AUTHENTICITY VERIFICATION OF A REQUESTING USER BASED ON A TRANSFER REQUEST

Abstract

A method for establishing a transmission path for a requesting user by verifying the authenticity of the requesting user and a transmission request, wherein the method comprises: In response to receiving a transmission request, determine whether to establish a transmission path for the requesting user to a destination through a transmission network by verifying the requesting user based on one or more authentication rules, wherein the one or more authentication rules are based on first information belonging to the transmission network, second information about the requesting user, and third information from the requesting user, wherein the first information belonging to the communication network includes one or more attributes of a physical network, information about a logical network connection, and information about a connection history belonging to the requesting user; and In response to a finding that the requesting user meets one or more authentication rules, the transmission path for the requesting user in the transmission network is established according to one or more transmission attributes belonging to the requesting user.

Description

BACKGROUND

[0001] The present invention relates generally to the field of data processing and more particularly to computer security.

[0002] In general, computer security, cybersecurity, or information technology security (IT security) can encompass the protection of computer systems and networks from the interruption or misrouting of services and applications running on computers. The field of computer security is gaining importance due to the increasing reliance on computer systems, the internet, wireless network standards, and the proliferation of smart mobile devices, including smartphones and apps. In computing, a firewall is one of the primary methods for controlling traffic across a network. More specifically, a firewall is a network security system that monitors and controls inbound and outbound network traffic based on predetermined security rules.Another method for protecting computers may include endpoint authentication, which is an authentication mechanism used to verify the identity of an external or remote device on a network. For example, wireless networks based on endpoint authentication verify user credentials, such as a Service Set Identifier (SSID) and password, as well as security protocols used by the endpoint device.

[0003] Documents have already been published in this context. Document WO 2018 / 013925 A1 describes an attractive authorization framework for communication networks, such as 5G networks. Authorization information can be managed dynamically. Document US 2017 / 0041343 A1 also describes network access with dynamic authorization. These authorizations are granted using enforcement nodes, authorization ranks, and specially designed rules. Finally, document US 2015 / 0222634 A1 describes authorization requests for packet-based services in mobile networks. A policy control unit is used to perform an authorization check. A response to the requesting unit contains an indication of the authorization status for the service. SUMMARY

[0004] A method for dynamically establishing a transmission path for a requesting user by verifying the authenticity of the requesting user and a transmission request is provided. The method may include, in response to receiving the transmission request, dynamically determining whether to establish a transmission path for the requesting user to a destination through a transmission network by verifying the requesting user based on one or more authentication rules, wherein the one or more authentication rules are based on first information associated with the transmission network, second information about the requesting user, and third information from the requesting user.The method may further comprise, in response to determining that the requesting user satisfies the one or more authentication rules, dynamically establishing the transmission path for the requesting user in the transmission network according to one or more transmission attributes associated with the requesting user.

[0005] A computer system for dynamically establishing a transmission path for a requesting user by verifying the authenticity of the requesting user and a transmission request is provided. The computer system may include one or more processors, one or more computer-readable memories, one or more computer-readable tangible storage devices, and program instructions stored on at least one of the one or more storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, whereby the computer system can perform a method.The method may comprise, in response to receiving the transmission request, dynamically determining whether a transmission path should be established for the requesting user to a destination through a transmission network by verifying the requesting user based on one or more authentication rules, wherein the one or more authentication rules are based on first information associated with the transmission network, second information about the requesting user, and third information from the requesting user. The method may further comprise, in response to determining that the requesting user satisfies the one or more authentication rules, dynamically establishing the transmission path for the requesting user in the transmission network according to one or more transmission attributes associated with the requesting user.

[0006] A computer program product for dynamically establishing a transmission path for a requesting user by verifying the authenticity of the requesting user and a transmission request is provided. The computer program product may comprise one or more computer-readable storage devices and program instructions stored on at least one of the one or more tangible storage devices, wherein the program instructions are executable by a processor.The computer program product may comprise program instructions for dynamically determining, in response to receiving the transmission request, whether to establish a transmission path for the requesting user to a destination through a transmission network by verifying the requesting user based on one or more authentication rules, wherein the one or more authentication rules are based on first information associated with the transmission network, second information about the requesting user, and third information from the requesting user.The computer program product may further comprise program instructions to, in response to determining that the requesting user satisfies the one or more authentication rules, dynamically establish the transmission path for the requesting user in the transmission network according to one or more transmission attributes associated with the requesting user. BRIEF DESCRIPTION OF THE VARIOUS VIEWS OF THE DRAWINGS

