Data management system for networked endpoints

Patent metadata

Field	Value
Publication number	US-12095739-B2
Application number	US-202318383376-A
Country	US
Kind code	B2
Filing date	Oct 24, 2023
Priority date	Nov 15, 2022
Publication date	Sep 17, 2024
Grant date	Sep 17, 2024

Abstract

A system and method for securely exchanging information between a server and an endpoint. A firewall and switch may administer connections between the endpoint and the server. The network interface of the server may send and receive information through the firewall and switch. A program task in the sever may set the network interface to be in an “on state” for a predetermined amount of time on a specific date thereby creating an active time transfer window that the network interface can receive communications from the endpoint.

First claim

The claimed invention is:

1. A system comprising a server configured to send a connection packet to an endpoint to establish communications at a future time through a network; the connection packet comprising a next IP address, a next IP Port, a next connection time, and a next connection date; the connection packet providing instructions to the endpoint as to when and how to send information from the endpoint to the server; the server comprising a network interface to connect the server to the network; the server comprising a processor, memory, tangible computer readable storage media, and non-transitory computer readable software configured to cause the processor to execute a series of steps;
further comprising: a time transfer window generator configured to generate a time transfer window comprising a date, start time and end time; the time transfer window comprising a default duration; and
a scheduling monitor configured to adjust the time transfer window based on how many endpoints are scheduled to send data packets;
the scheduling monitor lengthening the time transfer window when it determines there has been an increase in size or number of recently received data packets;
the scheduling monitor shortening the time transfer window when it determines there has been a decrease in size or number of recently received data packets.

2. The system of claim 1 comprising a firewall and switch configured to turn off the network interface until the next connection time and date; the firewall and switch configured to keep all other ports on the network interface closed except the next IP port.

3. The system of claim 1 comprising:
a scheduled task configured to turn off the network interface until the next connection time and date; and
a firewall and switch configured to keep all other ports on the network interface closed except the next IP port.

4. The system of claim 1 comprising:
an identity generator configured to generate an endpoint identity using an IP address, Mac Address, passcode, username and password, or a hardware key associated with the endpoint; and
an ID verification module configured to:
accept communications from endpoints that an approved identity generated by the identity generator;
delete, quarantine, or export data from an endpoint that fails an ID verification; and
trigger an alarm if an ID Verification fails.

5. The system of claim 1 wherein the endpoint comprises a data compressor configured to compress data transmitted to the server.

6. The system of claim 1 wherein the time transfer window generator is configured to randomly generate the transfer window for each endpoint associated with the network.

7. The system of claim 1 wherein the time transfer window generator is configured to generate a time window to be open just long enough to securely upload and download the data packets from the endpoint.

8. The system of claim 7 , wherein the server is configured to receive information on a rotating, nonstandard SSH communications port.

9. A method comprising:
generating an ID associated with an endpoint;
a data packet generator generating a data packet;
the endpoint sending a data packet at time T using port X with the ID;
a network interface switching into an active state during a time transfer window;
the network interface receiving the ID and data packet while in the active state;
the network interface providing an ID verification module with the data packet and ID; and
the ID verification module:
determining the endpoint is recognized or approved; and confirming the ID matches an entry on a whitelist of approved identities;
further a scheduling monitor adjusting the time transfer window based on how many endpoints are scheduled to send data packets;
the scheduling monitor lengthening the time transfer window when it determines there has been an increase in size or number of recently received data packets;
the scheduling monitor shortening the time transfer window when it determines there has been a decrease in size or number of recently received data packets.

10. The method of claim 9 comprising:
the ID verification module determining the endpoint is not recognized or not approved by confirming the ID does not match an entry on a whitelist of approved identities; and
the ID verification module determining the endpoint is not recognized or not approved by confirming the identity matches an entry on a blacklist of disapproved identities.

11. The method of claim 9 wherein the data packet contains data collected by the endpoint including scans, detections, anomalies, software version numbers, and operating conditions.

12. The method of claim 11 comprising a data converter converting data from the data packet into a universal format; the data converter homogenizing data from a plurality of endpoints so that the data is in a consistent format.

13. The method of claim 12 comprising:
a server storing the data from the data converter into a storage device;
a data analyzer analyzing the homogenized data for objects of interest, notifications, and detections;
a report module outputting results from the data analyzer into a report; and
the report module outputting the report onto a display of a monitor or emailing a report to a user.

14. The method of claim 9 comprising:
a server transmitting a reply back to the endpoint containing a next contact time U and a next contact port Y;
the endpoint receiving the reply; and
the reply programming a scheduling module in the endpoint to send a second data packet at time U using port Y.

15. The method of claim 14 comprising:
the server transmitting a second reply to the endpoint containing a next contact time V and a next contact port Z;
the endpoint receiving the second reply; and
the second reply programming the scheduling module in the endpoint to send a third data packet at time V using port Z.

Assignees

• The Government Of The Us Secretary Of Homeland Security

Inventors

• Karas Michael

Classifications

• H04L63/029 Primary

  Firewall traversal, e.g. tunnelling or, creating pinholes · CPC title

• H04L9/3247

  involving digital signatures · CPC title

• H04L9/30

  Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy · CPC title

• H04L9/088

  Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068) · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title