PERFORMING SECURE AND NON-SECURE COMMUNICATION OVER THE SAME SOCKET

[0001] One embodiment is directed generally to a network computing system, and in particular to a network computing system that performs both secure and non-secure communication.

[0002] If an application running on a first computer is to perform both secure and non-secure communication with a second computer, the application must open two sockets with the second computer: one for secure communication and the other for non-secure communication. A socket is generally understood as an Application Programming Interface (“API”) of an operating system that delivers incoming data packets to the appropriate application process or thread based on a combination of local and remote Internet Protocol (“IP”) addresses and port numbers. For instance, a socket of the aforementioned second computer that is opened for non-secure communication with the application of the first computer may include the IP address of the second computer as well as a designated port (such as port 80 for Hypertext Transfer Protocol (“HTTP”)). Each socket is generally mapped to a communicating application process or thread. However, computers generally have both a per-process limit and a global (overall) limit on the number of open descriptors that describe each socket, thus limiting the total number of sockets. When these limits are reached, the available sockets are said to be exhausted and further sockets generally cannot be opened without closing previously opened sockets.

[0003] In an embodiment, a packet processing type determiner includes a non-secure packet processing module configured to process packets received over a single socket using a non-secure protocol. The packet processing type determiner also includes a data indicator checking module configured to check the packets for a first indicator denoting a beginning of a secure data record. The packet processing type determiner further includes a secure packet processing module configured to use a secure protocol to process the packets when the first indicator is detected in a packet until a packet with a second indicator denoting an end of the secure data record is detected.

[0010] It will be readily understood that the components of various embodiments of the present invention, as generally described and illustrated in the figures herein, may be arranged and designed in a wide variety of different configurations. Thus, the following more detailed description of the embodiments of an apparatus, system, and method of the present invention, as represented in the attached figures, is not intended to limit the scope of the invention as claimed, but is merely representative of selected embodiments of the invention.

[0011] The features, structures, or characteristics of the invention described throughout this specification may be combined in any suitable manner in one or more embodiments. For example, reference throughout this specification to “certain embodiments”, “some embodiments”, or similar language means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the present invention. Thus, appearances of the phrases “in certain embodiments”, “in some embodiments”, “in other embodiments”, or similar language throughout this specification do not necessarily all refer to the same group of embodiments and the described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0012] In addition, while the term “computer” has been used in the description of some embodiments of the present invention, the invention may be applied to many types of network computing devices. For purposes of this invention, the term “computer” includes servers, rack computing systems, cloud computing systems, distributed computing systems, personal computers, laptops, cell phones, personal digital assistants, tablet computing devices, mainframes, any networked devices that perform computing operations, and any equivalents thereof.

[0013] One embodiment is a packet processing type determiner that facilitates both secure and non-secure communication for an application over a single port, rather than using two or more ports. Therefore, the packet processing type determiner may enable a computer to communicate with more applications, or open more ports for already running applications, than is possible with conventional technology.

[0014] FIG. 1 is a block diagram of a computer 100 that can implement an embodiment of the present invention. Computer 100 includes a bus 105 or other communication mechanism for communicating information, and a processor 110 coupled to bus 105 for processing information. Processor 110 may be any type of general or specific purpose processor, including a central processing unit (“CPU”) or application specific integrated circuit (“ASIC”). Computer 100 further includes a memory 115 for storing information and instructions to be executed by processor 110. Memory 115 can be comprised of any combination of random access memory (“RAM”), read only memory (“ROM”), flash memory, cache, static storage such as a magnetic or optical disk, or any other types of computer readable media or combination thereof. Additionally, computer 100 includes a communication device 120, such as a network interface card, to provide access to a network. Therefore, a user may interface with computer 100 directly, or remotely through a network or any other method.

[0015] Computer readable media may be any available media that can be accessed by processor 110 and includes both volatile and nonvolatile media, removable and non-removable media, and communication media. Communication media may include computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any information delivery media.

[0016] Processor 110 is further coupled via bus 105 to a display 125, such as a Liquid Crystal Display (“LCD”), for displaying information to a user, such as web pages and other software applications. A keyboard 130 and a cursor control device 135, such as a computer mouse, is further coupled to bus 105 to enable a user to interface with computer 100.

[0017] In one embodiment, memory 115 stores software modules that provide functionality when executed by processor 110. The modules include an operating system 140 that provides operating system functionality for computer 100. The modules further include a packet processing type determiner 145 that is configured to facilitate both secure and non-secure communication for an application over a single port. Computer 100 can be part of a larger system such as a cluster computing system, a distributed computing system, a cloud computing system, a “server farm” or any other system having multiple computers and/or computing devices. Computer 100 will typically include one or more additional functional modules 150 to include additional functionality. In some embodiments, packet processing type determiner 145 may be part of operating system 140 or part of one or more other functional modules included in other functional modules 150.