[0007] These and other objects, features, and advantages of the present invention will become apparent from the following detailed description of illustrative embodiments of the invention, which should be read in conjunction with the accompanying drawings. The various features of the drawings are not to scale, as the illustrations, in conjunction with the detailed description, are intended to facilitate the understanding of the invention by those skilled in the art. In the drawings: illustrated Fig. 1 illustrates a networked computing environment according to a single embodiment; is Fig. 2 is an operational flow diagram illustrating steps performed by a program to dynamically establish a transmission path for a requesting user by verifying authenticity of the requesting user and a transmission request according to a single embodiment; is Fig. 3 is a block diagram of the system architecture of the program used to dynamically establish a transmission path for a requesting user by verifying an authenticity of the requesting user and a transmission request according to a single embodiment; is Fig. 4 is a block diagram of an illustrative cloud computing environment according to an embodiment of the present disclosure, including the Fig. 1 shown computer system; and Fig. 5 is a block diagram of functional layers of the illustrative cloud computing environment of Fig. 4 according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0008] Detailed embodiments of the claimed structures and methods are disclosed herein; however, it should be understood that the disclosed embodiments are merely illustrative of the claimed structures and methods, which may be embodied in various forms. This invention may, however, be embodied in many different forms and should not be construed as limited to the exemplary embodiments set forth herein. In the description, details of well-known features and techniques are omitted where appropriate in order not to unnecessarily obscure the illustrated embodiments.

[0009] As previously described, embodiments of the present invention generally relate to the field of data processing, and more particularly to computer and network security. More specifically, the following described exemplary embodiments provide a system, method, and program product for enhancing the generation of network data flows based on application requests and for measuring authenticity of the requests. More specifically, the present invention has the ability to enhance the technical field related to computer and network security by checking a strength of authenticity of a requesting user and a validity of a request based on rules that can determine whether a network is subsequently modified for a requested action.For example, the present invention may include a transmission controller that can interpret rules to check the strength of a requesting user's authenticity and the validity of the requested network actions. The transmission controller may also maintain track of pre-approved applications and their associated predefined network attributes. The transmission controller uses this information to evaluate transmission requests and enable only those that are permitted according to a predefined policy based on the strength of the requesting user's authenticity, the requested connection, and the appropriateness of the request. Changes to the network configuration, in turn, can be sent to the network, such as a software-defined network (SDN), to enable permitted traffic and then disable traffic when transmission is no longer required.

[0010] Specifically, and as previously discussed with reference to computer security, firewalls and endpoint authentication are two common methods for controlling connections and traffic across a network. However, firewalls often require a significant amount of time to determine the complex set of addresses, ports, and protocols to allow or block, potentially delaying critical business operations. Once desired access controls are defined for the firewall, a change window is typically required during which many network entities must be manually updated to implement the desired controls. This is both time-consuming and error-prone due to the manual nature of the configuration process. Furthermore, access controls often remain in place long after an application or system that was responsible for them has been retired.that the access controls were originally implemented. This creates a potential security risk, where the permitted ports and protocols could be used for malware or other unwanted traffic.

[0011] With the advent of software-defined networks (SDN), network entities can be programmatically and rapidly reconfigured, reducing both the time required to implement changes and the potential for user error. Currently, the reconfiguration process is a centralized approach, with the omniscient network operator controlling the creation / deletion of permitted network flows. Furthermore, a network operator can install firewalls within the network to control data flows. With the software-defined network, the network operator could control data flows by having the network create a dynamic route under the network operator's control or by creating a firewall instance specifically for the purpose of supporting appropriate data flows and flow control.However, one reason hackers have been successful in the past has been the lack of entity authentication methods to verify a computing device. This led to the creation of endpoint authentication and the creation of protocols such as SFTP and HTTPS, which require the device to prove its identity as part of establishing a connection. However, SDNs are undergoing a conceptual transition from route creation by an omniscient network operator to route creation on demand by a requesting user, such as a computing device or application on the network. This is enabled by an SDN system that provides application programming interface (API) access through which an entity can instruct the SDN to create / remove / modify a route through the network.Furthermore, while endpoint / entity authentication can be used to authenticate an entity, a requesting user may encompass not only the computing entity, but also an application running on the entity or a microservice associated with a entity and / or application. Consequently, it may not be possible for an omniscient network operator to have knowledge of every possible entity, application, or microservice. Similarly, applications have become temporary containers, created and destroyed as needed, and throughout the application's lifetime, they require network data flows.

[0012] To avoid massive security failures, the network must therefore have procedures to verify the authenticity of a requesting entity in the context of an SDN and with the fact that endpoint entities must generally not be modified to actively participate in proving their authenticity (i.e., the entity must prove a concept). Furthermore, such a solution to this problem must work without changing existing requesting users or changing any existing network protocols, since the installed base of requesting users can be enormous and the cost of changing the interactions with the network and the requesting users can be prohibitively high. Therefore, it may be advantageous, among other things, to provide a method, a computer system, and a computer program product to dynamically (i.e.,automatically, in real time) by checking the strength of authenticity of a requesting user and the validity of a request based on rules that can determine whether a network is subsequently modified to enable a requested action.

[0013] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of instructions comprising one or more executable instructions for performing the specified logical function(s). In some alternative implementations, the functions specified in the block may occur in a different order than shown in the figures. For example, two blocks shown in succession may actually execute substantially concurrently, or the blocks may sometimes execute in reverse order depending on the corresponding functionality.It is further understood that each block of the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented by special purpose hardware-based systems that perform the specified functions or steps, or by combinations of special purpose hardware and computer instructions.

