Secure network architecture method and apparatus

[0002] This invention relates generally to computer system network architectures. More particularly this invention relates to a system for creating and maintaining a secure network architecture allowing transmission of data and information when permitted and/or allowed to be accepted by a destination.

[0003] With the advent of computer networks has come the problem of secure communication over a network. In addition it is important in networks dealing with critical business transactions of an organization to have controls over who can send what information over the network and, as an added precaution, what network resources are permitted to accept what kinds of information.

[0004] Network architectures have been the subject of a great deal of inventive effort. For example, U.S. Pat. No. 5,548,726 to Pettus is granted for a “System For Activating New Service in Client Server Network by Reconfiguring the Multi-layer Network Protocol Stack Dynamically Within the Server Node.” This invention allows for a client, in a client server network, to access remote services by means of a communications directory located in each node of the network. The activities of the client are then controlled by the server which allows only certain activities to take place. Thus the client is effectively controlled by the server.

[0005] U.S. Pat. No. 5,577,209 to Boyle et al. was granted for an “Apparatus Invented for Providing Multi-level Security for Communication Among computers and terminals on a Network.” This system is a multi-level security system employing a secure network interface unit between each host computer, user computer and the network. This system also provided for security management architecture for controlling operation and configuration of the secure network interface units. Each secure network interface unit is configured to perform certain defined activities. Thus control in the network is achieved by virtue of a secure network interface unit. Presumably limitations on activities of workstations on the network are also controlled by the secure network interface unit.

[0006] Other types of architectures have attempted to control processing on the network by imparting to servers or network computers certain controls over the processing taking place on the network. U.S. Pat. No. 5,355,453 to Rew et al. describes a system where all networks are connected to a network controller unit for controlling what traffic is permitted on the network.

[0007] U.S. Pat. No. 5,287,537 to Newmark et al. was granted for “Distributing Processing System Having a Plurality of Computers Each Using Identical Retaining Information to Identify Another Computer For Executing a Received Command.” This system causes a computer that receives a command to forward that command to another if the first computer can not fulfill the command. The emphasis here is on the ability to shift processing to computers that can perform the desired task.

[0008] U.S. Pat. No. 5,502,576 to Ramsay et al was granted for a “Method and Apparatus for the Transmission, Storage, and Retrieval of Documents in An Electronic Domain.” This invention has a particular structure that facilitates processing time and achieving higher bandwidth over a network. Traffic on the network is concerned with maximizing the bandwidth of information that is sent over the network.

[0009] U.S. Pat. No. 5,109,385 to Tseung was granted for a “Guaranteed Reliable Broadcast Network.” This invention introduces a concept of an “arbitrator node” which manages traffic over the network in order to guarantee that a message is received by a particular network resource even though the resource may be busy, slow, or temporarily out of service. Thus the arbitrator node performs the function of a “traffic cop.”

[0010] Other inventions in the network security arena relate to methodologies of encryption, for example U.S. Pat. No. 5,295,188 to Wilson et al for “Public Encryption and Decryption Circuitry and Method,” U.S. Pat. No. 5,351,293 to Michener et al for a “System Method and Apparatus for Authenticating an Encrypted Signal,” and U.S. Pat. No. 5,226,079 to Holloway for “Non-repudiation in Computer Networks.”

[0011] Other patents have been granted for authentication and signature verification. For example, U.S. Pat. No. 5,189,700 to Blandford was granted for “Devices to 1) Supply Authenticated Time and 2) Time Stamp and Authenticate Digital Documents,” and U.S. Pat. No. 4,326,098 to Bouricius et al for a “High Security System for Electronic Signature Verification.” These and other tools provide certain software solutions whereby one party can sign a digital document and another party can authenticate from the source that the message is truly from a desired party.

[0012] These various approaches deal with control over the messages on a network as well as various forms of centralized control over traffic on the network.

[0013] However, it would be extremely useful if controls over network traffic, once established by a central authority were automatically enforced by every single network resource (that is, without limitation, all manner of workstations, modems, servers, and other equipment and software residing on the network). Thus, the solution to not only network security but also to the security of the types of transactions on a network could best be enforced if rules existed not only at the network server or node level but also at the workstations originating the traffic, the various network resources along the way to the transaction destination, and enforced by the destination network resource as well. By having these enforcement mechanisms at all locations within the network, network security is enhanced for all manner of transactions or operations on the network. Further, network bandwidth usage decreases since, typically, only those communications that are permitted are ever transmitted on the net.

[0014] It is therefore an object of the present invention to provide a network with enhanced integrity and security in the transmission and reception of information by various network resources.

[0015] It is a further object of the present invention to establish communications profiles for all network resources whereby the ability of such network resources to create, transmit, and receive information is defined for the network resources.

[0016] It is a further object of the present invention to provide arbitrator nodes as a type of network resource able to control network traffic and having knowledge of important, relevant characteristics of network resources connected to such arbitrators.

[0017] It is a further object of the present invention to create individual network resource communications profiles whereby a network resource on the network will be permitted to create only certain types of traffic.

[0018] It is a further object of the present invention to create individual network resources having a communications profile comprising certain types of communications which the network resource is capable of creating and certain types of communication (which may be different) which the network resource is capable of receiving.

[0019] It is a further object of the present invention to be able to encrypt a bitstream based upon communications profiles of the receiving network resources whereby the receiving network resource will be able to decrypt the bit stream only if the encrypted bitstream comprises information the receiving network resource is permitted to receive.

[0020] It is a further object of the present invention to create an arbitrator capability that stores and monitors the individual network resource communications profiles after network resources have been established by the arbitrator to insure that only appropriate traffic emerges from a network resource.

[0021] It is yet another object of the present invention to create an arbitrator which monitors the usage of the network resources, software on the network, and information by various network resources.

