaded with a cryptographic identity for use in authenticating a shared encryption key.
13. A non-transitory computer readable medium storing a program for causing at least one computer to perform a method comprising the steps of:
receiving data that has been transmitted from a first computer system at a network interface card supporting a content checker;
the network interface card supporting the content checker encrypting the received data and passing the encrypted data to logic supporting the content checker, the logic supporting the content checker directing the encrypted data to a decryption unit;
decrypting the encrypted data with the decryption unit and passing the decrypted data to the content checker; and
checking the decrypted data at the content checker to ensure it meets predetermined conditions prior to causing said decrypted data to be passed to the second system if it meets the predetermined conditions.