[0014] With reference to Fig. 1 illustrates an exemplary networked computing environment 100 according to a single embodiment. The networked computing environment 100 may include a computer 102 having a processor 104 and a data storage device 106 capable of executing a software program 114, and may also include a microphone (not shown). The software program 114 may be an application program, such as an internet application and / or one or more apps, executing on a client computer 102, such as a desktop, laptop, tablet, or mobile phone device. An authenticity and validation program 108 may communicate with the software program 114. The networked computing environment 100 may also include a server 112 and a transmission network 110.The networked computing environment 100 may include a plurality of computers 102 and servers 112, only one of which is shown for illustrative brevity. For example, the plurality of computers 102 may include a plurality of interconnected devices, such as the mobile phone, tablet, and laptop, associated with one or more users.

[0015] According to at least one embodiment, the present embodiment may also include a database 116, optionally executed on the server 112. The transmission network 110 may include various types of transmission networks, such as a software-defined network (SDN), a wide area network (WAN), a local area network (LAN), a telecommunications network, a wireless network, a public switched network, and / or a satellite network. It should be noted that Fig. 1 illustrates only a single embodiment and does not imply limitations on the environments in which various embodiments may be practiced. Many changes to the illustrated environments may be made based on design and implementation requirements.

[0016] The client computer 102 can exchange data with the server computer 112 via the transmission network 110. The transmission network 110 can include connections such as wired, wireless transmission connections, or fiber optic connections. As described with reference to Fig. 3, the server computer 112 may include internal components 1102a and external components 1104a, respectively, and the client computer 102 may include internal components 1102b and external components 1104b, respectively. The server computer 112 may also operate in a cloud computing service model such as Software as a Service (SaaS), Platform as a Service (PaaS), or Infrastructure as a Service (IaaS). The server 112 may also be located in a cloud computing deployment model such as a private cloud, community cloud, public cloud, or hybrid cloud. The client computer 102 may be, for example, a mobile device, a telephone, a personal digital assistant (PDA), a netbook, a laptop computer, a tablet computer, a desktop computer, or any type of computing device capable of executing a program and accessing a network.

[0017] The networked computing environment 100 may also include a transmission controller 136 capable of executing an authenticity and validation program 108. According to various implementations of the present embodiment, the transmission controller 136 may include one or more servers and / or other computing devices and / or may be embedded in the transmission network 110 or in various storage devices, such as, but not limited to, a networked server 112 or a cloud storage service.The transmission controller 136 may interact with the transmission network 110 and may be configured by the authenticity and validation program 108 to dynamically evaluate transmission requests by checking the strength of a requesting user's authenticity and the validity of a request based on rules that can determine whether the transmission network 110 is subsequently modified to enable a requested action. Specifically, the authenticity and validation program 108 may configure the transmission controller 136 to receive transmission requests, determine whether and how the request is fulfilled, and instruct the transmission network 110 to configure the network as needed.

[0018] According to a single embodiment, a requesting user may be any entity, such as an application, a microservice, a software component, a hardware component, and a computing device, that may request the transmission network 110 to establish a transmission path to a destination. For example, a requesting user may include a database application requesting a connection to another database application for the purpose of backing up a database, a laptop application requesting a connection to a server application, such as an email client, where the laptop requests transmissions with an email server, and / or a microservice requesting a connection to a database, such as a microservice searching for weather information for a particular location.

[0019] As with reference to Fig. 2, the transmission controller 136 and the authenticity and validation program 108 may verify a strength of authenticity of the requesting user of a network route based on one or more or combinations of authenticity assertions, which may include authenticity assertions based on information from the transmission network 110, authenticity assertions based on information about the requesting user, authenticity assertions based on information from the requesting user, and authenticity assertions based on information about a network operator / owner.For example, during a configuration phase, the transmission controller 136 may be configured by the authenticity and validation program 108 to determine what requesting users are permitted to transmit on the transmission network 110 and to the transmission controller 136, to specify required / preferred transmission attributes for certain types of transmissions and / or specific transmissions, to specify a strength of authentication required of the requesting user (or categories of requesting users) to verify the authenticity of the requesting user, and to specify validation rules to evaluate the appropriateness of a request (such as establishing a threshold number of authenticity assurances that a requesting user must meet before a transmission path is established for the requesting user).

[0020] According to a single embodiment, transmission attributes may include required or preferred features of the transmission path, such as, but not limited to, a physical routing of a transmission path through certain physical locations or regions or countries; a requirement for maximum or minimum route latency; a requirement for a high-availability route; a requirement for a route that can accommodate a minimum packet size; a requirement for a route to provide minimum or maximum throughput; a requirement that the route be present only during certain times of the day, certain days of the week; a requirement that the route be encrypted and its encryption strength; and a requirement for minimum and maximum route duration.Also according to a single embodiment, information about a physical network connection may include attributes about the physical connection that the requesting user uses to connect themselves to the broadcast network 110. This information may include the identity of the physical connection, the type and characteristics of the physical connection (e.g., 10 Gigabit link rate, Ethernet, Wired, Fiber), the identity of the switch port, the physical location of the connection (e.g., the Real-Time Transport Protocol (RTP) campus, the state of North Carolina, the country of the United States). Furthermore, according to a single embodiment, information about a logical network connection may include attributes about the logical connection that the requesting user uses to connect themselves to the broadcast network 110.This can include the IP address, the IP subnet, the VLAN ID, the IP address of the default router, the network stack provider.