[0022] It is a further object of the present invention to create an arbitrator having knowledge of other network resources which are destinations for traffic and for which the arbitrator only sends the traffic which the destination network resources are permitted to receive.

[0023] It is a further object of the present invention to individualize encryption elements to effect a unique dialect in the form of a communications profile for communication with each network resource.

[0024] It is a further object of the present invention to create and pre-store encryption elements for later distribution to network resources over the network when needed.

[0025] It is a further object of the present invention to allow arbitrators to request encryption elements as needed from a central directory or other arbitrators to fulfill the communication needs of network resources.

[0026] It is a further object of the present invention to allow a central directory to establish the communications profile of new network resources connected to arbitrators as a means of establishing initial communications between new network resources and arbitrators.

[0027] It is a further object of the present invention to establish communications profiles for network resources whereby the network resources understand and monitor incoming traffic and accept only traffic that the network resource is allowed to accept by virtue of its communications profile.

[0028] It is a further object of the present invention to insure that network traffic cannot be modified at any point in the transmission over the network without detection of the modification made.

[0029] It is a further object of the present invention to provide absolute object identity thereby allowing system management over the network as well as to insure certainty that communications destined for a particular network resource can be received only by that destination resource.

[0030] It is a further object of the present invention to allow anonymous communication notwithstanding absolute object identity.

[0031] It is a further object of the present invention to control and manage traffic over the network and determine what traffic is permitted to be sent and received by network resources, with a minimum of human intervention.

[0032] It is a further object of the present invention to be able to permit only certain kinds of communications between various parties and limit other types of communications.

[0033] It is a further object of the present invention to provide network resource communications profiles on network resources at all levels on the network.

[0034] It is yet another object of the present invention to meter network usage in order to create use statistics, charge users for network resources used, to enable billing and to enable tracking instances of network vandalism and related network information.

[0035] It is a further object of the present invention to create a class of network resource known as containers and distributed containers comprising information, access permissions and other network resources.

[0036] It is a further object of the present invention to create containers that cannot be modified and wherein any attempted modifications result in the container not being able to be decrypted.

[0037] It is a further object of the present invention to be able to identify corrupted files for subsequent retransmission to a destination network resource.

[0038] It is a further object of the present invention to provide known-object storage with absolute object identity in a container such that users can be certain that information retrieved from a container has not been modified or otherwise changed or tampered with.

[0039] These and other objects of the present invention will become apparent to those skilled in the art by review of the specification that follows.

[0040] For purposes of this specification, the term “network resource(s)” refers to, without limitation, software, any equipment and its associated software, for example, servers, workstations, modems and other equipment as well as other software programs such as databases, spreadsheets, and containers, (e.g. groups of databases and special access to other resources).

[0041] The present invention comprises a central directory which establishes the identity and characteristics of other network resources of the system architecture. It is the function of the central directory to establish the method and type of communication to be established with various network resources, to assist in establishing profiles and the identities of the network resources by distributing communication and network resource profiles and to distribute cryptographic elements to the network resources.

[0042] The Central Directory (CDIR) has the job of generating initial communications profiles for all network resources. Principally these are for lower level network resources (LLNRs) such as, and without limitation, workstations, arbitrators, containers and distributed containers. However, it is the intention and within the scope of the present invention for all network resources of any type to have communications profiles associated with them. To accomplish this the CDIR receives unique random numbers from a unique random number generator of the system and together with other communication filters, generates an initial communications profile that contains a unique identifier for the network resource in question and “receive” and “transmit” permissions for allowing communications of certain types to and from the network resource in question. Additionally, the CDIR can regenerate communications profiles in cases where original communications profiles have been corrupted or become unuseable.

[0043] The CDIR also performs checks to ensure that communications profiles together with other unique identifiers are not the same as for other network resources. This insures and establishes absolute object identity. Absolute object identity is a key issue that has been a source of problems on networks that is, the positive identification of those network resources on the network. It is important to have assurances that the network resource with whom a party is exchanging information is in fact the network resource for whom the information is intended. Conversely, it is important to have assurance that the source of information is in fact the source desired.

[0044] As described above, the actions of the unique random number generator and the actions of the CDIR in guarantying the absolutely unique nature of numbers being generated assures that each communications profile is in fact unique. If it is not unique, the CDIR reports the error to the unique random number generator and requests a new random number from the unique random number generator to establish the unique communications profile. Since the basis for each network resource's existence on the network is a function of its communications profile, which in turn is a function of the unique identifier given to it by the CDIR, other network resources can be assured that information coming from or going to a network resource is uniquely destined for that network resource or coming from the network resource as the case may be.

[0045] Once the communications profile is generated, the CDIR stores the communications profile for later distribution to a new arbitrator, or if the profile is for a LLNR, for the distribution to the LLNR by the associated arbitrator. Through such storage of network resource communications profiles, the CDIR is able to reestablish communications on a network resource in the event the communications profile becomes unuseable.

[0046] When the need arises for the creation of a new entity on the network and the distribution of a communications profile, such as when a new network resource is brought on line, the CDIR receives a request for a communications profile from a loader that is passed through an associated arbitrator. The loader is an applet whereby the CDIR can load an appropriate communications profile onto a network resource. Thereafter, the arbitrator receives the communications profile from the CDIR and passes the communications profile to the LLNR to allow communications to be established with the network. The arbitrator also stores the communications profile so that it can monitor communications from the LLNR. The CDIR or arbitrators have the power to reject a request for a communications profile in the event that the request is somehow improper.

[0047] The CDIR also stores the status of arbitrators and LLNRs on the net. For example the CDIR notes whether a network resource is active or inactive (i.e the account is active or dormant). The CDIR also stores needed information regarding the owner of the network resource. In the event anonymous communications are required, an alias identifier is used in place of the true identity of the network resource during communications but the CDIR still maintains the historical information of the true identity of the aliased communications.