[0018] It should be noted that many of the functional features described in this specification have been presented as modules in order to more particularly emphasize their implementation independence. For example, a module may be implemented as a hardware circuit comprising custom very large scale integration (“VLSI”) circuits or gate arrays, off-the-shelf semiconductors such as logic chips, transistors, or other discrete components. A module may also be implemented in programmable hardware devices such as field programmable gate arrays, programmable array logic, programmable logic devices or the like.

[0019] Modules may also be at least partially implemented in software for execution by various types of processors. An identified unit of executable code in a software module may, for instance, comprise one or more physical or logical blocks of computer instructions which may, for instance, be organized as an object, procedure or function. Nevertheless, the executables of an identified module need not be physically located together, but may comprise disparate instructions stored in different locations that, when joined logically together, comprise the module and achieve the stated purpose for the module. Modules may be stored on a computer-readable medium, which may be, for instance, a hard disk drive, a flash device, random access memory (“RAM”), a tape drive, an optical drive, a compact disk having read-only memory (“CD-ROM”) or a digital video disk having read-only memory (“DVD-ROM”), or any other such medium used to store data. The medium may be read-only or read/write.

[0020] Indeed, a unit of executable code could be a single instruction, or many instructions, and may even be distributed over several different code segments, among different programs, and across several memory devices. Similarly, operational data may be identified and illustrated herein within modules, and may be embodied in any suitable form and organized within any suitable type of data structure. The operational data may be collected as a single data set, or may be distributed over different locations including over different storage devices, and may exist, at least partially, merely as electronic signals on a system or network.

[0021] FIG. 2 is a flow diagram illustrating a process flow for processing both secure and non-secure packets according to an embodiment of the present invention. In some embodiments, the functionality of FIG. 2, and FIG. 3 below, is implemented by software stored in memory or other computer readable media, and executed by a processor. In other embodiments, the functionality may be performed by hardware (e.g., through the use of an ASIC, a programmable gate array (“PGA”), a field programmable gate array (“FPGA”), etc.), or any combination of hardware and software.

[0022] In some embodiments, the process of FIG. 2 may be performed, for example, by computer 100 of FIG. 1 (i.e., the “first computer”) via packet processing type determiner 145. In FIG. 2, the process flow begins with a first computer receiving a request for communication from an application running on a second computer at 200. Clearly, the application running on the second computer may request, and send, numerous communications to and from the first computer. The first computer then establishes a socket for non-secure communication with the application at 205. In protocols such as Transmission Control Protocol/Internet Protocol (“TCP/IP”), communication from the application will be divided into packets and sent to the first computer. The packets may take different routes in the network over which the first computer and the second computer are communicating (such as a corporate Intranet, the Internet or any other network suitable for packet-based communication), and may arrive in a different order than that in which they were sent. The second computer sends information to the first computer indicating the number of packets that are to be sent, and numbers each packet accordingly in the headers thereof.

[0023] Once the first computer establishes a socket for non-secure communication with the application at 205, the first computer then awaits the packets from the application at 210. When a packet is received by the first computer, the packet is acknowledged in an “ACK” message to the second computer. If a packet is not received after a certain period of time, the first computer requests resending of the packet from the second computer via a negative acknowledgement, or “NACK”, message. In some implementations, the first computer may acknowledge multiple packets in a single ACK, or request the resending of multiple packets in a single NACK. The packets are then reassembled in order at the first computer. These operations, as well as other TCP/IP operations, would be readily appreciated by one of ordinary skill in the art.

[0024] The first computer periodically checks whether packets from the application have been received on the socket. If all packets have not been received at 215 and the connection has either timed out or been ended by the application at 220, the socket is terminated at 225 and the process ends. On the other hand, if all of the packets have not been received at 215 and the connection is still active, the first computer continues to await packets from the application on the socket at 210. In some embodiments, the first computer may begin processing the data packets before the entire communication is received, particularly if the communication is large.

[0025] Once all of the packets of the communication from the application have been received at 215, the first computer parses the first packet at 230. For the first packet, the first computer does not need to make a determination of whether SSL is currently being used at 235 since the first computer is initially using a non-secure protocol, and will default to the “NO” branch. The first computer then checks whether the first packet contains a secure data record indicator indicating the beginning of a secure data record at 240. This indicator may be marked by a certain value in the out of band data byte of the packet. For instance, the value 0xFA (denoted in hex, or 11111010 in binary) for the out of band data byte may indicate the beginning of a secure data record. The secure data record often spans multiple packets. While certain values in the out of band byte of a TCP packet are discussed with respect to indicators pertaining to secure data records, these are used for example only and other fields and/or values are both possible and clearly within the scope of the present disclosure.