[0021] With reference to Fig. 2 shows an operational flow diagram 200 illustrating the steps performed by the authenticity and validation program 108 to dynamically evaluate and process transmission requests by checking the strength of the authenticity of a requesting user and the validity of a request based on rules that can determine whether the transmission network 110 should be subsequently modified to enable a requested action. In particular, with reference to Fig. 3 at 202 and as previously described, the transfer controller 136 and the authenticity and validation program 108 may receive a transfer request from a requesting user. As previously described, a requesting user may be any entity that may request the transfer network 110 to establish a transfer path to a destination. For example, a requesting user may include a database application requesting a connection to another database application, a laptop application running on the client computer 102 requesting a connection to a server application running on the server 112, and / or a microservice requesting a connection to a database 116.According to a single embodiment, the requesting user may send a signal to the transfer controller 136 or to the transfer network 110 (which may transmit the transfer request to the transfer controller 136). For example, the transfer network 110 may have received a Domain Name System (DNS) resolution query from a requesting user and inform the transfer controller 136 of the DNS query. Those skilled in the art may recognize several methods for indicating a transfer request; therefore, the above-mentioned methods should not be considered limiting.

[0022] Then, at 204, in response to receiving the transfer request, the transfer controller 136 may use the authenticity and validation program 108 to perform an authenticity check of the requesting user and the transfer request. Specifically, the authenticity and validation program 108 may perform the authenticity check based on a set of authentication rules (i.e., authenticity assertions) that determine whether to establish a connection between the requesting user and a desired server / database to process the required action in the transfer request.More specifically, for example, and as previously described, the authenticity and validation program 108 may perform the authenticity check based on the requesting user and the received request satisfying one or more or combinations of authenticity assertions, which may include authenticity assertions based on information from the transmission network 110, authenticity assertions based on information about the requesting user, authenticity assertions based on information from the requesting user, and authenticity assertions based on information about a network operator / owner.

[0023] For example, for authenticity assertions based on information from the transmission network 110, the authenticity and validation program 108 may cause the transmission controller 136 to query the transmission network 110 for the attributes of the requesting user's physical network, query the transmission network 110 for the information about the requesting user's logical network connection, and / or query the transmission network 110 for the connection history of the requesting user.Also, for example, for authenticity assurances based on information about the requesting user, the authenticity and validation program 108 may cause the transfer controller 136 to check the requesting user for auditable attributes such as open ports and / or a version / level of an operating system (OS) associated with the requesting user, cause the transfer controller 136 to fingerprint the requesting user, and / or cause the transfer controller 136 to query an identity authority that provides an assurance of the authenticity of the requesting user.Also, for example, for authenticity assertions based on information from the requesting user, the authenticity and validation program 108 may cause the transmission controller 136 to receive the requesting user's identification data from the requesting user as part of the request, or it may query and receive the requesting user's identification data from the requesting user. Furthermore, for example, for authenticity assertions based on information about a network operator / owner, the authenticity and validation program 108 may cause the transmission controller 136 to query the network operator for permissible connectivity configurations. Determining whether the authenticity assertion is true (i.e.Whether a single authenticity assertion is true can be based on whether a single authenticity assertion is true, or on a combination of different authenticity assertions, or on a weighted authenticity assertion measure where a summary of the weights exceeds a threshold. Therefore, there can be many techniques for combining the different possible authenticity assertions based on the configuration.

[0024] For example, the transfer controller 136 may receive a DNS query from an application 114 running on the client computer 102, where the DNS query may be for a request to execute a microservice that requests weather information in New York City. Thus, the DNS query may be interpreted as a request to establish a temporary connection between the requesting user (i.e., the application) and a database 116 that stores weather information pertaining to New York City, so that the requesting user can query the database 116. Therefore, the authenticity and validation program 108 may perform an authenticity check of the requesting user and the transfer request to determine whether the requesting user (i.e.,The application (the application) is authentic and / or trusted to establish the transmission path in the transmission network 110 between the requesting user and the database 116. Consequently, based on the authenticity assertions described above, the authenticity and validation program 108 may specify the physical location of the application making the request to determine whether the physical location is a trusted location and / or entity, determine whether the application's logical connection is correct, such as determining that an IP address of the application is understood, and / or determine, based on a connection history, that the application has made a similar connection to the database 116 in the last 16 days.Therefore, based on the satisfaction of one or more combinations of these authenticity assertions and / or based on the satisfaction of a more weighted authenticity assertion, the authenticity and validation program 108 may determine whether a transmission path through the transmission network 110 should be dynamically established to enable the requesting user's application to connect to the database 116.