[0048] The CDIR is assisted in the task of establishing the network by a plurality of arbitrators. The arbitrator takes information from the CDIR to establish and/or modify its own identity and its own communications profile and further assists the CDIR in establishing the communications profile of various network resources that communicate with the arbitrator.

[0049] When a network resource needs to become established on the network, the arbitrator is contacted in order to establish for the network resource a communications profile by which the network resource can interact and exist on the network and receive communications from the arbitrator and other network resources. If the arbitrator does not have the appropriate information or communications profiles to pass down to the network resource, the request to become active on the network flows to higher arbitrators and may even reach the CDIR. If the arbitrator has the appropriate information to establish the communications profile, the arbitrator provides it to the network resource and to the CDIR for record keeping purposes. In either case, a completed communications profile flows from either the arbitrator or the CDIR, through the arbitrator, to the network resource.

[0050] Once the network resource is established on the network, it has a communications profile associated with the information and communications it can generate and put over the network, as well as a communications profile associated with the type of information it is authorized to receive. In addition each network resource has a unique identifier. Only communications that have precisely the correct identifying information and are of the type of communication permitted can be received by the LLNR. Similarly, the network resource cannot generate or transmit any communication not expressly permitted by its communications profile. In this fashion an individual network resource polices itself both from the standpoint of what information it can send, and what information it can receive. Further, any tampering with the network resource communications profile and identifiers changes the LLNR to make both the sending and receiving of information impossible. This in turn triggers an automatic repair/update of the LLNR communications profile.

[0051] As further assistance to establishing integrity over the network an arbitrator (or plurality of arbitrators) serves as a second line of defense on the network to monitor the traffic that is coming from the network resources connected to it for purposes of metering usage, billing users, collecting statistics on use, and other statistics and to insure that it is the kind of traffic that the network resource is authorized to send. This is accomplished by the arbitrator maintaining an extensible database of profiles of all of those network resources with whom it most commonly communicates. Thus the communications profile of a particular network resource is generally mirrored at the arbitrator so that the arbitrator can then monitor traffic coming from the particular network resource. In a similar fashion the arbitrator can review the network resource communications profile in question so that traffic that is going to the network resource from other areas of the network is precisely the kind of traffic that the particular network resource is authorized to receive. If it is not then the arbitrator does not permit the communication traffic to reach the network resource. Thus network bandwidth is not wasted sending communications that cannot be accepted.

[0052] In the unlikely event that the arbitrator does, for some reason, pass communications traffic for which the network resource is not authorized, the network resource itself continues to monitor traffic coming to it and filters that traffic via its own network profile to determine whether or not it can accept traffic that is coming to it. If the network resource communications profile does not permit such information, the traffic coming to the network resource is simply rejected (or in the case of encrypted traffic not decrypted/not processed) and a message may be sent back to the arbitrator that unuseable data was sent or that an error in communication has occurred. In an interactive communication session, the arbitrator is notified of any problem in the communication.

[0053] A first arbitrator can also have knowledge of the communications profile of subsequent arbitrators along the network with whom the first arbitrator is permitted to communicate. Thus a first arbitrator will have knowledge of the communications profile of a second arbitrator and vice versa. After first checking its own communication profile to determine if it can transmit the communication, the first arbitrator will only send a communication to the second arbitrator where the second arbitrator has authorization to receive it. Similarly the first arbitrator will only accept information and traffic from the second arbitrator that the second arbitrator has authorization to transmit. Again in the event that there is a breakdown of some type in communication, the first arbitrator is self monitoring in that it will only accept traffic from other network resources, including arbitrators, that the first arbitrator is authorized to receive. Any traffic of a type that the first arbitrator is not authorized to receive is simply rejected and an error message may be sent to the next higher level arbitrator or to the CDIR that an error in communication has occurred. Thus, in a larger network with more layers of arbitrators, an arbitrator encountering a communications error would notify a higher level arbitrator of the error noted.

[0054] The arbitrator has a series of functions that affect the traffic on the network especially that flowing to and from LLNRs. The arbitrator monitors changes and usage of the LLNRs connected to it for communications that are transmitted by the LLNR. When communications are generated the arbitrator enforces the profiles to filter LLNR communication for the LLNR. This means that the arbitrator uses its stored LLNR communications profile to ensure that communications coming from the LLNR are the type permitted to be sent or transmitted by the LLNR. This is in addition to the self-policing done by the LLNR as a result of its own stored communications profile.

[0055] The arbitrator also enforces its own communications profile. This means that the arbitrator constantly monitors communications it receives to ensure that it only receives communications which it is authorized to receive.

[0056] When a communications profile must be updated at the LLNR, the arbitrator receives information from an authority authorized to change communications profiles and passes those profile changes on to the LLNR. This can occur in situations where the LLNR is given additional permissions to create certain types of communications, as frequently happens when a person's job responsibilities change.

[0057] The arbitrator may also have the task of monitoring the health of LLNRs that communicate with it. This may take the form of timed queries to the LLNR for information about its status. When the arbitrator detects that a corrupted file, communications profile or other problem exists on the LLNR, the arbitrator can download a special loader applet comprising the LLNR communications profile to reestablish the LLNR identity and hopefully fix the corrupted file without human intervention or assistance.

[0058] When encrypted communications are desired, the arbitrator provides the necessary encryption elements to the LLNR, which may be a bit ring. Thereafter, when the LLNR communicates in an encrypted form over the network, the arbitrator can check the communications to ensure that it is progressing normally in an encrypted fashion.

[0059] It is important to note that, notwithstanding any LLNR problems, the arbitrator continues to communicate with other arbitrators, the CDIR, and with containers and distributed containers.

