Patent ID: 12225017

DETAILED DESCRIPTION

Stealth enterprise security solution from Unisys Corporation of Blue Bell, Pennsylvania can be used to implement features of the present disclosure. Unisys's Stealth Suite includes both Stealth(core) (“Stealth”) and Stealth(aware). Stealth reduces attack surfaces in a network environment by creating dynamic, identity-driven microsegments called communities-of-interest. Micro segmentation is a security strategy that segments a network into smaller elements and manages them with IT security policies. By establishing secure community-of-interest, Stealth separates trusted devices, users and data from unknown or untrusted devices. It can further reduce attack surfaces by encrypting all communication between Stealth protected devices and cloaking the devices from unauthorized or unknown users. Micro segmentation divides a physical network into multiple logical micro-segments. Only the resources within the micro segment can see and communicate with one another.

For example, virtual or physical machines executing on one or more servers may each be assigned to one or more communities-of-interest. The communities-of-interest may allow an administrator to create logical organizations of virtual machines. A community-of-interest may be defined by a role performed by the virtual machines in the application stack.

Messages or communications within a community-of-interest are encrypted with a key corresponding to the community-of-interest. In this fashion, messages or communications are cryptographically isolated.FIG.1is a block diagram illustrating an encrypted enclave of virtual machines organized into communities-of-interest according to one example embodiment of the present disclosure. A network100may include a network bus130serving an enclave104. The bus130may couple virtual machines108a-ewithin the enclave104. Each of the virtual machines108a-emay communicate through encrypted communications carried on the bus130. A virtual gateway106may be coupled to the bus130to provide communications from the enclave104to external devices, such as a client110and/or other public networks, such as the Internet. The client110may be a remote device, such as a personal computer or mobile device. The client110may be connected to the virtual gateway106through a secured tunnel, such that the communications between the client110and the virtual gateway106are encrypted similar to the encrypted communications on the bus130.

The virtual machines108a-emay be assigned to one or more communities-of-interest. For example, the virtual machines108a,108c, and108emay be assigned to community-of-interest124. Virtual machines108dand108emay be assigned to community-of-interest114. And, virtual machine108bmay be assigned to community-of-interest122. And, the virtual machine108aand the client110may be assigned community-of-interest116.

A virtual machine108emay be instructed to transmit a message, or data, to the virtual machine108a. For example, software executing on the virtual machine108emay request data from a database server hosted on the virtual machine108d. When the virtual machine108ereceives the message destined for the virtual machine108a, the virtual machine108emay identify a community-of-interest in common between virtual machine108eand virtual machine108a. The community-of-interest124may be identified and a key associated with community-of-interest124may be used to encrypt the message.

The community-of-interest organization of virtual machines may be implemented in a computer network to provide cryptographic isolation of virtual machines.FIGS.2and3are block diagrams illustrating a network implementing communities-of-interest according to one embodiment of the disclosure. A network200may include an enclave210. According to one embodiment, the enclave210may belong to a single tenant of the network200. In other embodiments, the enclave210may be shared between tenants.

Communities-of-interest may be configured for a web tier214, an application tier216, and a database tier218. The web tier214may include a number of web servers214a-b, the application tier216may include a number of application servers216a-c, and the database tier218may include a number of database servers218a-b. Each of the servers214a-b,216a-c, and218a-bmay be a virtual server executing within a virtual machine. Additional communities-of-interest may be defined for infrastructure functions, such as administrative, proxy, application tier management, database tier management, or a jumpbox management. The enclave210may also include a jumpbox230, a transfer machine228, a virtual gateway226, a relay224, a proxy222, and a configuration device220, which may also be executing in virtual machines.

Membership of the virtual machines in individual communities-of-interest are shown as numbered circles213,215,217. For example, a community-of-interest213may include the servers214a-b, the jumpbox230and virtual gateway226. According to one embodiment, only virtual machines that share a common community-of-interest may communicate. When the first virtual machine initiates communication with the second virtual machine, the first virtual machine may search for a common community-of-interest between the first and the second virtual machine. If found, a cryptographic session key may be created that is encrypted with a key associated to the common community-of-interest. Thus, only a virtual machine that shares the community-of-interest key may decrypt the session key. All communication between the two virtual machines may be encrypted and decrypted with the session key. Messages within the enclave210may be isolated from the rest of the network200, because the messages are encrypted with keys that are not available to the rest of the network200.

For example, a web server virtual machine214amay be able to communicate with another web server virtual machine214b, because the virtual machines214a-bhave the community-of-interest213in common. They cannot communicate with the DB tier since the machines218a-bdo not have a community-of-interest in common with the virtual machines214a-b.