[0025] At 206, in turn, in response to determining that the transmission request is appropriate, or more specifically, that the requesting user satisfies a required number of authenticity assertions, the authenticity and validation program 108 may cause the transmission controller 136 to instruct the transmission network 110 to establish a transmission path (i.e., network connectivity) defined by required transmission attributes.As previously described, the transmission attributes may include required or preferred characteristics of the transmission path, such as, but not limited to, physically routing the transmission path through specific physical locations or regions or countries; a requirement for maximum or minimum route latency; a requirement for a high-availability route; a requirement for a route that can accommodate a minimum packet size; a requirement that the route only be present for a specific period of time; a requirement that the route be encrypted and its encryption strength; and / or a requirement for minimum and maximum route duration.Therefore, and continuing with the previous example, based on the satisfaction of one or more combinations of the described authenticity assurances, the authenticity and validation program 108 may dynamically establish a transmission path through the transmission network 110 to enable the requesting user's application to connect to the database 116 containing weather information for New York City. Furthermore, at 208, the authenticity and validation program 108 may cause the transmission controller 136 to automatically terminate network connectivity (i.e., the established transmission path) for the requesting user based on transmission attributes when the transmission path is no longer required for the requesting user and the transmission request.

[0026] It should be noted that the Fig. 1 through 2 illustrate only a single embodiment and do not imply limitations on how various embodiments may be implemented. Many changes to the illustrated environments may be made based on design and implementation requirements.

[0027] The present invention may be a system, a method, and / or a computer program product. The computer program product may comprise a computer-readable storage medium (or media) having computer-readable program instructions thereon for causing a processor to carry out aspects of the present invention. The computer-readable storage medium may be any physical device capable of retaining and storing instructions for use by a system for executing instructions. The computer-readable storage medium may be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof.A non-exhaustive list of more specific examples of computer-readable storage media includes the following: a removable computer diskette, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), removable compact disk read-only memory (CD-ROM), a digital versatile disc (DVD), a memory stick, a floppy disk, a mechanically encoded device such as punched cards or raised structures in a groove on which instructions are stored, and any suitable combination thereof.A computer-readable storage medium, as used herein, should not be construed as containing transient signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., pulses of light traveling through fiber optic cables), or electrical signals transmitted through a wire.

[0028] Computer-readable program instructions described herein may be downloaded from a computer-readable storage medium to respective computing / processing units or to an external computer or storage unit via a network such as the Internet, a local area network, a wide area network, and / or a wireless network. The network may include copper transmission cables, fiber optic transmission lines, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing unit receives computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in a computer-readable storage medium within the respective computing / processing unit.

[0029] Computer-readable program instructions for performing operations of the present invention may be assembly language instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state-setting data, or either source code or object code written in any combination of one or more programming languages, including an object-oriented programming language such as Java, Smalltalk, C++, or the like, as well as conventional procedural programming languages ​​such as the C programming language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on the remote computer or server.In the latter case, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet service provider). In some embodiments, electronic circuits, including, for example, programmable logic circuits, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), may execute the computer-readable program instructions by utilizing state information of the computer-readable program instructions to personalize the electronic circuits to perform aspects of the present invention.

[0030] Aspects of the present invention are described herein with reference to flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each block of the flowcharts and / or block diagrams, as well as combinations of blocks in the flowcharts and / or block diagrams, may be implemented by computer-readable program instructions.

[0031] These computer-readable program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that the instructions, executed by the processor of the computer or other programmable data processing apparatus, produce a means for implementing the functions / steps defined in the flowchart block(s) and / or block diagrams.These computer-readable program instructions may also be stored on a computer-readable storage medium that can direct a computer, a programmable data processing apparatus, and / or other devices to function in a particular manner, such that the computer-readable storage medium having instructions stored thereon comprises an article of manufacture, including instructions that implement aspects of the function / step specified in the flowchart block(s) and / or block diagrams.

[0032] The computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of process steps to be performed on the computer, other programmable apparatus, or other device to produce a computer-executable process such that the instructions executing on the computer, other programmable apparatus, or other device implement the functions / steps defined in the block(s) of flowcharts and / or block diagrams.

[0033] Fig. 3 is a block diagram 1100 of internal and external components of in Fig. 1 according to an illustrative embodiment of the present invention. It should be noted that Fig. 3 illustrates only a single embodiment and does not imply limitations on the environments in which various embodiments may be practiced. Many changes to the illustrated environments may be made based on design and implementation requirements.

[0034] Data processing system 110, 1104 represents any electronic device capable of executing machine-readable program instructions. Data processing system 1102 and 1104 may represent a smartphone, a computer system, a PDA, or other electronic device. Examples of data processing systems, environments, and / or configurations that may be represented by data processing system 1102, 1104 include, but are not limited to, personal computer systems, server computer systems, thin clients, thick clients, portable or laptop devices, multiprocessor systems, microprocessor-based systems, network PCs, minicomputer systems, and distributed cloud computing environments, including any of the foregoing systems or devices.