[0060] In order for communications over the network to occur in a secure fashion, the communications can be encrypted. When encrypted communications are to take place, the network resource desiring to communicate in a secure fashion requests from the arbitrator a cryptographic element to establish an encrypted transmission. This may take the form of a bit ring in the preferred embodiment but this can be any form of cryptographic element. Again however the type of transmission and subject matter must be something for which the network resource is permitted to operate.

[0061] The present invention also comprises a “loader” applet whereby the CDIR can load an appropriate communications profile onto a network resource. Network resources in this case can be an arbitrator or an individual workstation on the network. Network resources can also be a “container” comprising data that is updated periodically or comprising data links to other data sources.

[0062] The present invention can also establish a distributed container comprising multi-system/multi-location data, different accesses to data sources (including containers within containers) and access to other network resources grouped in a coherent manner that is distributed across the network but is to be accessed by various LLNRs. Again the CDIR establishes the communications profile associated with the distributed container, establishing what can be written to or received from the distributed container and what information or network resource accesses can the distributed container actually contain.

[0063] Thus in all phases of the network established by the present invention, checking and self-monitoring occurs to insure that, at all levels of the network, network resources check themselves to insure that only permitted communications are sent by the network resources, that only permitted communications are received by the network resources, that arbitrators monitor those network resources connected to them to insure that those network resources are sending information that they are permitted to send and receiving information they are permitted to receive. Further the arbitrators check themselves to insure that they are only receiving communications that the arbitrators are permitted to receive and sending communications they are permitted to send. Absent harmony among these various rules and linkages, communication that is unauthorized cannot take place.

[0064] All modifications to communications using the present invention can be detected by virtue of an encrypted CRC/ECC that is sent with both the encrypted and unencrypted communications. Thus if communications cannot be decrypted due to a modification (whether surreptitious or otherwise), a new transmission can be requested. As further enhancement to the integrity of this system, communications may be encrypted to allow privacy to the communications that are sent over the network. Thus the network becomes suitable for highly secure transactions, electronic commerce, and all manner of communication where privacy, security, and integrity of information are desired. For example, a distributed container could allow a plurality of banks to access a synchronized database of funds that could not be rendered into an out-of-synchronization status.

[0065] The present invention can exist on any network, including the Internet. Companies can use the present invention to establish intranets as well as local area networks with enhanced security, maintainability, and network resource access. The LLNR's of the present invention comprise any equipment that is capable of storing and/or executing computer instructions. For example, workstations of any nature typically can be LLNRs as can smart modems which have an on-board processor and microchip capability. In this manner, a communication profile can be established on the modem itself to accept certain types of communications and not others. A printer having microprocessor control can be a LLNR since it can be instructed to accept certain printing tasks and not others.

[0066] The LLNR also conducts a variety of activities. As noted earlier the LLNR performs its own internal checking on the communications it generates. When the LLNR requires encrypted communication with other network resources, it requests cryptographic elements from the arbitrator. Once received, the LLNR uses the cryptographic elements, which can be (but without limitation) a bit ring to process its outgoing message. The LLNR can also process incoming messages using the cryptographic elements to the extent that incoming communications passed to it by the arbitrator are encrypted.

[0067] If the LLNR detects that its communications profile is corrupted in some way, it can reload from its own internal storage or request a reload of its communications profile from the arbitrator. Alternatively, if this is not detected at the LLNR, the arbitrator may detect corrupted files. In such a case the LLNR merely accepts the reload when sent from the arbitrator.

[0068] Since a special procedure is required to establish anonymous communications with another network resource, the LLNR also generates requests to the arbitrator for such anonymous communications.

[0069] The LLNR can also send requests for additional communication permissions to the arbitrator. This may be required in the event that the LLNR must now communicate with a network resource, or in a particular way about a particular topic that has not until that time been permitted. Thus the LLNR also has the capability, after request and higher level approval, to add or remove filters if such addition and removal is authorized. This general processing of communications profiles is necessary so that the LLNR communications profile can be updated from time to time.

[0070] Arbitrators of the present invention would preferably be but not limited to Pentium® class processors having 32 megabytes of RAM and several gigabytes of storage. Arbitrators also would preferably have network interface cards or potentially modems.

[0071] The CDIR of the present invention would be a fault tolerant machine due to the importance of the creation, storage, and communication of communications profiles, having multiple hard drives, at least a Pentium® class processor, at least 32 megabytes of RAM, and rigorous security access limitation hardware and software.

[0072] Further information concerning the operating of the secure network architecture of the present invention will be appreciated from the detailed description that follows.

[0073] FIG. 1A is the basic Flow of Establishing a Lower Level Network Resource on the Network

[0074] FIG. 1 is the Basic System Overview with a Single Arbitrator Showing Communication Between 2 Lower Level Network Resources

[0075] FIG. 2 is an Alternate System Overview with Two Arbitrators Showing Communications Between 2 Lower Level Network Resources Using 2 Arbitrators

[0076] FIG. 3 shows a Typical Communication Between Two Network Resources via Arbitrators

[0077] FIG. 3A shows the continuation of Communication Between Two Network Resources via Arbitrators

[0078] FIG. 4 shows the Activation of a Network Resource

[0079] FIG. 5 describes how Anonymous Communication Between Network Resources Occurs

[0080] FIG. 6 continued Description of Anonymous Communication Between Network Resources

[0081] FIG. 7 describes the Creation of a Container

[0082] FIG. 8 describes a Distributed Container

[0083] FIG. 9 describes Conferencing of Multiple Network Resources

[0084] FIG. 10 describes an Example of a Container of the Present Invention

[0085] FIG. 11 describes the procedure for establishing the presence of a LLNR on the Network

[0086] FIG. 12 describes The Present Invention Operating with Bit Stream Information

[0087] Referring to FIG. 1A the basic steps in establishing the presence on the net of a LLNR is shown. The LLNR first requests a “loader” applet from the nearest arbitrator to establish a presence on the net 50. The arbitrator refers the request to the CDIR 52. The CDIR then sends the appropriate loader applet 54 to the arbitrator for subsequent transmission to the LLNR 56.

