FIELD

The present invention relates to a system and method for managing access of data processing devices to networks. More particularly, the present invention relates to systems and methods for managing access of data processing devices to networks through a distributed ledger integrating address protocol and identity attributes of users.

BACKGROUND

Computing devices in permanent or semi-permanent networked use nowadays, extend far beyond the conventional computers and laptops of yesteryear, to personal communication terminals such as smartphones, industrial and domestic appliances, personal vehicles and many other devices including even toys, all commonly referred to as ‘things’ in the expression ‘Internet of Things’, wherein their aggregate number has increased over the relatively short time span of two to three decades, from tens to hundreds of thousands to now several tens of millions at least, in parallel with the deployment of quasi-ubiquitous network connectivity.

The pace of this development remains ever increasing, to the extent of the total number of computing devices in networked use at any given time soon, or already, comfortably exceeding the human population simultaneously using them.

Two problems that are inherently related to one another, arise from this situation. Firstly, at any particular node of a network, that of establishing at a relevant time, and maintaining over a period of time, a level of confidence about the identity of a user associated with a remote node, be it a computer connected to the Internet, a fridge likewise connected to the Internet, a smartphone connected to a cellular network, or an individual software-as-a-service session on either platform. Secondly, considering the ever-increasing number of network nodes associated with any particular individual, that of scaling up this level of confidence across multiple networks operating under different protocols and having widely-varying authentication requirements and capacities.

Recent attempts at mitigating the above quandary have relied upon block chain-based technologies, which are known to consume non-trivial amounts of computer processing power for verification purposes, and which exhibit limited flexibility for adaptation to varying application contexts. Further, the inherently anonymous design of the Internet results in indifferent neutrality of the technology in the case of node-oriented solutions: in the TCP/IP protocol, the data sender is potentially anonymous, and the intelligence is in the nodes, not in the network, for purposes of resilience, convenience and effectiveness. This design structure prevents network-wide authentication, requiring session-specific authentication instead, for instance using the Transport Layer Security protocol.

Research for technological solutions to the above problems is routinely ongoing outside the administrative context of identity control and individual or national security considerations. This disconnection between the digital realm and administrative constructs such as borders, nationalities and other jurisdictional rules, results in non-trivial governmental resources dedicated to network data auditing and surveillance for security purposes, because it is still highly impractical to try and enforce user accountability and borders in digital networks.

Authentication, accountability and compliance monitoring are prerequisites for creating a stable, predictable and secure environment. A scalable network architecture apt to authenticate and monitor user, device and/or data structure identity, rather than defer the task to discrete entities ad hoc, is therefore desirable in view of the above.

SUMMARY OF THE INVENTION

The present invention relates to a network architecture incorporating ledgers and systems for information, communication, transaction integrity and security, which is implemented by a methodology carried out by one or more core network access providers (CNAP) interfaced with all the layers, including the lowest layers of infrastructure in a communication network for controlling users access to the ledgers and systems and interaction, wherein one of the ledgers integrates a distributed ledger of identities of nodes, systems and communication addresses with address protocol and identity attributes of a user or node. The present invention relates to an architecture and operating-system enabling design of systems, networks and ledgers with rights and policy enforcement for information, communication, transaction, identity and access integrity and security using the different layers of infrastructure in a communication network and attached systems, networks and ledgers to control the use of the systems, networks and ledgers, The method is carried out by the core network access provider (CNAP) systems used for permissioned access to trusted systems that all can interoperate with other platforms, applications, ledgers and networks.

According to an aspect of the present invention therefore, there is provided a computer-implemented method of providing each node of a network with access to the network (and network based system or systems that run on, or are attached to the network, and/or to any other nodes connected to the network) wherein the network comprises at least one protocol stack comprising a plurality of layers, the method comprising the steps of controlling real time access to and activity on the network of each layer of the protocol stack by at least one core network access provider, wherein the core network access provider comprises at least one digital and/or physical entity; sequentially assigning a network communication address to the or each access-requesting node at the core network access provider; encoding the assigned network communication address at the core network access provider with a unique parameter of the node and a unique parameter of the node user, in an integrity identifier ledger; distributing the integrity identifier ledger in real time to each network-connected node; receiving the distributed identifier ledger and processing same at each network-connected node or one or more certified nodes to verify it integrity related to all relevant aspects; upon determining a loss of integrity in the ledger, identifying the ledger record causing the loss and broadcasting an alert comprising the identified ledger record to each network-connected node or one or more certified nodes; and upon either identifying a ledger record causing a loss of integrity or receiving an alert at the core network access provider, cancelling or controlling access to the network and its connected nodes and systems for the node having the identifier corresponding to the identified ledger record or the node that has taken the communication address. The integrity related to all relevant aspects may comprise its sequential, identity factor and process integrity. In one embodiment this could be monitored or any of the other functionalities in the CNAP or other attached system capabilities. In one embodiment, the core network access provider is configured for receiving computer programs and information containing conditions controlling access to different systems and intelligence on operational requirements and use of these CNAP capabilities. In one embodiment the distribution of the integrity identifier leger in real time to each network-connected node is to CNAPs with certification, a group of users/nodes pre-set by the system specification (e.g. a group of banks), or each network connected node. In one embodiment the verification of integrity further comprises an ability to immediately detect a change or a breach in user identification attributes (e.g. Identity/IP/machine code) and react according with the pre-set system of the node (such as a CNAP blocking of the breached user or an access database blocking or restricting a user). In one embodiment, one or more certified nodes may be alerted if a node is identified as lacking in integrity.