[0035] The user client computer 102 ( Fig. 1), the transmission controller 136 ( Fig. 1) and the network server 112 ( Fig. 1) comprise respective sets of internal components 1102 a, b and external components 1104 a, b, which are arranged in Fig. 3. Each of the sets of internal components 1102 a, b includes one or more processors 1120, one or more computer-readable RAMs 1122 and one or more computer-readable ROMs 1124 on one or more buses 1126, and one or more operating systems 1128, as well as one or more computer-readable tangible storage units 1130. The one or more operating systems 1128, the software program 114 ( Fig. 1) in the client computer 102 ( Fig. 1) and the authenticity and validity verification program 108 ( Fig. 1) in the transmission controller 136 ( Fig. 1) are stored on one or more of the respective computer-readable, tangible storage units 1130 for execution by one or more of the respective processors 1120 via one or more of the respective RAMs 1122 (which typically include a cache). Fig. In the embodiment illustrated in Figure 3, each of the computer-readable, tangible storage devices 1130 is a magnetic disk storage device of an internal hard disk drive. Alternatively, each of the computer-readable, tangible storage devices 1130 is a semiconductor storage device such as a ROM 1124, an EPROM, a flash memory, or any other computer-readable, tangible storage device capable of storing a computer program and digital information.

[0036] Each set of internal components 1102a, b also includes a read / write drive or read / write interface 1132 for reading from and writing to one or more removable, computer-readable, tangible storage devices 1137, such as a CD-ROM, DVD, memory stick, magnetic tape, magnetic disk, optical disk, or semiconductor storage device. A software program, such as an authenticity and validation program 108 ( Fig. 1), may be stored on one or more of the respective removable, computer-readable, tangible storage units 1137, read via the respective read / write drive or read / write interface 1132, and loaded into the respective hard disk drive 1130.

[0037] Each set of internal components 1102 a, b also includes network adapters or network interfaces 1136, such as TCP / IP adapter cards, WiFi radio interface cards, or 3G or 4G radio interface cards, or other wired or wireless transmission connections. The authenticity and validation program 108 ( Fig. 1) and the software program 114 ( Fig. 1) can be accessed on the client computer 102 ( Fig. 1) and the network server 112 ( Fig. 1) from an external computer via a network (for example, the Internet, a local area network, or another wide area network) and respective network adapters or network interfaces 1136. The software program 114 ( Fig. 1) in the client computer 102 ( Fig. 1) and the authenticity and validity verification program 108 ( Fig. 1) in the transmission controller 136 ( Fig. 1) loaded into the respective hard disk drive 1130. The network may include copper cables, fiber optic cables, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers.

[0038] Each of the sets of external components 1104a, b may include a computer display 1121, a keyboard 1131, and a computer mouse 1135. The external components 1104a, b may also include touch-sensitive screens, virtual keyboards, touchpads, pointing devices, and other human interface devices. Each of the sets of internal components 1102a, b also includes device drivers 1140 for connecting to a computer display 1121, a keyboard 1131, and a computer mouse 1135. The device drivers 1140, the read / write drive or read / write interface 1132, and the network adapter or network interface 1136 comprise hardware and software (stored in the memory unit 1130 and / or in the ROM 1124).

[0039] It should be understood at the outset that, although this disclosure includes a detailed description of cloud computing, the implementation of the teachings herein is not limited to a cloud computing environment. Rather, embodiments of the present invention may be practiced in conjunction with any other type of computing environment now known or later invented.

[0040] Cloud computing is a service delivery model for enabling seamless, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal management effort or interaction with a service provider. This cloud model can include at least five characteristics, at least three service models, and at least four implementation models.

[0041] The properties are as follows: On-demand self-service: A cloud user can unilaterally and automatically provision data processing functions such as server time and network storage as needed, without requiring human interaction with the service provider. Broad Network Access: Functions are available over a network and accessed through standard mechanisms that support use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, and PDAs). Resource pooling: The provider's computing resources are pooled to serve multiple users using a multi-tenant model, with various physical and virtual resources dynamically allocated and reassigned as needed. There is a perceived location independence, as the user generally has no control or knowledge over the exact location of the provided resources, but may be able to specify a location at a higher level of abstraction (e.g., country, state, or data center). Rapid Elasticity: Features can be deployed quickly and elastically for rapid horizontal scaling out, in some cases automatically, and released quickly for rapid scale-in. To the user, the features available for deployment often appear unlimited, and they can be purchased in any quantity at any time. Measured Service: Cloud systems automatically control and optimize resource usage by leveraging a measurement function at a certain level of abstraction appropriate for the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, creating transparency for both the provider and the user of the service.

[0042] The service models are as follows: Software as a Service (SaaS): The functionality provided to the user is to use the provider's applications running on a cloud infrastructure. The applications are accessible from various client devices via a thin client interface such as a web browser (e.g., web-based email). The user does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, storage, or even individual application features, with the possible exception of limited user-specific application configuration settings. Platform as a Service (PaaS): The functionality provided to the user is to deploy applications created or obtained by a user, which were built using programming languages ​​and tools supported by the provider, on the cloud infrastructure. The user manages ordoes not control the underlying cloud infrastructure, including networks, servers, operating systems, or storage, but has control over the applications deployed and possibly over configurations of the application hosting environment.

[0043] Infrastructure as a Service (IaaS): The functionality provided to the user consists of providing processing, storage, networking, and other basic computing resources, allowing the user to deploy and run any software, including operating systems and applications. The user does not manage or control the underlying cloud infrastructure, but has control over operating systems, storage, deployed applications, and possibly limited control over selected network components (e.g., host firewalls).

[0044] The deployment models are as follows: Private Cloud: The cloud infrastructure is operated solely for an organization. It can be managed by the organization or a third party and can be located on its own premises or on a third-party site.

