Encryption with sealed keys

Patent metadata

Field	Value
Publication number	US-10911491-B2
Application number	US-201715817341-A
Country	US
Kind code	B2
Filing date	Nov 20, 2017
Priority date	Nov 20, 2017
Publication date	Feb 2, 2021
Grant date	Feb 2, 2021

Abstract

An aspect includes a computer system with a network encryption device and a trusted container within firmware or hardware and/or within a virtual machine running on the computer system. The network encryption device includes a key store for storing secret encryption keys and a network traffic encryption engine for negotiating and/or storing encryption keys in the key store and/or for encrypting and/or decrypting network traffic using the encryption keys from the key store. The trusted container includes a flow analyzer for analyzing network traffic received from the network encryption device.

First claim

What is claimed is:

1. A computer system comprising:
a network encryption device and a trusted container within firmware or hardware and/or within a virtual machine running on the computer system, wherein the network encryption device provides a secure interface for forwarding data unaltered through a host/operating system between an application and a network interface device, the network encryption device comprising:
a key store to store secret encryption keys; and
a network traffic encryption engine to negotiate and/or store encryption keys in the key store and/or encrypt and/or decrypt network traffic using the encryption keys from the key store; and
the trusted container comprising a flow analyzer executed by the trusted container to analyze network traffic received, via a plug-in interface, from the network encryption device, wherein the flow analyzer generates and/or forwards a flow report to a report engine system, wherein the flow report comprises a plurality of application specific identifiers, each of the plurality of application specific identifiers comprising at least one of an application name, a fingerprint, or an application user identifier,
wherein the encryption keys are used for negotiating session keys for encrypting and/or decrypting the network traffic using the session keys, and wherein the session keys are stored in the network traffic encryption engine separately from the key store.

2. The computer system according to claim 1 , wherein the trusted container is connected to the network encryption device via the plug-in interface comprising a data flow analyzer interface.

3. The computer system according to claim 2 , wherein the plug-in interface transports a plurality of application specific identifiers.

4. The computer system according to claim 1 , further comprising a secure socket layer library executed by the host/operating system, wherein the secure socket layer library forwards stream socket calls and/or key operation calls to the network encryption device.

5. The computer system according to claim 4 , wherein the stream socket calls and/or key operation calls are forwarded through a kernel driver.

6. The computer system according to claim 5 , wherein the plug-in interface receives the stream socket calls and/or the key operation calls as input.

7. The computer system according to claim 5 , wherein the plug-in interface forwards the stream socket calls and/or key operation calls to the flow analyzer to analyze network traffic, wherein the stream socket calls and/or key operation calls are non-encrypted calls.

8. A method for providing encryption with sealed keys in a computer system having a network encryption device and a trusted container within firmware or hardware and/or a virtual machine running on the computer system, wherein the network encryption device provides a secure interface for forwarding data unaltered through a host/operating system between an application and a network interface device, the method comprising:
providing a network traffic encryption engine to negotiate and/or store encryption keys in a key store implemented in the network encryption device;
encrypting and/or decrypting network traffic using the encryption keys from the key store; and
analyzing network traffic received, via a plug-in interface, from the network encryption device by a flow analyzer executed by the trusted container, wherein the flow analyzer generates and/or forwards a flow report to a report engine system, wherein the flow report comprises a plurality of application specific identifiers, each of the plurality of application specific identifiers comprising at least one of an application name, a fingerprint, or an application user identifier,
wherein the encryption keys are used for negotiating session keys for encrypting and/or decrypting the network traffic using the session keys, and wherein the session keys are stored in the network traffic encryption engine separately from the key store.

9. The method according to claim 8 , further comprising:
providing a secure socket layer library that is executed by the host/operating system, wherein the secure socket layer library directs data from the application to the network encryption device, wherein the data comprises stream socket calls and/or key operation calls and/or application specific identifiers, and the stream socket calls and/or key operation calls are non-encrypted calls.

10. The method according to claim 9 , further comprising forwarding the data through a kernel driver.

11. The method according to claim 8 , further comprising:
forwarding the network traffic from the network encryption device to the flow analyzer via the plug-in interface comprising a data flow analyzer interface.

12. A computer program product for providing encryption with sealed keys in a computer system having a network encryption device and a trusted container within a firmware or hardware and/or a virtual machine running on the computer system, wherein the network encryption device provides a secure interface for forwarding data unaltered through a host/operating system between an application and a network interface device, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions when executed by a computer to cause the computer to perform a method comprising:
providing a network traffic encryption engine for negotiating and/or storing encryption keys in a key store implemented in the network encryption device;
encrypting and/or decrypting network traffic using the encryption keys from the key store; and
analyzing network traffic received, via a plug-in interface, from the network encryption device by a flow analyzer executed by the trusted container, wherein the flow analyzer generates and/or forwards a flow report to a report engine system, wherein the flow report comprises a plurality of application specific identifiers, each of the plurality of application specific identifiers comprising at least one of an application name, a fingerprint, or an application user identifier,
wherein the encryption keys are used for negotiating session keys for encrypting and/or decrypting the network traffic using the session keys, and wherein the session keys are stored in the network traffic encryption engine separately from the key store.

13. The computer program product according to claim 12 , wherein the program instructions further cause the computer to perform operations comprising:
providing a secure socket layer library that is executed by the host/operating system, wherein the secure socket layer library directs data from the application to the network encryption device, wherein the data comprises stream socket calls and/or key operation calls and/or application specific identifiers, and the stream socket calls and/or key operation calls are non-encrypted calls.

Assignees

• IBM

Inventors

• Kraemer Marco
• Nguyen Hoang-Nam
• Otte Carsten
• Raisch Christoph

Classifications

• H04L63/0281 Primary

  Proxies · CPC title

• H04L63/166

  at the transport layer · CPC title

• H04L63/0272

  Virtual private networks · CPC title

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• H04L63/061

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title