Abstract:
A secure communication system comprises a software program client operating on a host computing device, a service manager configured to manage client access to the protected services, an authorizer in communication between the client and the service manager, and a receiver in communication with the service manager and serves as an interface to the protected services. At least one of a browser and an application of the client is configured to access one or more protected services running on a computing device that is remote to the host computing device over a communication channel. The service manager maintains a list of predetermined services authorized for the client and limits client access to the predetermined services.

Description:
CROSS-REFERENCE TO RELATED APPLICATION 
       [0001]    This application claims priority to U.S. Provisional Application Ser. No. 62/030,137, filed Jul. 29, 2014, entitled “SECURE COMMUNICATION SYSTEM AND METHOD.” 
     
    
     FIELD OF THE INVENTION 
       [0002]    The present invention relates generally to computer network security and, more specifically, to systems and methods for securing access to computer services. 
       BACKGROUND OF THE INVENTION 
       [0003]    Most secure network connections take a “trust but verify” approach. Under this approach, a remote client has access to a targeted service. It is left to the service to grant or deny access to the requesting party. Filters are used to attempt to block malicious attempts at gaining access to the targeted service. When a malicious actor has been identified, the filters are updated to try to impede repeated malicious attempts by the same bad actor. 
       SUMMARY OF THE INVENTION 
       [0004]    Embodiments of the present invention take a “Verify then Trust” approach. That is to say, verify who is attempting to access a service, where the access is originating, and limiting the attempted access to only services that the originating requestor has authority to access. This is done before the edge of the service is exposed to the requestor. 
         [0005]    A secure communication system according to an aspect of the present invention includes a software program client, a service manager, an authorizer, and a receiver. The software program client, in conjunction with a browser or a web-based protocol application, operates on a host computing device. The client is configured to establish a secure session to one or more protected services running on one or more computing devices that are remote to the host computing device over a communication channel. The service manager is configured to manage access to the protected services by the client browser or application. The service manager maintains a list of predetermined services authorized for the client browser or application. The service manager in conjunction with the client, authorizer, and receiver limits the access of the client browser or application to the predetermined services. The authorizer is in communication between the client and the service manager. The authorizer is also operable to authenticate the client and, upon authentication, pass the predetermined services authorized for the client from the service manager to the client. The receiver is in communication with the service manager and serves as an interface to the protected services. The receiver ignores connection requests from all non-authenticated entities until a notification is received from the service manager authorizing the receiver to open a communication channel for the authorized client browser or application. Access of the client browser or application is limited to the predetermined services. The client browser or application also communicates with the predetermined services through the receiver. 
         [0006]    According to an aspect of the present invention, an authorizer includes a communication device operable to send and receive messages over a network, and a processing device that is in digital communication with the communication device. The processing device is enabled to authenticate an access request to one or more protected services running on a remote computing device based on a user identity received through the communication device from a client operating on a remote host computing device. The user identity identifies the user requesting access to the protected services. The processing device receives a list of available services associated with the user identity from a service manager using the communication device. The service manager maintains a list of predetermined services authorized for the user identity. The processing device returns the list of predetermined services to the client using the communication device. 
         [0007]    According to an aspect of the present invention, a service manager includes a communication device, a memory device, and a processing device. The communication device is operable to send and receive messages over a network. The memory device stores user identities and access rights to one or more protected services running on a remote computing device. The processing device is in digital communication with the communication device and the memory device. The processing device is enabled to retrieve from the memory device a list of protected services authorized for a remote client operating on a host computing system based on a user identity received through the communication device and return the list of the protected services associated with the user identity using the communication device. The processing device is further enabled to validate a request received through the communication device to access the protected services based on the access rights stored in the memory device and notify a receiver of the valid request. The receiver is in communication between the client browser or application and the protected services. The receiver ignores all attempts to communicate with the protected services until notified of the valid session request. 
         [0008]    According to an aspect of the present invention, a receiver includes a communication device, a memory device, and a processing device. The communication device is operable to send and receive messages over a network. The processing device is in communication with the memory device and the communication device. The processing device is enabled to allow a communication session between a client browser or application operating on a host computing system and one or more protected services running on a remote computing device. The processing device ignores requests from all non-authenticated entities to access the protected services until the processing device receives an authorization from a service manager through the communication device. The client, authorizer, service manager, and receiver are configured to manage access to the protected services. The communication session between the client browser or application and the protected services is through the receiver. 
