Secure network communications using hardware security barriers

摘要

One embodiment includes hardware-based cybersecurity devices that create a physical barrier (“hardware security barrier”) between a computer's (or other device's) processor and a public or private network. Hardware security barriers typically use immutable hardware in accomplishing cybersecurity activities including generating and distributing cryptographically secure numbers, encryption, decryption, source authentication, and packet integrity verification. This hardware security barrier protects against remote threats and guarantees that all exported and received data are strongly encrypted. A hardware security barrier can be included in any computing or networking device that contains a network interface. One embodiment of a hardware security barrier is implemented as part of a network interface, such as, but not limited to being part of a network interface controller, or as a standalone unit between a communications interface of a host system and a connection to a network.

主权项

1. A method, comprising:
performing operations in a network comprising a source apparatus communicatively coupled to a destination apparatus over an external network; wherein the source apparatus includes a source host and a source hardware security barrier, with the source host including a source host processing unit and memory containing instructions and data, with the source hardware security barrier including a source host communications interface and a source network interface coupled to the external network, with the source hardware security barrier providing a physical non-bypassable path in and out of the source apparatus for the source host to communicate with the destination apparatus, with the hardware security barrier disposed between the source host communications interface and source network interface such that all packets must pass through the source hardware security barrier that are communicated between the source host communications interface and the source network interface and between the source host and the source network interface; wherein the destination apparatus includes a destination host and a destination hardware security barrier, with the destination host including a destination host processing unit and memory containing instructions and data, with the destination hardware security barrier including a destination host communications interface and a destination network interface coupled to the external network, with the destination hardware security barrier providing a physical non-bypassable path in and out of the destination apparatus for the destination host to communicate with the destination apparatus, with the hardware security barrier disposed between the destination host communications interface and destination network interface such that all packets must pass through the destination hardware security barrier that are communicated between the destination host communications interface and the destination network interface and between the destination host and the destination network interface; and where said operations include: generating one or more outgoing security keys by the source hardware security barrier; encrypting said one or more outgoing security keys based on a first security key to generate secure key data by the source hardware security barrier; communicating said secure key data from the source hardware security barrier to the destination hardware security barrier; decrypting said secure key data based on the first security key to produce said one or more outgoing security keys by the destination hardware security barrier; receiving a particular packet by the source hardware security barrier from the source host; encrypting at least a portion of the particular packet based on a particular security key of said one or more outgoing security keys by the source hardware security barrier resulting in a secure packet including an encrypted portion, wherein said encrypting at least a portion of the particular packet based on a particular security key includes pseudorandomly generating a pseudorandom number key by the source hardware security barrier based on the particular security key, and encrypting said at least a portion of the particular packet based on the pseudorandom number key by the source hardware security barrier resulting in the secure packet including an encrypted portion; communicating the secure packet from the source hardware security barrier to the destination hardware security barrier; decrypting the encrypted portion of the secure packet based on the particular security key of said one or more outgoing security keys by the destination hardware security barrier resulting in the particular packet, wherein said decrypting the encrypted portion of the secure packet based on the particular security key includes pseudorandomly generating the pseudorandom number key based on the particular security key by the destination hardware security barrier, and decrypting the encrypted portion of the secure packet based on the pseudorandom number key by the destination hardware security barrier resulting in the particular packet; and communicating the particular packet from the destination hardware security barrier to the destination host; wherein said generating and encrypting operations are immutable to processing modifications resulting from packets processed by the source hardware security barrier and said decrypting operation is immutable to processing modifications resulting from packets processed by the destination hardware security barrier.