Adaptive data security system and method

Details Adaptive data security system and method Adaptive data security system and method

2000-03-17

2003-01-21

Patel, Ramesh (Department: 2121)

Data processing: generic control systems or specific application

Generic control system, apparatus or process

Supervisory control

C700S007000, C700S008000, C700S067000, C700S068000, C709S213000, C709S229000, C709S230000, C713S186000, C713S187000, C713S188000, C370S246000, C370S352000, C370S389000, C380S029000, C380S030000, C380S274000, C380S286000

Reexamination Certificate

active

06510349

ABSTRACT:

TECHNICAL FIELD
The present invention is generally related to the field of data communications and, more particularly, is related to a system and method for securing data communication.
BACKGROUND OF THE INVENTION
Currently there is an exponential increase in the number of banks and other businesses that use the Internet to conduct transactions. The Internet is often a less expensive and less time consuming business medium than paper or the telephone. Electronic commerce and data interchange are increasing efficiency and giving companies a competitive edge in the global economy. With this growth in Internet electronic commerce, it becomes essential that greater security be provided for network-enabled transactions and collaboration.
The demand for information security is further elevated by the increasing prevalence of virtual private networks (VPNs), which are configurations by which private business is conducted over public media, such as the Internet. Sharing an existing public communications infrastructure is far more cost-effective than building a separate network for every business. However, security is required to create this “private” logical network over existing public wire. To create this VPN, security operations are invoked at both the source and destination nodes to ensure properties such as confidentiality, integrity, and authentication, for proof of origination and non-repudiation, of data.
Although some Internet commerce applications have been developed, they do not provide sufficiently strong security for trusted transfer of private data over a public medium. The very essence of strong security is the notion that the security medium employed to protect data cannot be compromised in a sufficiently short time to allow use or alteration of those data by an unauthorized party. Therefore, data protection mechanisms for strong security are required to be complex, and they thus have a high computation overhead which detracts from overall application performance. In the interest of performance, security procedures are often omitted. If Internet commerce applications are to succeed, they cannot compromise performance or security. In the best possible case, security mechanisms would be transparent to users. However, so far, security in the world wide web security is poor. It is relatively few vendors that can delivery invisible security. The inherent tradeoffs in realizing both security and performance comprise the challenge we face in providing them.
In addition, law enforcement officials are becoming increasingly dependent on the availability of real-time, network collaborative and shared applications. For example, police officers are assisted by real-time photos and data delivered directly to their vehicles. This often requires strong authentication measures which are admissible in court as proof of origin, identity, and integrity of certain data and electronic evidence. The ability to dynamically vary levels of authentication to match available resources and current requirements provides users of law enforcement applications options to employ strong security and use data as evidence while still receiving these data in a timely manner. This option was previously unavailable.
In addition, the healthcare industry is another example of a business relying heavily on shared or collaborative applications to provide greater customer service. For example, electronic communications infrastructures such as the Internet facilitate and expedite potentially worldwide collaboration on x-ray images or case studies. These materials, however, contain personal data, and for patient privacy and safety, are often required to be encrypted, for confidentiality and/or authenticated, for identification of the image. Again, security is necessary for these applications that enable the networked collaboration, yet the security could be detrimental if it hampers the speed with which the information can be used to help the patient.
SUMMARY OF THE INVENTION
The present invention provides a system and method for facilitating adaptive security between a send host and a receive host. Briefly described, in architecture, the system includes a send host having a processor coupled to a data bus, a memory coupled to the data bus, an input device coupled to the data bus to input a desired security configuration for a data stream to be communicated to a receive host, and an output device coupled to the data bus to display the desired and actual security configurations for the data stream on an output display, the actual security configuration generally being received from the receive host. The processor operates according to adaptive security logic stored on the memory which includes logic to generate a plurality of data packets associated with the data stream, the data packets including an authentication data block with an authentication header containing the actual security configuration and a signature.
The system further includes a receive host which comprises a processor, memory, data input, and data output, all coupled to a data bus. The data input is configured to receive at least one data stream comprising a number of data packets, the data packets including an authentication data block having an authentication header and a signature. The processor runs according to adaptive security logic stored on the memory. The adaptive security logic includes logic to decompose an authentication header in the data packets, logic to perform a variable percentage verification on the data packets from the data stream, and logic to determine an actual verification percentage performed based on a number of available security operations, a minimum verification threshold, and a desired verification target, the minimum verification threshold and the desired verification target being contained in the authentication header. The adaptive security logic also includes logic to verify the data packets using delayed verification techniques.
The present invention can also be viewed as providing a method for communicating a data stream employing adaptive security. In this regard, the method can be broadly summarized by the following steps:
identifying a desired verification type, a desired security algorithm, a minimum security level, and a target security level in a send host for communicating a data stream from the send host to a receive host;
determining an actual verification type, an actual security algorithm, and an actual security level in the receive host based on the desired verification type, desired security algorithm, minimum security level, target security level, and an availability of a number of security operations per second (SOPS);
communicating the actual verification type, the actual security algorithm, and the actual security level from the receive host to the send host;
generating a plurality of data packets associated with the data stream in the send host, the data packets having an authentication data block with an authentication header, the authentication header containing the actual verification type, actual security algorithm, minimum security level, target security level, and the actual security level;
verifying the data packets on a percentage basis if the actual verification type is percentage based verification, the percentage based verification being performed at the actual security level which is greater or equal to the minimum security level and less than or equal to the target security level; and
performing a delayed verification on the data packets if the actual verification type is delayed verification.
The present invention has numerous advantages, a few of which are delineated hereafter as merely examples. An advantage of the invention is that it facilitates more effective data security by allowing a receive host to adapt the security level at which a data stream is verified based upon the availability of host processor resources to provide security operations per second (SOPS) in the receive host. In this manner, data streams received by the receive host are not delayed or lost clue to a

Affiliated with

Also associated with

Rating

Adaptive data security system and method does not yet have a rating. At this time, there are no reviews or comments for this patent.

If you have personal experience with Adaptive data security system and method, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Adaptive data security system and method will most certainly appreciate the feedback.

Rate now

Comments { 0 }

Profile ID: LFUS-PAI-O-3037932