[0045] Community Cloud: The cloud infrastructure is shared by multiple organizations and supports a specific user community with common concerns (e.g., mission, security requirements, policies, and compliance considerations). It can be managed by the organizations or a third party and can be located on their own premises or on third-party premises.

[0046] Public Cloud: The cloud infrastructure is made available to the general public or a large industry group and is owned by an organization that sells cloud services.

[0047] Hybrid Cloud: Cloud infrastructure is a composition of two or more clouds (private, community, or public) that remain separate entities but are interconnected by a standardized or proprietary technology that enables data and application portability (e.g., cloud targeting for load balancing between clouds).

[0048] A cloud computing environment is service-oriented with a focus on state independence, low coupling, modularity, and semantic interoperability. At the heart of cloud computing lies an infrastructure consisting of a network of interconnected nodes.

[0049] With reference to Fig. 4, an illustrative cloud computing environment 1200 is shown. As shown, the cloud computing environment 1200 includes one or more cloud computing nodes 4000 with which local computing devices used by cloud users, such as a personal digital assistant (PDA) or cellular phone 1200A, a desktop computer 1200B, a laptop computer 1200C, and / or an automotive computer system 1200N, can communicate. The nodes 4000 can communicate with each other. They can be physically or virtually grouped into one or more networks such as private, community, public, or hybrid clouds (not shown), as described above, or a combination thereof. This enables the cloud computing environment 2000 to offer infrastructure, platforms, and / or software as services for which a cloud user does not need to maintain resources on a local computing device.It should be noted that the types of . Fig. 4 are intended to be merely illustrative and that the computing nodes 4000 and the cloud computing environment 2000 may communicate with any type of computer-based device via any type of network and / or via any type of network-accessible connection (e.g., using a web browser).

[0050] With reference to Fig. 5 shows a set of functional abstraction layers 1300 provided by the cloud computing environment 1200 ( Fig. 4) are provided. It should be clear from the outset that the Fig. The components, layers, and functions shown in Figure 5 are intended to be illustrative only, and embodiments of the invention are not limited thereto. As shown, the following layers and corresponding functions are provided:

[0051] A hardware and software layer 60 includes hardware and software components. Examples of hardware components include: mainframe computers 61; Reduced Instruction Set Computer (RISC) architecture-based servers 62; servers 63; blade servers 64; storage units 65; and networks and network components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0052] A virtualization layer 70 provides an abstraction layer from which the following examples of virtual entities may be deployed: virtual servers 71; virtual storage 72; virtual networks 73, including virtual private networks; virtual applications and operating systems 74; and virtual clients 75.

[0053] In one example, a management layer 80 may provide the functions described below. Resource provisioning 81 provides for the dynamic procurement of computing resources and other resources used to perform tasks within the cloud computing environment. Metering and pricing 82 provides cost tracking when using resources within the cloud computing environment, as well as billing or invoicing for the consumption of those resources. In one example, these resources may include application software licenses. Security provides identity verification for cloud users and tasks, as well as protection for data and other resources. A user portal 83 provides users and system administrators with access to the cloud computing environment.Service level management 84 provides the allocation and management of cloud computing resources so that the required service objectives are met. Service level agreement (SLA) planning and fulfillment 85 provides the pre-arranging and procurement of cloud computing resources for which future requirements are anticipated, in accordance with an SLA.

[0054] A workload layer 90 provides examples of the functionality for which the cloud computing environment can be used. Examples of workloads and functions that can be provided by this layer include: mapping and navigation 91; software development and lifecycle management 92; providing education in virtual classrooms 93; data analytics processing 94; transaction processing 95; and authenticity and validity checking 96. An authenticity and validity checking program 108 ( Fig. 1) can be offered "as a service in the cloud" (i.e., Software as a Service (SaaS)) and dynamically establish a transmission path for a transmission request by checking a strength of authenticity of a requesting user and a validity of a request based on rules that can determine whether a transmission network is subsequently modified to enable a requested action.

[0055] The descriptions of the various embodiments of the present invention have been presented for illustrative purposes, but are not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope of the described embodiments. The terminology used herein has been chosen to best explain the principles of the embodiments, practical application, or technical improvement over existing technologies, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