[0026] If the secure data record indicator marks the beginning of a secure data record, the first computer detects the secure data record indicator and switches to Secure Sockets Layer (“SSL”) protocol at 245. If not previously established, this generally requires the first computer and second computer to perform an SSL negotiation to establish an SSL session. SSL negotiation is discussed in more detail with respect to FIG. 3 below. While the negotiation is performed at this stage in FIG. 2, in some embodiments, the SSL negotiation may be performed in advance, such as prior to sending data packets by the application. This allows the first computer to use the SSL protocol over the socket to read/write/interpret the data sent by the application. While SSL is discussed in this example, it would be readily appreciated by one of ordinary skill in the art that Transport Layer Security (“TLS”) or any other applicable security protocol may be used.

[0027] If the secure data record indicator does not mark the beginning of a secure data record, the first computer will not switch to SSL. The first computer then processes the packet according to the current protocol at 250. If more packets remain to be processed from the communication at 255, the first computer parses the next packet at 260 and repeats the process for the next packet at 235. If there are no more packets to process at 255, the first computer then terminates the socket at 225. While the socket is terminated in this example, one of ordinary skill in the art will readily appreciate that the socket may remain open to receive future communications from the application.

[0028] For subsequent packets, the first computer will check to see whether SSL is currently being used at 235. If the secure data record indicator of a previously processed packet indicated a secure data record, the protocol will have been switched to SSL and the “YES” branch of 235 will then be taken for subsequent packets. While SSL is being used, the first computer checks whether the current packet contains a secure data record indicator indicating the end of the present secure data record at 265. This indicator may also be marked by a certain value in the out of band data byte of the packet. For instance, the value 0xFE (denoted in hex, or 11111110 in binary) for the out of band data byte may indicate the end of the secure record.

[0029] If the secure data record indicator marks the end of the secure data record, the first computer detects the secure data record indicator and switches back to the non-secure protocol at 270. If the secure data record indicator does not mark the end of the secure data record, the first computer will not change the security and will continue to use SSL on future packets. The first computer then processes the packet according to the current protocol at 250 and repeats the operations with respect to subsequent packets discussed above and illustrated in the flowchart of FIG. 2. In some embodiments, packets containing an indicator of the beginning or end of a secure data record may be used for the sole purpose of informing the first computer of the secure data record and may lack a payload.

[0030] Since in public key infrastructure (“PKI”) encryption, for instance, the larger the key size that is used, the more processing that is generally required, it may make sense in some implementations to use a level of encryption that corresponds with the level of sensitivity of the information. For example, in the case of a bank website, a longer key (such as 128 bit, 192 bit or 256 bit) may be used for highly sensitive information, such as a customer's username/password and account number, and a shorter key (such as 64 bits) may be used for less sensitive information, such as a static statement of account balances. While it is desired that third parties not see the less sensitive information, such information likely cannot be used to access or manipulate the account, unless used for verification by the bank over the phone when a purported customer calls the bank. If certain information is used for such telephonic verification, it is clear that a higher level of security may be desired for that information. Any key length and any number of different security levels for different data may be assigned and implemented by design choice and are within the scope of this disclosure.

[0031] FIG. 3 is a flow diagram illustrating a process flow for processing both packets having multiple types of security and non-secure packets according to an embodiment of the present invention. In some embodiments, the process of FIG. 3 may be performed, for example, by computer 100 of FIG. 1 (i.e., the “first computer”) via packet processing type determiner 145. In FIG. 3, the process flow begins with a first computer receiving a request for communication from an application running on a second computer at 300. The first computer then establishes a socket for non-secure communication with the application at 305. Once the first computer establishes a socket for non-secure communication with the application at 305, the first computer then awaits the packets from the application at 310. The first computer periodically checks whether packets from the application have been received on the socket. If all packets have not been received at 315 and the connection has either timed out or been ended by the application at 320, the socket is terminated at 325 and the process ends. On the other hand, if all of the packets have not been received at 315 and the connection is still active, the first computer continues to await packets from the client application on the socket at 310. In some embodiments, the first computer may begin processing the data packets before the entire communication is received, particularly if the communication is large.

