Network authorization system

Patent metadata

Field	Value
Publication number	US-9906513-B2
Application number	US-201514867824-A
Country	US
Kind code	B2
Filing date	Sep 28, 2015
Priority date	Sep 28, 2015
Publication date	Feb 27, 2018
Grant date	Feb 27, 2018

Abstract

A system includes a key repository and a network node. The key repository is configured to generate a private key and a public key of the network node, to communicate the private key and the public key to the network node, to verify whether the network node is authorized to operate on a network, to generate a first message indicating whether the network node is authorized to operate on the network, to encrypt the first message using the public key, and to communicate the encrypted first message to the network node. The network node is configured to decrypt the encrypted first message using the private key, to generate a second message based on the first message, to encrypt the second message using the private key, and to record the encrypted second message to a ledger.

First claim

What is claimed is:

1. A system comprising:
a key manager comprising a hardware processor configured to:
generate a private key and a public key of a network node;
communicate the private key and the public key to the network node;
verify whether the network node is authorized to operate on a network;
generate a first message indicating whether the network node is authorized to operate on the network;
encrypt the first message using the public key; and
communicate the encrypted first message to the network node; and the network node configured to:
decrypt the encrypted first message using the private key;
generate a second message based on the first message, the second message indicating whether the network node is authorized to operate on the network;
encrypt the second message using the private key; and
record the encrypted second message to a ledger, wherein the ledger is searchable using the public key to return the encrypted second message.

2. The system of claim 1 , wherein verifying whether the network node is authorized to operate on the network comprises one or more of:
verifying an operating system version of the network node;
verifying a patch level of the network node;
verifying that a first user account is associated with the network node;
verifying that a second user account is not associated with the network node;
verifying that a file system is mounted on the network node;
verifying that a security software is installed on the network node;
verifying that a service is connected to the network node.

3. The system of claim 1 , wherein the network node is further configured to:
generate a hash of a kernel of the network node; and
communicate the hash to the key manager to identify the network node to the key manager.

4. The system of claim 1 , wherein the key manager is further configured to:
determine that a change occurred on the network node; and
in response to the determination that the change occurred, verify whether the network node is authorized to operate on the network.

5. The system of claim 1 , wherein the ledger comprises a plurality of records, each record indicating whether a node of the network is authorized to operate on the network.

6. The system of claim 1 , wherein a second network node searches the ledger using the public key of the network node to determine whether the network node is authorized to operate on the network before the second network node communicates with the network node.

7. The system of claim 1 , wherein:
the network comprises a plurality of network nodes; and
each network node of the plurality of network nodes stores a copy of the ledger.

8. The system of claim 1 , wherein the second message comprises a portion of the first message.

9. An apparatus comprising:
a memory configured to store:
a private key of a network node; and
a public key of the network node; and

a hardware processor communicatively coupled to the memory, the processor configured to:
generate the private key and the public key of the network node;
communicate the private key and the public key to the network node;
verify whether the network node is authorized to operate on a network;
generate a first message indicating whether the network node is authorized to operate on the network;
encrypt the first message using the public key; and
communicate the encrypted first message to the network node, wherein the network node is configured to:
decrypt the encrypted first message using the private key;
generate a second message based on the first message, the second message indicating whether the network node is authorized to operate on the network;
encrypt the second message using the private key; and
record the encrypted second message to a ledger, wherein the ledger is searchable using the public key to return the encrypted second message.

10. The apparatus of claim 9 , wherein verifying whether the network node
is authorized to operate on the network comprises one or more of:
verifying an operating apparatus version of the network node;
verifying a patch level of the network node;
verifying that a first user account is associated with the network node;
verifying that a second user account is not associated with the network node;
verifying that a file apparatus is mounted on the network node;
verifying that a security software is installed on the network node;
verifying that a service is connected to the network node.

11. The apparatus of claim 9 , wherein the network node is further configured to:
generate a hash of a kernel of the network node; and
communicate the hash to the key manager to identify the network node to the key manager.

12. The apparatus of claim 9 , wherein the processor is further configured to:
determine that a change occurred on the network node; and
in response to the determination that the change occurred, verify whether the network node is authorized to operate on the network.

13. The apparatus of claim 9 , wherein the ledger comprises a plurality of records, each record indicating whether a node of the network is authorized to operate on the network.

14. The apparatus of claim 9 , wherein a second network node searches the ledger using the public key of the network node to determine whether the network node is authorized to operate on the network before the second network node communicates with the network node.

15. The apparatus of claim 9 , wherein:
the network comprises a plurality of network nodes; and
each network node of the plurality of network nodes stores a copy of the ledger.

16. A method comprising:
generating a private key and a public key of a network node;
communicating the private key and the public key to the network node;
verifying whether the network node is authorized to operate on a network;
generating a first message indicating whether the network node is authorized to operate on the network;
encrypting the first message using the public key;
communicating the encrypted first message to the network node;
decrypting the encrypted first message using the private key;
generating a second message based on the first message, the second message indicating whether the network node is authorized to operate on the network;
encrypting the second message using the private key; and
recording the encrypted second message to a ledger, wherein the ledger is searchable using the public key to return the encrypted second message.

17. The method of claim 16 , wherein verifying whether the network node is authorized to operate on the network comprises one or more of:
verifying an operating method version of the network node;
verifying a patch level of the network node;
verifying that a first user account is associated with the network node;
verifying that a second user account is not associated with the network node;
verifying that a file method is mounted on the network node;
verifying that a security software is installed on the network node;
verifying that a service is connected to the network node.

18. The method of claim 16 , further comprising:
generating a hash of a kernel of the network node; and
communicating the hash to the key manager to identify the network node to the key manager.

19. The method of claim 16 , further comprising:
determining that a change occurred on the network node; and
in response to the determination that the change occurred, verifying whether the network node is authorized to operate on the network.

20. The met

Assignees

• Bank Of America

Inventors

• Wuehler Michael

Classifications

• H04L63/08 Primary

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L9/3236

  using cryptographic hash functions · CPC title

• H04L9/0861

  Generation of secret information including derivation or calculation of cryptographic keys or passwords · CPC title

• H04L9/083 Primary

  involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] · CPC title

• H04L63/0442

  wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30) · CPC title