Management system for networked endpoints

Patent metadata

Field	Value
Publication number	US-12250200-B2
Application number	US-202418823485-A
Country	US
Kind code	B2
Filing date	Sep 3, 2024
Priority date	Nov 15, 2022
Publication date	Mar 11, 2025
Grant date	Mar 11, 2025

Abstract

A system and method for securely exchanging information between a server and an endpoint. A firewall and switch may administer connections between the endpoint and the server. The network interface of the server may send and receive information through the firewall and switch. A program task in the sever may set the network interface to be in an “on state” for a predetermined amount of time on a specific date thereby creating an active time transfer window that the network interface can receive communications from the endpoint.

First claim

The claimed invention is:

1. A system comprising:
a server configured to send a connection packet to an endpoint to establish communications at a future time through a network; the connection packet comprising a next IP address, a next IP Port, a next connection time, and a next connection date; the connection packet providing instructions to the endpoint as to when and how to send information from the endpoint to the server;
the server comprising:
a processor, memory, tangible computer readable storage media, and non-transitory computer readable software configured to cause the processor to execute a series of steps;
a network interface connecting the server to the network;
a firewall and switch configured to: turn off the network interface until the next connection time and date; and keep all other ports on the network interface closed except the next IP port; and
a time transfer window generator configured to generate a time transfer window comprising a date, start time and end time; the time transfer window comprising a default duration; and a scheduling monitor configured to: adjust the time transfer window based on how many endpoints are scheduled to send data packets;
lengthen the time transfer window when it determines there has been an increase in size or number of recently received data packets; and
shorten the time transfer window when it determines there has been a decrease in size or number of recently received data packets.

2. The system of claim 1 wherein the firewall and switch is further configured to:
turn on the network interface at the next connection time and date; and
open the next IP port at the next connection time and date.

3. The system of claim 1 comprising:
an identity generator configured to generate an endpoint identity using an IP address, Mac Address, passcode, username and password, or a hardware key associated with the endpoint; and
an ID verification module configured to:
accept communications from endpoints that an approved identity generated by the identity generator;
delete, quarantine, or export data from an endpoint that fails an ID verification; and
trigger an alarm if an ID Verification fails.

4. The system of claim 1 wherein the endpoint comprises a data compressor configured to compress data transmitted to the server.

5. The system of claim 1 wherein the time transfer window generator is configured to randomly generate the transfer window for each endpoint associated with the network.

6. The system of claim 1 wherein the time transfer window generator is configured to generate a time window to be open just long enough to securely upload and download the data packets from the endpoint.

7. The system of claim 6 , wherein the server is configured to receive information on a rotating, nonstandard SSH communications port.

8. A method comprising:
generating a data packet with a data packet generator;
an endpoint:
generating an ID;
sending a data packet at time T using port X with the ID to a server through a network interface;

the network interface:
switching into an active state during a time transfer window;
receiving the ID and data packet while in the active state;
providing an ID verification module with the data packet and ID; and
connecting the server to the network;

the server sending a connection packet to the endpoint to establish communications at a future time through the network; the connection packet comprising a next IP address, a next IP Port, a next connection time, and a next connection date;
a firewall and switch:
turning off the network interface until the next connection time and date;
keeping all other ports on the network interface closed except the next IP port; and

the ID verification module:
determining the endpoint is recognized or approved; and
confirming the ID matches an entry on a whitelist of approved identities.

9. The method of claim 8 comprising:
the firewall and switch turning on the network interface during the next connection time and date; and
the firewall and switch opening the next IP port during the next connection time and date.

10. The method of claim 8 comprising:
the ID verification module determining the endpoint is not recognized or not approved by confirming the ID does not match an entry on a whitelist of approved identities; and
the ID verification module determining the endpoint is not recognized or not approved by confirming the identity matches an entry on a blacklist of disapproved identities.

11. The method of claim 8 wherein the data packet contains data collected by the endpoint including scans, detections, anomalies, software version numbers, and operating conditions.

12. The method of claim 11 comprising a data converter converting data from the data packet into a universal format; the data converter homogenizing data from a plurality of endpoints so that the data is in a consistent format.

13. The method of claim 12 comprising:
a server storing the data from the data converter into a storage device;
a data analyzer analyzing the homogenized data for patents of interest, notifications, and detections;
a report module outputting results from the data analyzer into a report; and
the report module outputting the report onto a display of a monitor or emailing a report to a user.

14. The method of claim 8 comprising:
a server transmitting a reply back to the endpoint containing a next contact time U and a next contact port Y;
the endpoint receiving the reply; and
the reply programming a scheduling module in the endpoint to send a second data packet at time U using port Y.

15. The method of claim 14 comprising:
the server transmitting a second reply to the endpoint containing a next contact time V and a next contact port Z;
the endpoint receiving the second reply; and
the second reply programming the scheduling module in the endpoint to send a third data packet at time V using port Z.

16. A method of securely exchanging information between a server and an endpoint comprising:
the server comprising a processor, memory, storage media, a network interface, and non-transitory software instructions configured to executed by the processor;
the endpoint comprising a processor, memory, storage media, a network interface and non-transitory software instructions configured to executed by the processor;
the processor of the server creating a program task in the memory of the server;
a firewall and switch administering a connection between the endpoint and the server;
the network interface of the server sending and receiving information through the firewall and switch;
the program task setting the network interface to be in an “on state” for a predetermined amount of time on a specific date thereby creating an active time transfer window that the network interface can receive communications from the endpoint;
the program task setting the network interface to be in an “off state” before and after the active time transfer window thereby blocking transmissions from the endpoint when the network interface is in the off state;
the processor of the endpoint creating a program task in the memory of the endpoint; the program task of the endpoint configured to run at a random time within the active time transfer window;
the server providing active transfer time window information to the endpoint;
the program task setting the network interface to be in the “on state”;
the endpoint establishing an encrypted VPN between the endpoint and the server; and
the endpoint transferring information on a computer port.

Assignees

• The Government Of The Us Secretary Of Homeland Security

Inventors

• Karas Michael

Classifications

• H04L63/029 Primary

  Firewall traversal, e.g. tunnelling or, creating pinholes · CPC title

• H04L9/3247

  involving digital signatures · CPC title

• H04L9/30

  Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy · CPC title

• H04L9/088

  Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068) · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title