[0088] Thereafter the LLNR loads the loader applet and complies with requests for information contained therein 58. The LLNR then establishes communication with the arbitrator. The arbitrator next checks all compliance by the LLNR with the requirements of the loader applet 60. If the applet is sufficiently complete, the arbitrator forwards the LLNR information to the CDIR 62. The CDIR then completes the communications profile for the LLNR and sends the profile to the arbitrator 64.

[0089] Upon receipt of the communications profile from the CDIR, the arbitrator stores a copy of the profile and sends the profile to the LLNR 66. Upon receipt and processing, the LLNR is then established on the network 68.

[0090] Referring to FIG. 1, communication between two LLNR's is shown. When an arbitrator desires to establish a network resource on the network it requests an appropriate communications profile and unique identifier from the CDIR 101. The arbitrator 103 then establishes the existence of the LLNR 105 using the communications profile from the CDIR. In a similar fashion the second LLNR 107 is also established. When LLNR 105 wishes to communicate with LLNR 107, LLNR 105 provides its message encrypted with its own bit ring to arbitrator 103. Arbitrator 103 uses its own bit ring which further encrypts the message and provides that message to LLNR 107 which then has the capability to decrypt the message. This entire process will be described in more detail later.

[0091] Referring to FIG. 2, communication between two LLNRs resources is shown via separate arbitrators. Similar to FIG. 1 the CDIR 201 provides an appropriate communications profile and unique identifier to establish LLNR 207 through an arbitrator 203 assigned to that LLNR. Similarly an appropriate communications profile and unique identifier is established for LLNR 209 and is provided via arbitrator 205 which is assigned to communicate with network resource 209. In this case, LLNR 207 provides its message encrypted according to its own bit ring to arbitrator 203. Arbitrator 203 uses its own bit ring to further encrypt the message and send it to arbitrator 205. Arbitrator 205, with knowledge of the encryption capability of network resource 209 further encrypts the message so that network resource 209 can decrypt it. Again further information on communications profile applied to this transaction will be discussed below.

[0092] Referring to FIG. 3, the typical communication between two network resources via arbitrators is described. For purposes of illustration these will be referred to as LLNR 981 and LLNR 8888. The user of LLNR 981 desires to communicate with LLNR 8888 and sends a request for communication 301. LLNR 981 then reviews its communications profile 303 to determine if communication with LLNR 8888 is permitted. If communications are not permitted, further communication is refused 307. In establishing the LLNR, various communication permissions are established as part of the communications profile of the LLNR. In the event that communications are not permitted a message is displayed to the user or other appropriate action is taken. If communications are permitted, the system next determines if a specific arbitrator or a group of arbitrators is required 305. A specific bit ring for the arbitrator is then used 309 to code the information to be sent to a specific arbitrator. If the communication is non-specific with respect to a given arbitrator, a “first available arbitrator bit ring” is created which discloses the identity of LLNR 981 but does not otherwise provide additional encrypted protection 313.

[0093] If a specific arbitrator or group of arbitrators is required, a specific arbitrator bit ring based upon the identity of LLNR 981 is generated. In the case where an arbitrator is not specified, the first available arbitrator bit ring is applied to the communication request 311. Whether the communication is a specific or a general communication request, the arbitrator receives the request for communication from LLNR 981315. The arbitrator then tests its communications profile 317 to determine if communication is allowed with the destination LLNR. This is in effect a second communications check which adds further security to the overall system. If communications are not allowed, the arbitrator is able to so note and forbid the communication 318 from taking place sending a message to LLNR 981. For purposes of identification the initial arbitrator in this FIG. 3 is noted as “ARB 222.”

[0094] ARB 222 next checks to determine if the communications profile of LLNR 981 is in the database of ARB 222319. If this communications profile is not present, ARB 222 can obtain that communications profile from an arbitrator higher in the arbitrator tree of the system 321. Once the communications profile of LLNR 981 is in place, a bit ring for LLNR 981 communication is generated 323. That bit ring is then sent to LLNR 981325. LLNR 981 then processes the bit ring from ARB 222327.

[0095] Using the bit ring from ARB 222, LLNR 981 applies the bit ring to its request for communication with ARB 8888329. This encrypts the communication between ARB 981 and ARB 222. LLNR 981 then sends its request for communication with LLNR 8888331 to ARB 222. ARB 222 receives the encrypted bit stream from LLNR 981333 and determines if the communication is a valid one 335.

[0096] If the communication is not valid ARB 222 performs certain system health checks to determine if a virus is present, if there are difficulties with memory, or other types of errors 337. If the communication is valid ARB 222 next determines if its own communications profile will allow LLNR 981 to communicate with LLNR 8888339. If the communication is not valid for any reason, communication is refused 340. The ARB 222 next checks to determine if its own communications profile allow it to communicate with LLNR 8888341. If such communication is permitted, ARB 222 next determines if LLNR 8888 communications profile is in ARB 222's database 343. If the communication is not permitted, communication is refused 340. If the LLNR 8888 communication profile is not in the database, ARB 222 obtains the communications profile from an arbitrator higher in the arbitrator tree of the system 345. If the communications profile of LLNR 8888 is present in ARB 222's database, a bit ring for communicating with LLNR 8888 is generated based on the LLNR 8888 communications profile 347.