Each of the devices within the enclave210may be coupled to a bus212. When a device within the enclave210communicates with devices outside the enclave210, then messages may be handled by the virtual gateway226, which may be coupled to an unencrypted network232. According to one embodiment, the virtual gateway226, such as a Stealth Gateway, may encrypt and/or decrypt messages between the enclave210and the unencrypted network232. The network232may couple the enclave210to other network appliances234, such as network address translation (NAT) devices, dynamic host control protocol (DHCP) devices, domain name service (DNS) devices, and the like. The other network appliances234may also be executing in virtual machines.

Access to the enclave210may be controlled by the virtual gateway226. Messages passing through the gateway226from the unencrypted, or clear-text, network232to the enclave210may be encrypted and messages in the other direction may be decrypted by the gateway226. According to one embodiment, messages within the enclave210may only be transmitted to a virtual machine that has a community-of-interest in common with the gateway226. Furthermore, the gateway226may be configured to filter messages for a community-of-interest. The filter may allow an administrator to restrict access based on a message's source and/or destination address and/or port. The enclave210may also be isolated from other enclaves (not shown) in the network200, because only a virtual machine having a common community-of-interest with the gateway226may communicate outside of the enclave210.

For example, the web servers214a-bmay be able to communicate through the gateway226, because the web servers214a-bshare the community-of-interest213with the gateway226. In another example, the application servers216a-cand the database servers218a-bmay have restricted access through the gateway226, because the gateway226may filter messages transmitted in the application community-of-interest and the database community-of-interest to only provide access from management devices244.

Productivity and innovation require access to IT services on-premises and in the cloud, from any device, in any location globally. Traditional security perimeters are dissolving, increasing the network complexity and making it difficult to keep track of all the activity, especially in regards to security. Stealth(aware) is a network visualization product that enables a user to easily configure and deploy network security policies in order to protect the network. Stealth(aware) allows a user to visually discover endpoints and traffic on the network, as well as communications, using live discovery or existing packet capture files. Additionally, Stealth(aware) enables a user to create new network models from scratch to visualize new environments.

To simplify network complexity, Stealth(aware) automatically groups devices, or Nodes, into Profiles that have similar traffic patterns. Granularity levels are adjusted to balance simplicity and details. With a single click, a network model can be transformed into a model of micro segmentation policies. Stealth(aware) keeps the network view current by refreshing network model to identify policy violations or unwanted and suspicious communications between Nodes. It then allows the network administrator to quickly create and update network security polices to isolate the Node or block the suspicious communication.

In Stealth(aware), when a Project is initially created, a set of predefined Solutions, Profiles, Channels and Flows are automatically created for the user to help with the initial set up of a Stealth Environment. As part of creating these pre-defined objects, a Stealth recommended configuration is provided for the user in order to have a functioning Stealth environment as quickly as possible. Secure endpoint or nodes must also be created.

Stealth(aware) has Property Sets, which is an object associated with nodes that defines who the node authenticates to and how that node operates. Referring toFIG.4, the concept of Property Sets400is illustrated. Property Sets400includes nodes402(also referred to as endpoints), node property sets404, authorization groups406and authorization servers408. Nodes402are members of a node property set404; node property sets404are associated with one or more authorization groups406; and authorization groups406contain one or more standalone authorization servers408. An authorization group406can be associated with one or more node property sets404, and authorization servers408can be members of one or more authorization groups406.

Referring toFIG.5, a node402must perform registration502before authorization504. The node402applies a random selection algorithm to choose which authorization server408to register to. Once registered, the node402receives an endpoint property set ID506to get authorized. The endpoint property set ID506allows the node402to look up its authorization details in a setting file such that it can authorize504.

A user can set the Property Set400at a Project level (automatically done when the Project is created), at a Solution level (where are member nodes of that Solution are associated with the selected Property Set), at a Profile level (where all member Nodes of that Profile are associated with the selected Property Set) and at a Node level. Property Sets can includes a registration server, Stealth Management Server, Standalone Authorization Server or Default IWA Property Set. Property Set membership uses an inheritance/hierarchy concept. The Project level value is set to a default IWA Property Set. Solutions inherit from the Project level; Profiles inherit from the Solution level; and Nodes inherit from the Profile level. A user can then change the parameters of any given Property Set400.

Property Sets400abstract the actual Authorization Servers from the network administrator. This enables the Property Sets400to be created based on a functional, location or other basis as determined by the network administrator. The user can create, edit, display and delete node property sets404and their related fields. The user also creates node property sets404for both registration502and authorization504.

Previously, a user would describe the authorization parameters and the associated authorization servers. Information to guide the node during the authorization was also described. The packages, which contain both configuration information and software were manually maintained and mapped to individual servers.