         [0009]    The client of the secure communication system is configured to maintain a heartbeat connection with the authorizer. The authorizer may send a request to the service manager to have the receiver disconnect the communication channel with the client when the heartbeat is no longer present. A receiver may further contain a local bus hardware controller for communicating with the protected services. 
         [0010]    In an Internet based version of the system, the authorizer, manager, and receiver may be operable in an Internet cloud, while the target services are operable at the target host site. In a partially isolated bus architecture version of the system, the authorizer and the manager may be operable in the Internet cloud. Another authorizer along with a receiver may be operable in the target local bus architecture. The target local bus architecture authorizer may allow for protected services within the local bus to communicate securely within the local bus architecture. In a partially isolated network architecture version of the system, the manager may be operable in the Internet cloud. The authorizers are operable within the Internet cloud and optionally within the target local network. An authorizer located within the protected services of the target local network can communicate between each protected service within the secure communications system. This version includes a switch or router within the target local network. The switch or router allows communication to pass through from the manager to the receiver or receivers. In addition, the switch or router allows communication from the Internet to pass to unprotected services. Multiple receivers within the target local network allow for fault protection and fully separated protected services, both internally within the target local network and from requests outside the target local network. 
         [0011]    In a fully isolated network architecture aspect, the isolated network can be within an isolated network cloud or at a host site, or both. This embodiment allows for multiple combinations of routers and switches. It provides authorizers, managers, and receivers to be fully isolated from any traffic not part of the isolated network. 
         [0012]    A method for securely accessing protected services running on a remote computing device, according to an aspect of the present invention, includes transmitting a user identity over a network from a client to an authorizer, service manager, and receiver for authentication. The authorizer is in communication with a service manager and the service manager is in communication with the receiver, all of which is configured to limit access to the protected services based on limitations established by an administrator of the protected services. The method further comprises waiting to receive an authentication response from the authorizer over said network. The authentication response includes a list of protected services authorized for the user identity. Access to one or more services from the list of protected services to the authorizer is passed over the network. The authorizer relays the request to the service manager. The request is verified by the service manager based on the list of protected services authorized for the user identity. A connection request is transmitted over the network to a receiver. The receiver is in communication with the protected services. The receiver is configured to ignore the connection request until the receiver receives a notification from the service manager that that request to access the protected services has been verified. The method further comprises waiting for the receiver to validate the connection request and open a communication channel. The method further comprises communicating with the service through the receiver over the communication channel. 
         [0013]    The method of securely accessing protected services running on a remote computing device further comprises transmitting a heartbeat message to the authorizer over the network to keep the communication channel open. 
         [0014]    A method of providing access to protected services running on a remote computing device, according to an aspect of the present invention, includes authenticating a client requesting access to the protected services based on a user identity received from the client, wherein the user identity identifies a host computing system running the client. A list of protected services authorized for the host computing system is retrieved based on the user identity. A communication channel is opened between the client browser or application and the protected services through a receiver. All communication between the client browser or application and the protected services is through the receiver. The access of the client browser or application to the protected services is limited to protected services authorized for the host computing system. 
         [0015]    The method of providing access to protected services running on a remote server further comprises monitoring a heartbeat message received from the client and closing the communication channel if the heartbeat message is no longer received. The communication channel between the client and the receiver is secure. 
         [0016]    These and other objects, advantages, purposes and features of the present invention will become more apparent upon review of the following specification in conjunction with the drawings. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0017]      FIG. 1  is a block diagram of a secure communication system in accordance with the present invention; 
           [0018]      FIG. 2  is a schematic diagram illustrating a use case involving a secure communication system in accordance with the present invention; 
           [0019]      FIG. 3  is a state sequence chart illustrating the operation of the secure communication system of  FIG. 1 ; 
           [0020]      FIG. 4  is a flowchart illustrating operational features of the client; 
           [0021]      FIG. 5  is a flowchart illustrating the heartbeat function shared between the client and the authorizer; 
           [0022]      FIG. 6  is a flowchart illustrating operational features of the service manager; 
           [0023]      FIG. 7  is a flowchart illustrating operational features of the receiver; 
           [0024]      FIG. 8  is a block diagram illustrating an internet based embodiment of a secure communication system in accordance with the present invention; 
           [0025]      FIG. 9  is a block diagram illustrating an alternative embodiment of a secure communication system incorporating a target local bus network; 
           [0026]      FIG. 10  is a block diagram illustrating a partially isolated embodiment of a secure communication system in accordance with the present invention; and 
           [0027]      FIG. 11  is a block diagram illustrating a fully isolated embodiment of a secure communication system in accordance with the present invention. 