[0097] The generated bit ring is next sent to LLNR 8888349. LLNR 8888 receives the bit ring and request for communication from ARB 222351. LLNR 8888 then processes the bit ring from ARB 222353 and applies the bit ring to the request for communication 355. This in effect decrypts the request for communication from ARB 222. LLNR 8888 then determines if the communication is valid 357. If the communication is not valid LLNR 8888 performs certain system checks to attempt to isolate the problem noted 359. If the communication is valid LLNR 8888 tests its communications profile 361 to determine if it is permitted to accept communication from ARB 222 and/or LLNR 981. This is in effect a third check on whether the communication is valid. In the event that LLNR 8888's communications profile does not allow it to accept the communication, the communication is refused and a message is sent to ARB 222363. If the communication from ARB 222 is accepted 365 then communication between LLNR 981 and LLNR 8888 can continue.

[0098] Referring to FIG. 3A, 8888 sends a message noting that the communication terms are accepted to Arb 222365. Thereafter Arb 222 sends the “communication terms accepted” message to 981367. LLNR 981 then can begin to send its information to Arb 222369 for subsequent transmission to 8888.

[0099] Referring to FIG. 4, the activation of a LLNR 401, or indeed any network resource, is described. The CDIR is the entity that activates a LLNR. A particular loader applet is configured for the desired LLNR 403 and sent to the LLNR, which comprises a user's computer or other network resource, via the unsecured channels 405. The loader applet is then run on the destination LLNR or network resource 407. The destination LLNR contacts the first available arbitrator 409 noting that it is ready to be established as a LLNR on the network. The arbitrator then sends a message from the loader applet at the LLNR to the central directory 411. By virtue of the loader applet message sent from the LLNR to the CDIR, the loader applet has established a secure link between the destination computer and the CDIR 413. The LLNR then establishes its own identity and password 415 which becomes part of its communications profile. (Note: a “computer” is used simply as an example of one type of “network resource.” The use of this piece of equipment is by way of example only and is not meant to limit the type of network resource that could be in place).

[0100] The CDIR next establishes various communication restrictions that an arbitrator will use to allow communication by the LLNR 417. These restrictions are passed to both the arbitrator and the LLNR. The CDIR then generates a communications profile for the LLNR 419. This communications profile is then typically sent only to arbitrators in direct link with LLNR 419 above the LLNR on the network 421. The arbitrator then completes the communications profile that will be used between that arbitrator and the LLNR by merging the arbitrator's communications profile and the communications profile for the LLNR 423. This creates a unique communications profile which can only be used between the LLNR and the arbitrator. The final step in the LLNR establishment process is for an arbitrator to send a test communication message to the LLNR to ensure that communications are operating properly 425.

[0101] Referring to FIG. 5, the situation relating to anonymous communication between LLNR's is described. Anonymous communication may be desired when interest is being expressed in certain financial transactions, if medical test results are being reviewed and other private matters. Anonymous communication begins and is carried on in a similar fashion to normal communications over the network. Using the same number identification as noted previously, LLNR 981 requests an anonymous communication with LLNR 8888501. LLNR 981 tests its communications profile to determine if anonymous communication with LLNR 8888 is allowable 503. If communication is not allowed a message may be displayed for the user so noting 502. If communication is allowed, LLNR 981 determines if a specific arbitrator or group of arbitrators is required 505. If a specific arbitrator or group of arbitrators is not required a generic bit ring based on the LLNR 981 I.D. is generated 507. This results in a request for the first available arbitrator to enable communication 509.

[0102] If a specific arbitrator or group of arbitrators is required a specific arbitrator bit ring based on the LLNR I.D. and the arbitrators to be contacted is generated by LLNR 981511. It should be noted that these steps 503, 505, 507, 509, and 511 are performed by the LLNR 981 based upon its own communications profile and data downloaded to it from the central directory.

[0103] The request for anonymous communication with LLNR 8888 is then transferred to ARB 222 which receives the request for communication 513. ARB 222 then tests its communications profile to determine if such anonymous communication is allowed 515. If communication is not allowed 516, a message is sent from the arbitrator to LLNR 981 to that effect. Assuming the communication is allowed, arbitrator next determines if LLNR 981's communications profile is in the ARB 222's database 517. If that communications profile for LLNR 981 is not present, ARB 222 will request the communications profile from an arbitrator higher in the arbitrator tree of the system 519. Once the communications profile is obtained or it is found by the ARB 222 that the communications profile is in the database of ARB 222 a bit ring is generated for LLNR 981521. That bit ring for anonymous communication is sent to LLNR 981523.

[0104] Thereafter LLNR 981 receives the bit ring and processes that bit ring from ARB 222525. LLNR 981 then applies the bit ring to the request for anonymous communication 527 which serves to encrypt the communication between LLNR 981 and ARB 222. Thereafter the encrypted request for anonymous communication is sent from LLNR 981 to LLNR 8888 via ARB 222529. ARB 222 receives the encrypted bit stream from LLNR 981531 and determines if this is a valid communication 533.

[0105] If communication is not valid due to protocol errors or other system difficulties, ARB 222 will perform system checks in order to isolate the problem 537. If the communication is valid, ARB 222 will check its stored communications profiles to determine if LLNR 981 is permitted to communicate with LLNR 8888539. Assuming that such communication is permitted, ARB 222 determines if its own communications profile will allow it to communicate in an anonymous fashion with LLNR 8888. If communication is not permitted, the transmission of information will not take place 540. If ARB 222 is permitted communication with 8888541 then ARB 222 will check its database to determine if the communications profile for LLNR 8888 is in the ARB 222 database 543. If ARB 222 is not permitted to communicate with 8888, then communication is not permitted 540. If the LLNR 8888 communications profile is not in the database of ARB 222, ARB 222 requests the communications profile from arbitrators higher in the arbitrator tree of the system 545. If the communications profile is in place in the database of ARB 222, ARB 222 generates a bit ring for communicating with LLNR 8888547. Thereafter, the bit ring is sent to LLNR 8888549 and is received by LLNR 8888, which includes the request for anonymous communication from ARB 222551. It is important to note that at this juncture, the identity of LLNR 981 is not given, only that anonymous communication is to be sent from ARB 222.