In this disclosure, the configuration information is consolidated into a single standard configuration, referred to as generic node configuration, which can be used by all nodes402. Regardless of Operating System type, the configuration is the same and automatically managed by the software. This greatly reduces the burden of management and distribution of endpoint packages. Referring toFIG.6, a generic endpoint package600is illustrated. This generic endpoint package600is a consolidation of configuration information into a single standard configuration, which can be used by all endpoints. The configuration is applied to each supported software, such as Linux, Windows 32 bit systems and Windows 64 bit systems. Regardless of the OS type, the configuration is the same and automatically managed by the Stealth software. The node configuration is divided into three main sections: node property sets402, common-information and registration. The node property sets402contain all the authorization information that is used by a particular node402. The administrator may define one or more property sets depending on network complexity and needs of the enterprise.

A random hunting algorithm is used such that various nodes402start the attempt to authorize at a different place in the list. This provides load balancing of the authorization of nodes402between multiple authorization servers408without having to define multiple ordered lists to accomplish this. The randomization of this list makes the consolidation of the node package even more generic. A mapping table is maintained by the software where each node is mapped to a node property set404as defined by the user.

The common-info section contains the rules to apply to nodes402while in service mode and prior to authorization. These rules govern the communication to other Stealth enabled nodes. The registration section includes information to direct the node402to pre-defined registration servers as defined by the user. In order for a node to successfully authorize and join the secure network, it must first contact the registration server where its identity is mapped to a property set. Once the property set is known by the node, it can attempt authorization as defined by the generic endpoint configuration.

Updates are sent by node property sets404to the nodes402that are mapped to them automatically. As the user makes changes, a new version of the node package is generated and distributed as directed by the user. This greatly reduces the burden of managing and creating node packages by the user.

FIG.7illustrates a node property set's information700. Referring toFIG.8, a method800of creating secure endpoint on a network is illustrated. The method begins at802. At804, a node registers using a random selection algorithm to choose which server to register to. At806, the node receives a property set ID. At808, the node authorizes using the property set ID to look up it authorization information. The method ends at810.

FIG.9illustrates one embodiment of a system900for an information system, which may host virtual machines. The system900may include a server902, a data storage device906, a network908, and a user interface device910. The server902may be a dedicated server or one server in a cloud computing system. The server902may also be a hypervisor-based system executing one or more guest partitions. The user interface device910may be, for example, a mobile device operated by a tenant administrator. In a further embodiment, the system900may include a storage controller904, or storage server configured to manage data communications between the data storage device906and the server902or other components in communication with the network908. In an alternative embodiment, the storage controller904may be coupled to the network908.

In one embodiment, the user interface device910is referred to broadly and is intended to encompass a suitable processor-based device such as a desktop computer, a laptop computer, a personal digital assistant (PDA) or tablet computer, a smartphone or other a mobile communication device having access to the network908. The user interface device910may be used to access a web service executing on the server902. When the device910is a mobile device, sensors (not shown), such as a camera or accelerometer, may be embedded in the device910. When the device910is a desktop computer the sensors may be embedded in an attachment (not shown) to the device910. In a further embodiment, the user interface device910may access the Internet or other wide area or local area network to access a web application or web service hosted by the server902and provide a user interface for enabling a user to enter or receive information.

The network908may facilitate communications of data, such as dynamic license request messages, between the server902and the user interface device910. The network908may include any type of communications network including, but not limited to, a direct PC-to-PC connection, a local area network (LAN), a wide area network (WAN), a modem-to-modem connection, the Internet, a combination of the above, or any other communications network now known or later developed within the networking arts which permits two or more computers to communicate.

In one embodiment, the user interface device910accesses the server902through an intermediate sever (not shown). For example, in a cloud application the user interface device910may access an application server. The application server may fulfill requests from the user interface device910by accessing a database management system (DBMS). In this embodiment, the user interface device910may be a computer or phone executing a Java application making requests to a JBOSS server executing on a Linux server, which fulfills the requests by accessing a relational database management system (RDMS) on a mainframe server.

FIG.10illustrates a computer system1000adapted according to certain embodiments of the server902and/or the user interface device910. The central processing unit (“CPU”)1002is coupled to the system bus1004. The CPU1002may be a general purpose CPU or microprocessor, graphics processing unit (“GPU”), and/or microcontroller. The present embodiments are not restricted by the architecture of the CPU1002so long as the CPU1002, whether directly or indirectly, supports the operations as described herein. The CPU1002may execute the various logical instructions according to the present embodiments.

The computer system1000also may include random access memory (RAM)1008, which may be synchronous RAM (SRAM), dynamic RAM (DRAM), synchronous dynamic RAM (SDRAM), or the like. The computer system1000may utilize RAM1008to store the various data structures used by a software application. The computer system1000may also include read only memory (ROM)1006which may be PROM, EPROM, EEPROM, optical storage, or the like. The ROM may store configuration information for booting the computer system1000. The RAM1008and the ROM1006hold user and system data, and both the RAM1008and the ROM1006may be randomly accessed.