       
    
    
     DESCRIPTION OF THE PREFERRED EMBODIMENTS 
       [0028]    The present invention will now be described with reference to the accompanying figures, wherein the numbered elements in the following written description correspond to like numbered elements in the figures. As illustrated in  FIG. 1 , a secure communication system  20  includes a client services unit or client  22 , an authorizer  24 , a service manager  26 , and a receiver  28 . Receiver  28  interfaces to one or more services  30  that require secured communication. As discussed in more detail below, when a user wishes to access one or more of the services  30 , client  22  makes a request to authorizer  24  to authenticate the user based on a token containing an encrypted user identity. As further understood from  FIG. 2 , authorizer  24  authenticates the user and then communicates with service manager  26  to retrieve the available services associated with the user identity as predefined in service manager  26  by an administrator  34 . Authorizer  24  relays the available services from service manager  26  to client  22  while service manager  26  notifies receiver  28  of the session request from authorized client  22 . Only after receiver  28  has validated the session request from service manager  26  is a secure communication session opened between receiver  28  and client  22 . Client  22  may only access protected services  30  through receiver  28 . The separation of powers approach utilized by secure communication system  20  prevents attempted access to service manager  26 , receiver  28 , and protected services  30  by non-authenticated users. 
         [0029]    Referring again to  FIG. 1 , client  22  is a computer software package that is loadable on a client host  32 , such as a computer/controller, smart phone, tablet device or the like, to provide client services. Optionally, client  22  may integrate with other user software operating on host  32  or as part of the firmware of host  32 . Client  22  may rely on host  32  for operating system functions, internet communication functions, and/or internet security functions. As shown in  FIG. 4 , client  22  performs a first stage of authentication by requesting a unique personal identifier or PIN (step  36 ). The PIN is never transmitted over the internet nor is it stored within client  22 . Once client  22  has verified the PIN (step  38 ), client  22  communicates with authorizer  24  to request user authentication and access to one or more of the protected services  30  from service manager  26  as discussed below. If authenticated, client  22  establishes and manages a secure communication channel with receiver  28 . Client  22  also includes functions to maintain a heartbeat (step  40 ) with authorizer  24  so that the secure channel is automatically disconnected when the heartbeat is no longer present. 
         [0030]    Authorizer  24  is a hardware unit comprising a communication device and a processing device with embedded software to perform authorization and authentication functions in concert with client  22  and service manager  26 . As shown in  FIG. 1 , authorizer  24  is in communication between client  22  and service manager  26 . Authorizer  24  authenticates the user based on the user identity provided by client  22 . Once authenticated, authorizer  24  is enabled to request the services available client  22  from service manager  26  based on the user identity and returns those services to client  22  as discussed in more detail below. Authorizer  24  may optionally be duplicated a number of times in system  20  to prevent denial of service attacks on a single authorizer  24 . As shown in  FIG. 5 , authorizer  24  also manages a heartbeat with client  22  (step  42 ) and will send a request to service manager  26  to disconnect the secure channel between client  22  and receiver  28  (step  44 ) if client  22  fails to maintain the heartbeat. 
         [0031]    As best described with reference to  FIGS. 1 and 2 , service manager  26  is a hardware unit comprising a communication device, a memory device, and a processing device having embedded software for managing access to services  30  by client  22 . Service manager  26  maintains a list of predetermined services available for each user identity along with any regional limitations as established by administrator  34  in the memory device. Service manager  26  may also maintain a history of service connections to services  30 . Referring now to  FIG. 6 , when authorizer  24  relays a request for a new connection from client  22 , service manager  26  verifies the credentials of the user requesting the connection (step  46 ). If valid, service manager  26  retrieves the list of available services from the memory device based on the user identifier (step  48 ) and returns the list of services to authorizer  24  (step  50 ), which in tum returns the list to client  22 . Service manager  26  also includes control software for communicating with receiver  28  to allow a connection with client  22  (step  52 ) as discussed in more detail below. Optionally, the functions of service manager  26  may be distributed over multiple hardware units to share loading and to provide redundancy. 