[0106] LLNR 8888 processes the bit ring from ARB 222553. The bit ring is applied to the request for anonymous communication that was previously encrypted. This in effect decrypts the request for anonymous communication from ARB 222557. Thereafter, LLNR 8888 performs a check to determine if the communication is valid 559. If communication is not valid due to errors in protocol or other difficulties, LLNR 8888 performs a limited system check to determine the problem encountered 565. If the communication is valid, LLNR 8888 tests its communications profile 561 to determine if it is permitted to accept anonymous communication from ARB 222. If its communications profile determines that it cannot accept such a communication, the communication is refused 567 and a message so indicating is sent to ARB 222. If anonymous communication can be accepted by LLNR 8888, then LLNR 8888 sends ARB 222 a message noting that anonymous communication is possible 563.

[0107] Referring to FIG. 6, the flow of anonymous communication continues. LLNR 8888, after determining that anonymous communication is possible, sends ARB 222 its communications profile concerning the type of communication it can receive 601. ARB 222 tests to see if LLNR 981 is permitted to communicate with LLNR 8888 based upon LLNR 8888's communications profile 603. If communication is permitted, ARB 222 creates an alias for LLNR 981 to use for the communication 605. Thereafter, ARB 222 informs LLNR 981 to begin its communication 607. Thereafter, during that anonymous communication all communication having the identity of LLNR 981 is converted to the alias which is assigned to the communication by ARB 222.

[0108] Referring to FIG. 7, the creation of the container is described. The container is in effect a storage structure wherein data, network resources and access to network resources that can be accessed by other network resources are stored. When a particular network resource requires a container for storage of data, network resources and access to network resources it must initially establish that requirement 701. The individual LLNR cannot by itself create a container but can request the creation of the storage structure. The LLNR sends a container creation request to an arbitrator 703. The arbitrator reviews its own communications profile to determine if creation of a container by the arbitrator is permitted 705. If creation of containers by the arbitrator is permitted the arbitrator sends a message to the CDIR to send a loader applet to the arbitrator 707. Once the loader applet is in place, the arbitrator requests data, network resources and access to network resources which are to be contained to be sent to the arbitrator from the LLNR 709. Thereafter the LLNR sends the appropriate data, network resources and access to network resources to be contained to the arbitrator 711. The arbitrator next merges the LLNR data, network resources and access to network resources and any communications profile information from the LLNR, together with the loader applet from the arbitrator to create an encrypted bit stream 713. The container is then stored by the arbitrator 715, or in the alternative, the container may be stored at the user computer 717. A key element that maintains the integrity of the data that is stored in a container is the fact that any individual user cannot modify the data stored in the container unless the container is accessed via the arbitrator (as illustrated in this figure. There may be more than one arbitrator that can allow changes to be made to information stored in containers). Data in containers cannot be modified without the appropriate authority since each container also has a communications profile that notes from whom it can receive modifications and what type of modifications are possible. For example a container may have many “read” permissions as part of its communications profile so that others may read data stored therein. However, the profile would potentially contain very few “write” permissions in order to limit the extent to which it can accept commands to change the data or access to network resources stored in the container. In a similar fashion to the unmodifiable nature of communications over the net, data in containers, if modified in any unauthorized manner, cannot be decrypted, thereby thwarting the attempted unauthorized modification.

[0109] Referring to FIG. 8, the concept of a distributed container is shown. If LLNR 981 desires to make a change 801 it notifies the arbitrator 803 and inputs the value to be changed to the arbitrator. The arbitrator sends a message to all the distributed containers 811 and the various locations (illustrated as locations 805, 807, and 809) that it, the arbitrator, wants to make a change to the distributed container and what that change will be. All containers 811 respond that they are willing to accept the change and communicate this acceptance to the arbitrator. Prior values of the data or network resource accesses to be changed are stored in each distributed container as a “roll back value,” that is a value which may be restored in the event of difficulty in changing all of the information in the various distributed containers. The arbitrator next notes that all distributed containers have acknowledged the potential message change. Upon a given signal from an arbitrator or at a particular appointed time all distributed containers make the change requested and delete the rollback value. In this fashion all distributed containers having the same data are synchronized so that entities at location 805, 807, and 809 are all accessing the same data and that data is known to be the same at all locations. It should be noted that in FIG. 8, for purposes of illustration, other distributed containers are noted as 813 and 815, each of which is stored at each individual location 805, 807, and 809.

[0110] Referring to FIG. 9, the ability to conference multiple LLNR's using the system and method of the present invention is shown. LLNR 981, which desires conference communication establishes its standard communication with ARB 222901. The user of LLNR 981 requests to join the conference to communicate with LLNR's identified for purposes of this example as LLNR 13579, and LLNR 24680903. LLNR 981 tests its communications profile to ensure that it is permitted to not only communicate with LLNR 13579 and LLNR 24680 but that it is also permitted to engage in conference communication 905. LLNR 981 sends its conference request to ARB 222907. ARB 222 receives the request for communication from LLNR 981909 and tests its own communications profile to determine if conference communication with the other LLNR's is permitted 911. If communication is not permitted communication with the other desired LLNR is refused 913 and a message is sent to LLNR 981 to that effect.