The computer system1000may also include an input/output (I/O) adapter1010, a communications adapter1014, a user interface adapter1016, and a display adapter1022. The I/O adapter1010and/or the user interface adapter1016may, in certain embodiments, enable a user to interact with the computer system1000. In a further embodiment, the display adapter1022may display a graphical user interface (GUI) associated with a software or web-based application on a display device1024, such as a monitor or touch screen.

The I/O adapter1010may couple one or more storage devices1012, such as one or more of a hard drive, a solid state storage device, a flash drive, a compact disc (CD) drive, a floppy disk drive, and a tape drive, to the computer system1000. According to one embodiment, the data storage1012may be a separate server coupled to the computer system1000through a network connection to the I/O adapter1010. The communications adapter1014may be adapted to couple the computer system1000to the network908, which may be one or more of a LAN, WAN, and/or the Internet. The communications adapter1014may also be adapted to couple the computer system1000to other networks such as a global positioning system (GPS) or a Bluetooth network. The user interface adapter1016couples user input devices, such as a keyboard1020, a pointing device1018, and/or a touch screen (not shown) to the computer system1000. The keyboard1020may be an on-screen keyboard displayed on a touch panel. Additional devices (not shown) such as a camera, microphone, video camera, accelerometer, compass, and or gyroscope may be coupled to the user interface adapter1016. The display adapter1022may be driven by the CPU1002to control the display on the display device1024. Any of the devices1002-1022may be physical and/or logical.

The applications of the present disclosure are not limited to the architecture of computer system1000. Rather the computer system1000is provided as an example of one type of computing device that may be adapted to perform the functions of a server902and/or the user interface device910. For example, any suitable processor-based device may be utilized including, without limitation, personal data assistants (PDAs), tablet computers, smartphones, computer game consoles, and multi-processor servers. Moreover, the systems and methods of the present disclosure may be implemented on application specific integrated circuits (ASIC), very large scale integrated (VLSI) circuits, or other circuitry. In fact, persons of ordinary skill in the art may utilize any number of suitable structures capable of executing logical operations according to the described embodiments. For example, the computer system1000may be virtualized for access by multiple users and/or applications.

FIG.11Ais a block diagram illustrating a server hosting an emulated software environment for virtualization according to one embodiment of the disclosure. An operating system1102executing on a server includes drivers for accessing hardware components, such as a networking layer1104for accessing the communications adapter1014. The operating system1102may be, for example, Linux. An emulated environment1108in the operating system1102executes a program1110, such as CPCommOS. The program1110accesses the networking layer1104of the operating system1102through a non-emulated interface1106, such as XNIOP. The non-emulated interface1106translates requests from the program1110executing in the emulated environment1108for the networking layer1104of the operating system1102.

In another example, hardware in a computer system may be virtualized through a hypervisor.FIG.11Bis a block diagram illustrating a server hosting an emulated hardware environment according to one embodiment of the disclosure. Users1152,1154,1156may access the hardware1160through a hypervisor1158. The hypervisor1158may be integrated with the hardware1160to provide virtualization of the hardware1160without an operating system, such as in the configuration illustrated inFIG.11A. The hypervisor1158may provide access to the hardware1160, including the CPU1002and the communications adaptor1014.

If implemented in firmware and/or software, the functions described above may be stored as one or more instructions or code on a computer-readable medium. Examples include non-transitory computer-readable media encoded with a data structure and computer-readable media encoded with a computer program. Computer-readable media includes physical computer storage media. A storage medium may be any available medium that can be accessed by a computer. By way of example, and not limitation, such computer-readable media can comprise RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store desired program code in the form of instructions or data structures and that can be accessed by a computer. Disk and disc includes compact discs (CD), laser discs, optical discs, digital versatile discs (DVD), floppy disks and blu-ray discs. Generally, disks reproduce data magnetically, and discs reproduce data optically. Combinations of the above should also be included within the scope of computer-readable media.

In addition to storage on computer readable medium, instructions and/or data may be provided as signals on transmission media included in a communication apparatus. For example, a communication apparatus may include a transceiver having signals indicative of instructions and data. The instructions and data are configured to cause one or more processors to implement the functions outlined in the claims.

Although the present disclosure and its advantages have been described in detail, it should be understood that various changes, substitutions and alterations can be made herein without departing from the spirit and scope of the disclosure as defined by the appended claims. Moreover, the scope of the present application is not intended to be limited to the particular embodiments of the process, machine, manufacture, composition of matter, means, methods and steps described in the specification. As one of ordinary skill in the art will readily appreciate from the present invention, disclosure, machines, manufacture, compositions of matter, means, methods, or steps, presently existing or later to be developed that perform substantially the same function or achieve substantially the same result as the corresponding embodiments described herein may be utilized according to the present disclosure. Accordingly, the appended claims are intended to include within their scope such processes, machines, manufacture, compositions of matter, means, methods, or steps.