The method of invention advantageously combines and integrates a distributed transparency ledger technology, the communication layer and identifiable attributes inherent in a communication network, and devices and systems connected to it, to secure identification and make any change in the status immediately visible to the participating nodes of the ledger. The ledger is operated by, and accessed through globally, one or more core network access providers, the whole or parts of which can be managed by common platforms controlled by multiple players or a single institution.

With the methodology of the invention, core network access providers have, or can gain, full control of the nodes across the physical and virtual network and its capabilities and functions. Systems and ledgers wherein access is managed from a core network access provider can be specified and enforced in all participating networks across a wide area network like the Internet, as the access system implemented by each core network access provider to the ledger or system is granted. Each core network access provider is used as a central point of authenticating access, because they are adapted to control the physical and virtual functions of the network and its use whereby, even though core network access providers cannot control a whole wide area network like the Internet, they can control the use of its systems. They can also control its users and the terms of which a user can be given access to the network, systems and ledgers or parts of it. Through this, a user's access to the whole wide area network can be controlled from the user's CNAP. As more and more CNAPs comply with different systems, network and ledger conditions, the different systems integration and enforcement spread across an increasing number of users and an increasing geographical area.

The method of invention thus advantageously sets a standard in a network within a wider network, wherein authentication can be forced and a secure key breach notification installed for proper accountability and integrity across all communications. The foundational network architecture and capabilities of a core network access provider, the access technology to ledgers and systems and the features of the ledger of the present invention, all result in a network architecture which permits ease of scalability and implementation, increased flexibility and interoperability between different systems and ledgers. The ledger and CNAP verify integrity in sequence and integrity in all registered identity attributes (cryptologically, physically, digitally, or other attributes etc). This will make it impossible to change the status of the ledger and the id without it becoming apparent to the nodes with access to the ledger. This communication related to the distribution of the ledger and alert of an identity breach can use dedicated systems and/or circuit switched networks that are encrypted and have guaranteed message delivery.

In an embodiment of the method, the step of sequentially assigning the network communication address preferably further comprises matching at least one unique parameter of the data structure or device/hardware and/or at least one unique parameter of the data processing device user with one or more predetermined access parameters. The or each predetermined access parameter may advantageously be selected from the group comprising global positioning system (GPS) coordinates, geographical coordinates of network interfacing points, IP addresses or autonomous system numbers issued by regional internet registries (RIR), session keys or authorisation tokens issued by application service providers (ASP).

Preferably, the underlying reality of e.g. a MAC address, an IP address and other static or semi-static technological identifiers is cryptographically derived, synthesized, hashed and/or attached to a virtual identifier, so that a potential change in the physical network protocol, socket address, port number, or other data structure corresponding to such relevant information shall be visible on the ledger. Accordingly, in an embodiment of the method, the step of encoding preferably further comprises hashing the encoded network communication address, node unique parameter and node user unique parameter, and wherein the integrity identifier ledger is a block chain data structure. In an alternative embodiment of the method, the step of encoding may instead, or also, comprise the further step of processing the assigned network communication address into a digital signature or a digital key. In an alternative embodiment of the method, the hash is cryptographically attached to the underlying physical communication address and/or other identity attributes and a change in the underlying reality will destroy the hash and be alerted on the ledger.

Preferably, a core network access provider should be certified for operation, and thus the grant or prevention of access to the network or its systems, if it is compliant with the specific technological and administrative conditions for use of systems connected to the network, applicable both to the core network access provider and the network nodes. Different systems can require different conditions for a core network access provider to be accepted. Such conditions can relate to one or more distinct functions of one or all of a core network access provider's capabilities, available to control its network and the use of it by its nodes. Some system may require a core network access provider to deploy of all its resources to control, enhance or stop functionality and activities on the network.