[1] A method for establishing a transmission path for a requesting user by verifying an authenticity of the requesting user and a transmission request, the method comprising: in response to receiving the transmission request, determining whether the transmission path for the requesting user to a destination through a transmission network should be established by verifying the requesting user based on one or more authentication rules, wherein the one or more authentication rules are based on first information associated with the transmission network, second information about the requesting user, and third information from the requesting user, wherein the first information associated with the communications network comprises one or more attributes of a physical network, information about a logical network connection, and information about a connection history associated with the requesting user; and in response to determining that the requesting user satisfies the one or more authentication rules, establishing the transmission path for the requesting user in the transmission network according to one or more transmission attributes associated with the requesting user. [2] The method of claim 1, wherein the requesting user is selected from a group comprising an application and / or a microservice and / or a software component and / or a hardware component and / or a data processing device. [3] The method of claim 1, further comprising: wherein the one or more authentication rules are based on fourth information about permissible connectivity provided by a network operator, and wherein verifying the requesting user based on the fourth information from the network operator comprises: Query the network operator for permissible connectivity configurations. [4] The method of claim 1, wherein checking the requesting user based on first information associated with the transmission network further comprises: Determining the one or more attributes of a physical network associated with the requesting user; Determining the information about a logical network connection belonging to the requesting user; and Determine connection history information associated with the requesting user. [5] The method of claim 1, wherein checking the requesting user based on second information about the requesting user further comprises: Checking the requesting user for auditable attributes, including open ports and a version of an operating system belonging to the requesting user, and Obtaining information about the requesting user from a directory or database. [6] The method of claim 1, wherein checking the requesting user based on third information from the requesting user further comprises: Querying the requesting user to receive information and identification data related to the requesting user. [7] The method of claim 1, further comprising: Automatic termination of the established transmission path in response to determining that the transmission path is no longer required for the requesting user. [8] A computer system for establishing a transmission path for a requesting user by verifying an authenticity of the requesting user and a transmission request, the computer system comprising: one or more processors, one or more computer-readable memories, one or more computer-readable tangible storage units, and program instructions stored on at least one of the one or more storage units for execution by at least one of the one or more processors via at least one of the one or more memories, the computer system being capable of performing a method comprising: in response to receiving the transmission request, determining whether the transmission path for the requesting user to a destination through a transmission network should be established by verifying the requesting user based on one or more authentication rules, wherein the one or more authentication rules are based on first information associated with the transmission network, second information about the requesting user, and third information from the requesting user, wherein the first information associated with the communications network comprises one or more attributes of a physical network, information about a logical network connection, and information about a connection history associated with the requesting user; and in response to determining that the requesting user satisfies the one or more authentication rules, establishing the transmission path for the requesting user in the transmission network according to one or more transmission attributes associated with the requesting user. [9] The computer system of claim 8, wherein the requesting user is selected from a group comprising an application and / or a microservice and / or a software component and / or a hardware component and / or a data processing device. [10] The computer system of claim 8, further comprising: wherein the one or more authentication rules are based on fourth information about permissible connectivity provided by a network operator, and wherein verifying the requesting user based on the fourth information from the network operator comprises: Query the network operator for permissible connectivity configurations. [11] The computer system of claim 8, wherein checking the requesting user based on first information associated with the transmission network further comprises: Determining the one or more attributes of a physical network associated with the requesting user; Determining the information about a logical network connection belonging to the requesting user; and Determine connection history information associated with the requesting user. [12] The computer system of claim 8, wherein checking the requesting user based on second information about the requesting user further comprises: Checking the requesting user for auditable attributes, including open ports and a version of an operating system belonging to the requesting user, and Obtaining information about the requesting user from a directory or database. [13] The computer system of claim 8, wherein checking the requesting user based on third information from the requesting user further comprises: Querying the requesting user to receive identification data associated with the requesting user. [14] The computer system of claim 8, further comprising: Automatic termination of the established transmission path in response to determining that the transmission path is no longer required for the requesting user. [15] A computer program product for establishing a transmission path for a requesting user by verifying an authenticity of the requesting user and a transmission request, the computer program product comprising: one or more tangible, computer-readable storage devices and program instructions stored on at least one of the one or more tangible, computer-readable storage devices, the program instructions being executable by a processor, the program instructions comprising: Program instructions for determining, in response to receiving the transmission request, whether the transmission path for the requesting user to a destination through a transmission network should be established by verifying the requesting user based on one or more authentication rules, wherein the one or more authentication rules are based on first information associated with the transmission network, second information about the requesting user, and third information from the requesting user, wherein the first information associated with the communications network comprises one or more attributes of a physical network, information about a logical network connection, and information about a connection history associated with the requesting user; and Program instructions to, in response to determining that the requesting user satisfies the one or more authentication rules, establish the transmission path for the requesting user in the transmission network according to one or more transmission attributes associated with the requesting user. [16] The computer program product of claim 15, wherein the requesting user is selected from a group comprising an application and / or a microservice and / or a software component and / or a hardware component and / or a data processing device. [17] The computer program product of claim 15, further comprising: wherein the one or more authentication rules are based on fourth information about permissible connectivity provided by a network operator, and wherein verifying the requesting user based on the fourth information from the network operator comprises: Query the network operator for permissible connectivity configurations. [18] The computer program product of claim 15, wherein the program instructions for verifying the requesting user based on first information associated with the transmission network further comprise: Program instructions to determine the one or more attributes of a physical network associated with the requesting user; Program instructions to determine the information about a logical network connection belonging to the requesting user; and Program instructions to determine the connection history information belonging to the requesting user. [19] The computer program product of claim 15, wherein checking the requesting user based on second information about the requesting user further comprises: Program instructions to check the requesting user for auditable attributes, including open ports and a version of an operating system belonging to the requesting user; and Program instructions to retrieve information about the requesting user from a directory or database. [20] The computer program product of claim 15, wherein the program instructions to check the requesting user based on third information from the requesting user further comprise: Program instructions to query the requesting user to receive identification data associated with the requesting user.

Images