[0111] If conference communication is allowed, ARB 222 establishes communication with LLNR 13579915. Arb 222 then sends a conference request to LLNR 13579917. LLNR 13579 receives the conference request from ARB 222 and tests its own communications profile to determine if communication with ARB 222 is permitted 919. If communication is not permitted communication is refused 921 and a message is sent to ARB 222 to that effect. If communication is allowed LLNR 13579 sends to ARB 222 a message noting that the communication terms are accepted 923. Thereafter ARB 222 sends “conformance information,” that is information that is needed to decrypt the bit stream flowing from ARB 222 to LLNR 13579925. ARB 222 then calculates the bit ring needed to conform the bit stream from LLNR 13579 into a form that LLNR 981 can understand 927. Thereafter ARB 222 sends LLNR 981 the conformance bit ring 929 and LLNR 981 processes the bit ring and begins to monitor the bit stream from LLNR 13579931.

[0112] Referring to FIG. 10, an example of a container in the present invention is illustrated. In this case an example of a movie being distributed via over the present invention is shown. In this case the arbitrator first wraps a movie into a container via a loader applet 1001. This serves to encrypt the bit stream associated with the movie. When a user at a LLNR (in this case a set top box for viewing video selections) desires to view the movie, the user requests to view the movie via the arbitrator 1003. The arbitrator then reviews its communications profile to determine if the set top box requesting to see the movie is authorized to see that particular movie 1005. Such a filter can be a parental control filter noting that violent or sexually explicit movies are not to be viewed during particular time frames. Once the arbitrator determines that the set top box is permitted to see the movie requested, the arbitrator provides to the set top box the bit ring for decoding or decrypting the movie in question 1007. By virtue of the bit ring provided by the arbitrator, the arbitrator allows the bit stream associated with the movie to be decrypted by the set top box. As the bit stream reaches the set top box it is decoded by applying the bit ring sent from the arbitrator to the incoming data thereby decoding the movie and allowing it to be seen at the set top box location 1009.

[0113] In order to initially establish a LLNR on the network, a user contacts the network to establish the need for the user to be on the net and other administrative matters such as billing etc. Once the user's identity has been established to the satisfaction of the network intake facility, the user is given access to an applet that puts the user's LLNR in direct contact with the CDIR. Thereafter, communication with the CDIR occurs to establish the communications profile of the user with the associated transmit, receive and unique identifier information that allows the user's LLNR to communicate on the net.

[0114] As the CDIR creates and transmits the LLNR profile to the new LLNR, the profile is transmitted through various levels of arbitrators to reach the destination of the LLNR. At each arbitrator, the LLNR profile is stored so that the arbitrator can conduct its communication facilitating activity.

[0115] Referring to FIG. 11 the establishment of an LLNR is shown. In the FIG. 11 two intermediate levels of arbitrators are shown. LLNR 1101 makes its request for communication via the loader applet. This request is passed through arbitrator 1103 and arbitrator 1105 and finally reaches the CDIR 1107. Once the CDIR established the required profile for the LLNR, it passes that profile back through arbitrators 1105, which stores the LLNR profile as it passes the profile on to arbitrator 1103. Arbitrator 1103 then stores the LLNR profile and passes the profile on to the LLNR where it is loaded onto the LLNR thereby allowing it to communicate on the network.

[0116] If there comes a time when the LLNR is to be denied or deleted from the network, the CDIR simply inquires of its associated arbitrators whether they have knowledge of the profile of the LLNR to be deleted. Again referring to FIG. 11, Arbitrator 1109 and 1105 are queried by the CDIR 1107. Only arbitrator 1105 responds affirmatively that it does recognize the profile of the LLNR to be deleted. Thus a message to delete the LLNR from the network is sent only to arbitrator 1105. Since no other message needs to be transmitted, bandwidth is preserved.

[0117] Similarly, arbitrator 1105 inquires of its associated arbitrators 1103, 1113, and 1115 whether they have knowledge of the LLNR to be deleted. Only arbitrator 1103 responds with any knowledge of the LLNR to be deleted. Thereafter, the instruction to delete the LLNR only goes to arbitrator 1103 and to no other thereby again saving network bandwidth.

[0118] An alternative query method to that noted above which saves bandwidth even further is that since CDIR 1107 knows that it only sent LLNR profile information to arbitrator 1105, it does not need to query any other arbitrator regarding the existence of LLNR 1101. Therefore the CDIR 1107 only notifies arbitrator 1105 of the deletion of the LLNR 1101. Arbitrator 1105 knows that it only notified arbitrator 1103 of the existence of 1101. Therefore only arbitrator 1103 is notified of the deletion of LLNR 1101. Thereafter, arbitrator 1103 sends a message to LLNR 1101 deleting its ability to access the network. In this fashion only a single channel is queried or informed of the deletion of LLNR 1101 from the network, thereby saving bandwidth even further.

[0119] Referring to FIG. 12 the operation of the present invention is shown when dealing with bit stream information. This type of information could be a video such as a movie being shown in one's home, stock quote information which is constantly being updated or any other type of continuously flowing information. A source for the bit stream 1202 transmits the information to the arbitrator 1204. Arbitrator 1204 encrypts the bit stream and sends the bit stream to a network distribution resource, in this case shown as a satellite 1206. The distribution resource could also be a cable distribution system broadcast tower distribution system or any other system capable of distributing bit stream information.

[0120] The network distribution resource broadcasts the encrypted bit stream information where it can be received by those LLNR's that have appropriate communications profile and the ability to decrypt the information being broadcast. In this example LLNR 1208 is permitted to receive the information being broadcast by distribution resource 1206. However, in order for LLNR 1208 to read the information being broadcast, it must be able to decrypt the information. In order to accomplish this, decryption elements are sent by the arbitrator 1204 to LLNR 1208. Upon loading these decryption elements, LLNR 1208 is able to read the encrypted information being broadcast by distribution resource 1206.

[0121] A secure network architecture method and apparatus has been described which provides for controls over network traffic at all network resources. It will be appreciated by those skilled in the art that other modest variations of the invention described are possible without departing from the spirit of the invention as disclosed.