Accordingly, an embodiment of the method may comprise the further step of certifying at least one network-connected node as a second core network access provider according to a list of predetermined core network access provider attributes selected from hardware attributes, software attributes, communication attributes and a ruleset.

Some system may also, or alternatively, implement or defer the certification task to a plurality of already-certified core network access providers as a voting requirement, in which that plurality must vote to approve, and thereby certify, a new core network access provider. The enforcement of nodal integrity and system enforcement across a network and its subdivisions advantageously increases, as the number of certified core network access providers complying with cumulative conditions of the various network systems increases.

Accordingly, in an embodiment of the method including the further step of certifying, upon the network comprising a plurality of core network access providers, the step of certifying a network-connected node as a further core network access provider preferably further comprises a step of voting to certify the node at each of the plurality of core network access providers. In one embodiment the voting system among the node or CNAP comprises where the new CNAP must be approved by a number of, or all, the existing CNAPs.

An embodiment of the method including the further step of certifying may comprise the further step of geo-locating each core network access provider.

An embodiment of the method including the further step of certifying may comprise the further step of decertifying a core network access provider when it fails to uphold one or more attributes of the list of predetermined core network access provider attributes of the systems, networks and ledgers the CNAP must be compliant with. In one embodiment this further step may comprise cancelling access for the CNAP and its nodes/users by an automatic technological process related to the computer program that constitutes the ledger or system and that function in all the CNAPs that is certified for the system or ledger.

According to another aspect of the present invention, there is also provided a system comprising at least one protocol stack comprising a plurality of layers; at least one core network access provider operably interfaced with each layer of the protocol stack and configured for receiving information on systems, subnetworks and ledgers attached to the network and to control real time access of nodes to the network and their activity on the network, wherein the core network access provider comprises at least one digital and/or physical entity; one or more nodes connected to the network, wherein the or each node is sequentially assigned a network communication address by the core network access provider when requesting network access; and an integrity identifier ledger comprising, for each node, the assigned network communication address encoded therein with a unique parameter of the node and a unique parameter of the node user, wherein the integrity identifier ledger is distributed to each network connected node in real time; wherein the or each core network access provider and each node is further configured to process a received ledger to verify its integrity, identify a ledger record causing a loss of integrity, broadcast an alert comprising the identified ledger record across the network; and wherein the or each core network access provider is further configured to cancel or control access to the network or specific systems or other nodes for the node having lost its integrity e.g. by having the network communication address corresponding to the identified ledger record. In an embodiment the at least one core network access provider interfaced with each layer of the protocol stack is configured to control real time access of nodes to the network and control the nodes possible activities on the network. In an embodiment, if there is dissonance with the underlying nodes identity, an alert is sent on the ledger. A change in identity can be detected by a CNAP or directly in the ledger.

In an embodiment of the system, the or each core network access provider may be further configured to verify the accuracy of one or more unique parameter(s) of each node user, wherein a maximum number of network communication addresses assignable by the or each core network access provider in the network is equal to a number of identities verified thereat.

In another embodiment of the system, the or each core network access provider may be further configured to process each network communication address assigned to a node into a digital signature or a digital key.

In any of the embodiments of the method and system disclosed herein, the or each unique parameter of a node is preferably selected from the group comprising a media access control (MAC) address, an international mobile equipment identity (IMEI) code, a mobile equipment identifier (MEID) code, an electronic serial number (ESN), an Android_ID hex string or other type of identifier enabling hardware to communicate on a network.

In any of the embodiments of the method and system disclosed herein, the or each unique parameter of a node user is preferably selected from the group comprising global positioning system (GPS) coordinates, biometric data, a personal identification number (PIN), a password, a passport serial number, a universally unique identifier (UUID) or any other type of identifier that can identify a user.

