Server, switch and endpoints for secure communications

Patent metadata

Field	Value
Publication number	US-12425373-B2
Application number	US-202418956421-A
Country	US
Kind code	B2
Filing date	Nov 22, 2024
Priority date	Nov 15, 2022
Publication date	Sep 23, 2025
Grant date	Sep 23, 2025

Abstract

A system and method for securely exchanging information between a server and an endpoint. A firewall and switch may administer connections between the endpoint and the server. The network interface of the server may send and receive information through the firewall and switch. A program task in the sever may set the network interface to be in an “on state” for a predetermined amount of time on a specific date thereby creating an active time transfer window that the network interface can receive communications from the endpoint.

First claim

The claimed invention is:

1. A system comprising:
a plurality of endpoints connected to a local managed network switch; the plurality of endpoints comprising a network interface; the network interface having an online state and offline state; the network interface configured to utilize local TCP/IP address assignment;
the endpoints comprising a filing system for storing scan data in a database;
a server comprising:
a processor, memory, storage media, a network interface, and non-transitory software instructions configured to executed by the processor;
an ID verification module configured to restrict communications to only between the server and an individual, previously approved endpoint;

the endpoints configured to securely copy data or files to the server;
a security key module configured to generate a unique public-private key pair including a private key and a public key for each endpoint with the public key placed on the server and the private key on the endpoints;
a firewall and switch configured to administer connections between the endpoints and the server;
a managed network switch connected to at least one endpoint and the server through the firewall and switch;
the network interface of the endpoint is configured to send and receive information through the firewall and switch;
a program task in the memory of the server; the program task setting the network interface of the endpoint to be in an “on state” for a predetermined amount of time on a specific date thereby creating an active time transfer window that the network interface can receive communications from the endpoint; and
the program task is configured to set the network interface of the endpoint to be in an “off state” before and after the active time transfer window thereby blocking transmissions from the server when the network interface is in the off state.

2. The system of claim 1 comprising a security operations center comprising an identity and access control policy platform configured to enforce compliance, enhance infrastructure security, and streamline service operations; the security operations center configured to:
monitor an IP address of the endpoint; and
monitor a subnet of the endpoints.

3. The system of claim 2 wherein the firewall and switch are configured to:
provide network redundancy;
provide block chain control of network encryption keys;
support native IPv6; and
perform deep packet inspection and active reporting to the security operations center for monitoring.

4. The system of claim 1 wherein the endpoints are configured to adjust the active time transfer window to account for time required to send and receive files from the server.

5. The system of claim 1 wherein:
the endpoint is configured to fail to connect to the server;
the endpoint is configured to generate an error message;
the endpoint is configured to log the error message into a local log file;
the endpoint is configured to execute a trouble shooting module to analyze a source the error message; and
the trouble shooting module is configured to restore the connection between the endpoint and the server.

6. The system of claim 4 wherein the program task of the endpoint is configured to re-schedule itself to run based on a random time.

7. The system of claim 1 ,
wherein the security key module is configured to:
install the private key on the endpoint and the public key on the server as installed public/private key pair;
execute a first command on a nonstandard port with the installed public/private key pair; and

the first command configured to copy the files the server to the endpoint.

8. The system of claim 1 comprising a program task in the endpoint switching the network interface of the endpoint into an online mode.

9. The system of claim 8 wherein the endpoint is configured to receive a transmitted file when the network interface of the server is in online mode.

10. The system of claim 9 wherein the endpoint is configured to process instructions within the transmitted file; the transmitted file containing a nonstandard port number, a future time window, and a request for scan information.

11. The system of claim 10 wherein the program task of the server is configured to turn off the network interface after the server transmits the file back to the endpoint.

12. The system of claim 11 wherein the program task of the server is configured to turn on the network interface at a beginning of the future time window.

13. The system of claim 12 wherein the endpoint is configured to send scan information to the server using a nonstandard port number, within a time specified by the future time window.

14. The system of claim 13 wherein server comprises a data analysis engine configured to perform data analysis on the scan information to determine patterns of scan information.

15. The system of claim 14 wherein the server is configured to:
receive scan information from the plurality of endpoints; and
perform data analysis on the scan information from the plurality of endpoints to determine patterns of scan information.

16. A method of securely exchanging information between a server and an endpoint comprising:
the server comprising a processor, memory, storage media, a network interface, and non-transitory software instructions configured to executed by the processor;
the endpoint comprising a processor, memory, storage media, a network interface and non-transitory software instructions configured to executed by the processor;
the processor of the server creating a program task in the memory of the server;
a firewall and switch administering a connection between the endpoint and the server;
the network interface of the server sending and receiving information through the firewall and switch;
the program task setting the network interface to be in an “on state” for a predetermined amount of time on a specific date thereby creating an active time transfer window that the network interface can receive communications from the endpoint;
the program task setting the network interface to be in an “off state” before and after the active time transfer window thereby blocking transmissions from the endpoint when the network interface is in the off state;
the processor of the endpoint creating a program task in the memory of the endpoint; the program task of the endpoint configured to run at a random time within the active time transfer window;
the server providing active transfer time window information to the endpoint;
the program task setting the network interface to be in an up state;
the endpoint establishing an encrypted VPN between the endpoint and the server; and
the endpoint transferring information on a computer port;
the program task of the endpoint placing the network interface into an offline state; checking downloaded files for required signatures; and determining the required signatures are valid; and
the endpoint decrypting the downloaded files; and processing instructions in the downloaded files.

17. The method of claim 16 wherein the computer port is a nonstandard port.

18. The method of claim 17 comprising the endpoint adjusting the active time transfer window to account for time required to send and receive files from the server.

19. The method of claim 16 wherein the computer port is an incongruent, standard port.

20. The method of claim 16 comprising:
a security key module setting up a public/private key pair including a private key and a public key;
the security key module insta

Assignees

• The Government Of The Us Secretary Of Homeland Security

Inventors

• Karas Michael

Classifications

• H04L63/029 Primary

  Firewall traversal, e.g. tunnelling or, creating pinholes · CPC title

• H04L9/3247

  involving digital signatures · CPC title

• H04L9/30

  Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy · CPC title

• H04L9/088

  Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068) · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title