[0032] Once all of the packets of the communication from the client application have been received at 315, the first computer parses the first packet at 330. For the first packet, the first computer does not need to make a determination of whether SSL is currently being used at 335 since the first computer is initially using a non-secure protocol, and will default to the “NO” branch. The first computer then checks whether the first packet contains a secure data record indicator indicating the beginning of a secure data record at 340. This indicator may be marked by a certain value in the out of band data byte of the packet. Per the above, the value 0xFA (denoted in hex, or 11111010 in binary) for the out of band data byte may indicate the beginning of a secure data record, for example.

[0033] If the secure data record indicator marks the beginning of a secure data record at 340, the first computer detects the secure data record indicator and if not previously performed, the first computer performs an SSL negotiation with the client computer and switches to SSL protocol at 345. Per the above, this negotiation may have been previously performed in some embodiments. The first and second computers negotiate the SSL session, exchanging information such as the SSL version number, cipher settings, and certificates. For instance, the cipher may use a 64 bit encryption strength initially. Again, while SSL is discussed in this example, it would be readily appreciated by one of ordinary skill in the art that TLS or any other applicable security protocol may be used. If the secure data record indicator does not mark the beginning of a secure data record, the first computer will not use SSL and will instead use the non-secure protocol. The first computer then processes the packet according to the current protocol and security level at 350. If more packets remain to be processed from the communication at 355, the first computer parses the next packet at 360 and repeats the process for the next packet at 335. If there are no more packets to process at 355, the first computer then terminates the socket at 325. While the socket is terminated in this example, one of ordinary skill in the art will readily appreciate that the socket may remain open to receive future communications from the application.

[0034] For subsequent packets, the first computer will check to see whether SSL is currently being used at 335. If the secure data record indicator of a previously processed packet indicated a secure data record, the protocol will have been switched to SSL and the “YES” branch of 335 will then be taken for subsequent packets. While SSL is being used, the first computer checks whether the current packet contains a secure data record indicator indicating the end of the present secure data record at 365. This indicator may also be marked by a certain value in the out of band data byte of the packet. For instance, per the above, the value 0xFE (denoted in hex, or 11111110 in binary) for the out of band data byte may indicate the end of the secure record. If the secure data record indicator marks the end of the secure data record, the first computer switches back to the non-secure protocol at 370.

[0035] If the secure data record indicator does not mark the end of the secure data record, the first computer detects the secure data record indicator and then determines whether the cipher for SSL has previously been changed at 375. In other words, the first computer checks whether the level of security has changed from the original SSL setting, such as from using a 64 bit key to using a 128 bit key. If the cipher level has not previously changed, the first computer checks whether the packet contains an indicator of the beginning of a data record that has a different security level and requires a cipher change. This indicator may also be marked by a certain value in the out of band data byte of the packet. For instance, the value 0xFC (denoted in hex, or 11111100 in binary) for the out of band data byte may indicate that a cipher change is needed for a data record.

[0036] If such an indicator is present, the first computer changes the security level at 385. The first computer processes a cipher change protocol data record with the second computer and uses new ciphers without requiring a full SSL renegotiation during the same session. The first computer and second computer may agree to change ciphers with whatever key strength that is desired: 64 bit, 128 bit, 192 bit, 256 bit or any other length. In this manner, the communicating computers can have complete control and flexibility over what ciphers they use for different resources. If such an indicator is not present, the first computer will not change the security and will continue to use the current SSL security level on future packets. The first computer then processes the packet according to the current protocol and security level at 350 and repeats the operations with respect to subsequent packets discussed above and illustrated in the flowchart of FIG. 3.

[0037] If the cipher has already been changed at 375, the first computer then checks whether an indicator of the end of the changed cipher is present in the packet at 390. This indicator may also be marked by a certain value in the out of band data byte of the packet. For instance, the value 0xFD (denoted in hex, or 11111101 in binary) for the out of band data byte may indicate that the data record for which the cipher change was needed has ended. If such an indicator is present, the first computer detects the indicator and reverts to the original SSL security level that existed prior to the cipher change at 395. The first computer then processes the packet according to the original SSL security level at 350 and repeats the operations with respect to subsequent packets discussed above and illustrated in the flowchart of FIG. 3.

[0038] FIG. 4 is a block diagram illustrating packets of a communication 400 received by a first computer from a second computer according to an embodiment of the present invention. In this example, the packets 401-416 of the communication 400 are processed in a similar manner as the process discussed with respect to FIG. 2. The packets are in order and are processed from left to right.