According to another aspect of the present invention, there is also provided a data structure comprising at least one network communication address, at least one unique parameter of a network node and at least one unique parameter of the network node user, for use with the methodology disclosed herein, and in the network architecture disclosed herein (a) The CNAP, (b) its communication, registration and processing database/server (300), (c) all the CNAP capabilities, (d) external systems, networks, databases, ledgers and other connected systems and nodes, (e) the user identity ledger. This provides the framework for designing systems, networks and ledgers that can be registered and implemented into the CNAP for all these components and attached systems to operate according to the design of the system. The receiving and processing database in the CNAP (300) is configured for external communication, can register, store, update and run computer programs that interface with all the above mentioned capabilities and external systems and ledgers. The databases (300) has an operating-system that enable data programs/systems to utilize all the internal and external capabilities. The operating system comprises a communication configuration, a program/system registration, implementation and update system, an information processing unit, and interface with all the capabilities and systems to execute (e.g. access and blocking conditions) a registered program/system. The CNAP300provide an intelligence hub that can easily deploy and update systems implying functions across networks, systems and ledgers and through different layers of technological means. The system/program design (requirements and conditions) is implemented via a data program into the CNAP (300) to operate the CNAP capabilities to provide the support for the system that is required, and designed, by the system owner. (e.g. governments, companies, organizations, people, consortiums etc.) To secure unified performance and compliance with the programs across networks related to the systems, networks and ledgers designed to run on the operating-system of the CNAP300, the operating-system and/or the programs running on it can be made fully or partly open source so that all changes are distributed to all certified nodes. The CNAP300module can also be made fully or partly transparent so that the other certified CNAPs can control the actual real time operation and communication of the different systems. The program can also be designed to only function the intended way or to self-destruct if it is tampered with. A third party, a group of nodes or other independent system can also manage the program for the CNAPs. A certified CNAP and its users must be in constant compliance with the program/system to have access. The program may be designed so that the pre designed system is automatically enforced so that the neither the CNAP nor the users can breach the conditions of the system without automatically losing access. The CNAP registers and enforces the systems/programs through its capabilities and interface with external units to comply with the different programs/systems and different users. The identifier ledger system can function so that the CNAP cannot assign addresses for communication without registering the user on the ledger. The process and all attributes related to the ledger and its underlying information can be made transparent to all certified nodes. Any breach is distributed on the ledger as it happens. The nodes with access to information about the ledger can be regulated in the System/program (e.g. only certified CNAPs, groups of nodes and databases, all connected nodes including all users). The CNAP is the gatekeeper, intermediate to multiple networks, systems and ledgers with different access and operational conditions providing the intelligence for the systems, networks and ledgers function and communication. The potential design of the programs/systems that can be implemented in the CNAP300increase as the CNAP, its capabilities and connected systems increase. These systems inter operate through the identity ledger and the CNAP300operating-system. CNAP secures integrity in authentication and access between systems, networks, users on both sides. This enables an increasing system and network design opportunities that can utilize the capabilities of the CNAP. Networks, systems and ledgers within the network (WAN) can be designed for different users. The networks, systems and ledgers can interoperate through the CNAP, the id ledger and externally connected systems. Thus, the id ledger and the CNAP provide a platform for interoperation between systems, ledgers, applications and subnetworks connected to the network. The present invention thus provides an interface for receiving and storing programs and systems, with requirements and parameters for use and access on the network and its connected systems, subnetworks and ledgers. According to an aspect of the present invention therefore, there is provided a computer-implemented method of providing each node of a network with access to the network (and network based system or systems that run on, or are attached to the network), comprising the steps of controlling real time access to the network across layers of its protocol stack with at least one core network access provider; sequentially assigning a network communication address to the or each access-requesting node at the core network access provider; encoding the assigned network communication address at the core network access provider with a unique parameter of the node and a unique parameter of the node user, in a sequential identifier ledger; distributing the sequential identifier ledger in real time to each network-connected node; receiving the distributed identifier ledger and processing same at each network-connected node to verify its sequential integrity; upon determining a loss of sequential integrity, identifying the ledger record causing the loss and broadcasting an alert comprising the identified ledger record to each network-connected node; and upon either identifying a ledger record causing a loss of sequential integrity or receiving an alert at the core network access provider, cancelling access to the network for the node having the network communication address corresponding to the identified ledger record or the node that has taken the IP. According to another aspect of the present invention, there is also provided a network architecture comprising at least one protocol stack; at least one core network access provider interfaced with each layer of the protocol stack and configured to control real time access of nodes to the network; one or more nodes connected to the network, wherein the or each node is sequentially assigned a network communication address by the core network access provider when requesting network access; and a sequential identifier ledger comprising, for each node, the assigned network communication address encoded therein with a unique parameter of the node and a unique parameter of the node user, wherein the sequential identifier ledger is distributed to each network connected node in real time; wherein the or each core network access provider and each node is further configured to process a received ledger to verify its sequential integrity, identify a ledger record causing a loss of sequential integrity, broadcast an alert comprising the identified ledger record across the network; and wherein the or each core network access provider is further configured to cancel access to the network for the node having the network communication address corresponding to the identified ledger record.

Other aspects of the present invention are as stated in the appended claims.