         [0032]    Receiver  28  is a hardware unit comprising a communication device and a processing device with embedded software for managing communication sessions with protected services  30 . As illustrated in  FIG. 7 , receiver  28  blocks or ignores all requesting packets until it receives a notification from service manager  26  to allow a secure communication session with a browser and/or application of client  22  (step  54 ). Upon receipt of notification from service manager  26 , receiver  28  begins listening for a new connection request from the browser and/or application of client  22  (step  56 ). When receiver  28  receives the new connection request from the browser and/or application of client  22 , it verifies the credentials of client  22  against the session credentials provided by service manager  26  (step  58 ) and, if legitimate, opens a secure connection to the services authorized for client  22  (step  60 ). All communication between the browser and/or application of client  22  and services  30  is through receiver  28 . Upon session completion or termination, receiver  28  is configured to close all activities for the previously authorized session (step  62 ) and maintains a ready state in which it rejects all requests from unauthorized clients until it receives another notification from service manager  26  to allow a new session with another authorized client. 
         [0033]    The secure communication process is shown in  FIG. 3 . The process originates in client  22  with the unlocking of a token (step  64 ). This is the first tier of authentication. As mentioned above, the token is unlocked using an alphanumeric sequence or PIN only valid to a unique user. Upon supplying the PIN, the client  22  unlocks or decrypts the token (step  66 ). The token contains an encrypted user identity, which is transmitted to authorizer  24  (step  68 ) for token validation (step  70 ). This is the second tier of authentication. Authorizer  24  then transmits the user identity to service manager  26  for user level authentication (step  72 ). Service manager  26  retrieves the user data and services authorized for client  22  and returns a service acknowledgement with available services to authorizer  24  (step  74 ). Authorizer  24  next relays the available services to client  22  and requests to start a heartbeat with client  22  as acknowledgment (step  76 ). Client  22  starts the heartbeat (step  78 ) and presents allowable session (step  80 ). Upon selecting the targeted session, client  22  issues a session or service access request to authorizer  24  (step  82 ), which in turn relays the request to service manager  26  (step  84 ). Service manager  26  verifies the session access request against the available services to validate that the request is authorized (step  86 ). This is the fourth tier of authorization provided by secure communication system  20 . Next, service manager  26  notifies receiver  28  of the session request via a service identifier along with session credentials (step  88 ). Receiver  28  processes the session request along with the session credentials and, if valid, prepares for a valid session with the targeted service (steps  90  and  92 ). The targeted service can, at its option, use additional levels of user authentication as appropriate. At this point, five tiers of authorization have been passed and a session is available to the requested services. Steps  64  to  92  are all performed before any request is ever made to the targeted service. 
         [0034]    It should be noted that if a request is denied or a failure occurs at any one of the five tiers of authorization, no not acknowledge message is returned. Intentionally, secure communication system  20  does not return a response to the request. This is a security feature to maintain darkness of the service against malicious probes. Secure communication system  20  is now ready for client host  32  to connect through the validated session to the targeted service. This can be accomplished through a traditional browser or, more directly, from a user&#39;s host software program through a variety of network protocols. The session remains open as long as there is activity or until client host  32  shuts down the session. After the session is closed, the entire secure communication process must be repeated in order to open another secure communication session. As noted above, all communication between client  22  and services  30  is through receiver  28 . Client  22  never communicates directly with services  30 . 
         [0035]      FIG. 8  illustrates an internet-based secured communication system  120  using the secure communication process discussed above for secured communication system  20 , such that a detailed discussion need not be repeated herein. Like components of secured communication system  120  are labeled with similar reference numerals, but with 100 added to the reference numerals of secured communication system  20 . System  120  includes an actor host  132  with associated client  122 , an authorizer  124 , a service manager  126 , and a receiver  128  all located in an internet  94 . Internet  94  includes networks defined by Internet Standards from the Internet Engineering Task Force, cellular networks, wireless networks and the like. The secure communication processes is performed using standard internet secure protocols. Optionally, multiple authorizers  124  may be used to minimize the denial of service threat. 
         [0036]    A partially isolated secured communication system  220  incorporating a targeted local bus network  96  is shown in  FIG. 9 . Secured communication system  220  uses the secure communication process discussed above with secured communication system  20 . Like components of secured communication system  220  are labeled with similar reference numerals, but with 200 added to the reference numerals of secured communication system  20 . Due to the similarities between system  20  and system  220 , a detailed description need not be repeated herein. 