[0039] In this case, the first four packets 401-404 contain a value of 0xFF in the out of band data byte, which is not an indication of the beginning of a secure data record, so these packets are processed by the first computer using a non-secure protocol. Packet 405 contains a secure data record indicator 0xFA in the out of band data byte indicating the beginning of a secure data record. Accordingly, the first computer switches to SSL for processing packets. Packets 406-409 contain a value of 0xFF in the out of band data byte, which is not an indication of the end of the secure data record, so these packets are processed by the first computer using SSL. Packet 410 contains a secure data record indicator 0xFE in the out of band data byte indicating the end of the secure data record. Accordingly, the first computer switches back to the non-secure protocol for processing packets. The remaining packets 411-416 contain a value of 0xFF in the out of band data byte, which is not an indication of the beginning of a secure data record, so these packets are processed by the first computer using the non-secure protocol. Once the first computer finishes processing of packet 416, all packets in the communication have been processed and the processing ends.

[0040] FIG. 5 is a block diagram illustrating packets of another communication 500 received by a first computer from a second computer according to an embodiment of the present invention. In this example, the packets 501-516 of the communication 500 are processed in a similar manner as the process discussed with respect to FIG. 3. The packets are in order and are processed from left to right.

[0041] In this case, the first two packets 501-504 contain a value of 0xFF in the out of band data byte, which is not an indication of any operation with respect to a secure data record, so these packets are processed by the first computer using a non-secure protocol. Packet 505 contains a secure data record indicator 0xFA in the out of band data byte indicating the beginning of a secure data record. Accordingly, the first computer switches to SSL with an initial security level for processing packets. Packets 506 and 507 contain a value of 0xFF in the out of band data byte, which is not an indication of any operation with respect to a secure data record, so these packets are processed by the first computer using SSL with the initial security level.

[0042] Packet 508 contains a value of 0xFC in the out of band data byte, which is an indicator of the beginning of a portion of the secure data record that has a different security level and requires a cipher change. Accordingly, the first computer changes the security level for SSL to a new security level. Packets 509 and 510 contain a value of 0xFF in the out of band data byte, which is not an indication of any operation with respect to a secure data record, so these packets are processed by the first computer using the new SSL security level. Packet 511 contains a value of 0xFD in the out of band data byte, which is an indicator of the end of the portion of the secure data record that has the different security level and required the cipher change. Accordingly, the first computer changes the security level for SSL back to the initial security level. Packets 512 and 513 contain a value of 0xFF in the out of band data byte, which is not an indication of any operation with respect to a secure data record, so these packets are processed by the first computer using the initial SSL security level. Packet 514 contains a secure data record indicator 0xFE in the out of band data byte indicating the end of the secure data record. Accordingly, the first computer switches back to the non-secure protocol for processing packets. The remaining packets 515 and 516 contain a value of 0xFF in the out of band data byte, which is not an indication of the beginning of a secure data record, so these packets are processed by the first computer using the non-secure protocol. Once the first computer finishes processing of packet 516, all packets in the communication have been processed and the processing ends.

[0043] As disclosed, an embodiment is a packet processing type determiner that facilitates both secure and non-secure communication for an application over a single port. Another embodiment is a packet processing type determiner configured to process packets having multiple types of security, as well as non-secure packets. In a computer that has many sockets open with applications running on one or more other computers, both the per-process and global limits on open descriptors may confine the number of applications with which a computer can communicate. Using the same TCP socket to allow both non-secure and secure communications leaves sockets free for both existing and additional applications. In the case of a server, such an implementation may increase scalability in terms of socket connections with applications running on client computers.

[0044] One having ordinary skill in the art will readily understand that the invention as discussed above may be practiced in a different order, and/or with hardware elements in configurations that are different than those that are disclosed. Therefore, although the invention has been described based upon these preferred embodiments, it would be apparent to, and readily appreciated by, those of ordinary skill in the art that certain modifications, variations, and alternative constructions would be apparent, while remaining within the spirit and scope of the invention. In order to determine the metes and bounds of the invention, therefore, reference should be made to the appended claims.

[0045] It should be noted that reference throughout this specification to features, advantages, or similar language does not imply that all of the features and advantages that may be realized with the present invention should be or are in any single embodiment of the invention. Rather, language referring to the features and advantages is understood to mean that a specific feature, advantage, or characteristic described in connection with an embodiment is included in at least one embodiment of the present invention. Thus, discussion of the features and advantages, and similar language, throughout this specification may, but do not necessarily, refer to the same embodiment.

[0046] Furthermore, the described features, advantages, and characteristics of the invention may be combined in any suitable manner in one or more embodiments. One skilled in the relevant art will recognize that the invention may be practiced without one or more of the specific features or advantages of a particular embodiment. In other instances, additional features and advantages may be recognized in certain embodiments that may not be present in all embodiments of the invention.