         [0037]    System  220  includes an actor host  232  having an associated client  222 , an authorizer  224 , and a service manager  226  all located in the internet  94  similar to system  120  described above. However, unlike system  120 , secure communication system  220  includes targeted local bus network  96 , which uses a local bus and bus networking protocols for a more predictable high speed response and to separate internet traffic from bus traffic. A specific example of a local bus is a CAN bus, which is a message based protocol routinely used in automobiles or automated guided vehicles used in manufacturing. As automotive suppliers are adding more diagnostic capabilities, there is a greater need for telecommuting this information outside the local bus and, in some instances, loading critical updates to those protected services. However, in doing so, many of the critical controller edges are exposed to potential malicious outside sources. System  220  applies the secure communication security and control discussed above to those protected services on the local bus. In system  220 , an authorizer  225  local to bus network  96  operates in concert with internet-based service manager  226 . Authorizer  225  may be a software module integrated with a local bus hardware controller, such as a CAN bus hardware controller, which maintains target local bus protected services signatures. Like authorizer  225 , a receiver  228  may be a software module integrated with the local bus hardware controller to perform the receiver functions defined above and to provide a bridge for telecommunicating to protected services  230  on the local bus. 
         [0038]    A secure communication system  320  having a partially isolated network architecture is shown in  FIG. 10 . Secure communication system  320  uses the secure communication process discussed above with respect to secured communication system  20  such that a detailed description need not be repeated herein. Like components of secured communication system  320  are labeled with similar reference numerals, but with 300 added to the reference numerals of secured communication system  20 . System  320  includes an actor host  332  with an associated client  322 , an authorizer  324 , and a service manager  326  all located in the internet  94 . System  320  allows the separation of services  330  protected by the secure communication process from those traditional unprotected services  97 . This is accomplished using a router or switch  98  to separate protected services  330  from unprotected services  97  and applying the secure communication process to only protected services  330 . 
         [0039]    A secure communication system  420  having a fully isolated network architecture is illustrated in  FIG. 11 . Secure communication system  420  uses the secure communication process described above with respect to secured communication system  20  such that a detailed discussion need not be repeated herein. System  420  includes an actor host  432  with an associated client  422 , an authorizer  424 , a service manager  426 , and a receiver  428  all located in the internet  94 . However, system  420  uses the secure communication process to logically isolate its network from all outside network traffic. The physical location of client  422 , authorizer  424 , service manager  426  and receiver  428  may be anywhere as long as they are part of internet  94  and have sufficient internet speed to perform their function. Unlike a Virtual Private Network that extends an entities network outside to other actors, and thereby extends the entities network limitations to the other actors, secure communication system  420  applies the secure communication processes described above both inside and outside an isolated network  438 , thereby protecting critical services  430  from all outside actors and limiting inside actors  432  or services to only their authorized services. This does not limit inside actor  432  or protected service  430  from accessing internet services outside the isolated network. 
         [0040]    Secured communication system  420  is particularly useful for entities that need to physically and logically secure authorizer  424 , service manager  426  and receiver  428  such that these devices only perform secure communication functions for actor hosts  432  within isolated network  438 . There would be no traffic from other entities on their logically isolated network. The loading on authorizer  424  and service manager  426  would be only their isolated loading from clients  422  in isolated network  438 . 
         [0041]    Therefore, the present invention provides secure access to computer services by authenticating the client attempting to access the service before exposing the service to the client and limiting access to only those specific services authorized for that particular client. Authentication is done without accessing the services or exposing the services to any outside person or computer. That is, the services remain dark and cannot be seen and are not accessible to any outside probes. Only after the client has been authenticated is a secure connection between the client and the service created. 
         [0042]    While the foregoing description describes several embodiments of the present invention, it will be understood by those skilled in the art that variations and modifications to these embodiments may be made without departing from the spirit and scope of the invention, as defined in the claims below. The present invention encompasses all combinations of various embodiments or aspects of the invention described herein. It is understood that any and all embodiments of the present invention may be taken in conjunction with any other embodiment to describe additional embodiments of the present invention. Furthermore, any elements of an embodiment may be combined with any and all other elements of any of the embodiments to describe additional embodiments.