RU2820407C1 - System and method of interworking client and server - Google Patents

Abstract

FIELD: computer engineering.

SUBSTANCE: interworking method comprises steps of: intercepting a connection request from a client to a server; initiating, on behalf of the client, a request for a TLS connection with a server; receiving a certificate and a public key from the server, which are transmitted to an isolated encryption module; checking the obtained server certificate for authenticity by interacting with the certificate base; if the server certificate is determined to be authentic, public and private encryption keys of the client are created and the public encryption keys are exchanged with the server to create an encrypted communication channel, wherein the encryption of data sent from the client to the server, is realized with the help of the public key of the server, and decryption of data sent from the server to the client is realized with the help of the private key of the client.

EFFECT: high security of interworking between a client and a server.

8 cl, 3 dwg

Description

Technical field

The invention relates to the field of information security, and more specifically to systems and methods for ensuring secure internetwork interaction between a client and a server.

State of the art

Malware is constantly evolving, challenging information security service providers to keep up with the ever-changing threat landscape. Among other things, attackers are developing ways to distribute malicious software (software), using new vulnerabilities to penetrate computer systems (hereinafter referred to as computers).

Currently, various types of attacks on computer network resources are used. For example, a “man-in-the-middle” attack, during which an attacker intercepts data using methods that allow them to infiltrate an existing connection or communication process between two parties. An example of such methods is the method by which the parameters of the DNS server or hosts file on the “victim” computer are changed. While the “victim” believes that he is working directly, for example with a bank’s website, the traffic passes through the attacker’s intermediate node, which thus receives all the data sent by the user (personal data, login, password, PIN code, etc. .).

A solution is known from the prior art, the Transport layer security protocol (hereinafter referred to as TLS), designed to protect against the type of attacks described above. The TLS protocol implements three types of security - encryption, authentication and integrity. Encryption is the hiding of information transmitted from one computer to another. Authentication - checking the authenticity of the source of transmitted information. Integrity - detecting the substitution of information with a fake. It is worth noting that in this protocol there is no implementation of protecting the storage of SSL/TLS certificates (hereinafter referred to as certificates) from an attacker who, in order to achieve his goals, can replace a valid certificate of a trusted resource with his own to disguise his node as a legitimate service.

The solution presented in patent RU 2514138 C1 is known from the prior art. As a solution, a system and method for verifying a public key certificate is presented in order to counter man-in-the-middle attacks. This publication describes a method in which information about issued certificates is obtained and anomalies are detected by analyzing suspicious events associated with the certificate in question. Additional information is then collected about the certificates for which anomalies were detected. A list of suspicious certificates is generated by finding inconsistencies with previously obtained data and a decision is made on the legality of using certificates for authentication purposes by analyzing the inconsistencies found.

This solution quite effectively solves the problem of secure data transfer between the client and the server, but the problem of the lack of implementation of certificate store protection remains unresolved.

Disclosure of the invention

The objective of the proposed solution is to implement an internetworking system between the client and the server, while all functional modules of the internetworking system are isolated from each other.

The technical result of the present invention is to increase the security of the internetwork interaction between the client and the server through the use of an internetwork system for data transmission, and all modules of the internetwork system perform their functions in isolation from each other.

As one embodiment of the present invention, a method of internetworking is provided, implemented on at least one computer system and comprising the steps of: intercepting, using an isolated transport interaction module, a connection request from a client to a server; using an isolated transport interaction module on behalf of the client, initializing a request for a TLS connection with the server; using an isolated transport interaction module, they receive a certificate and a public key from the server, which are transmitted to the isolated encryption module; using an isolated encryption module, the received server certificate is checked for authenticity by interacting with the certificate database through an isolated certificate control module; if the server certificate is determined to be genuine, create the client's public and private encryption keys through the isolated encryption module and exchange public encryption keys through the isolated transport interaction module with the server to create an encrypted communication channel, wherein the encryption of data sent from the client to the server is implemented using the public server key, and decryption of data sent from the server to the client is implemented using the client’s private key.

In another embodiment of the method, isolation of the transport interaction module, encryption module and certificate control module is carried out using a security module based on security policies that contain requirements and conditions for interaction with each mentioned module.

In yet another embodiment of the method, during each interaction between the isolated transport interaction module, the isolated encryption module and the isolated certificate control module, compliance with security policies is checked using the security module.

In another embodiment of the method, each request from one isolated module to another isolated module is intercepted, the intercepted request is analyzed and the intercepted request is transferred to the assigned isolated module if the specified request complied with the requirements and conditions of the security policy.

As another embodiment of the present invention, there is proposed an internetworking system consisting of at least one computer system and containing: a security module designed to isolate a transport interaction module, an encryption module and a certificate control module, wherein the isolation is based on security policies that contain requirements and conditions for interaction with each mentioned module; an isolated transport interaction module that interacts with a client, a server and an isolated encryption module, and is designed to: intercept a connection request from a client to a server; initializing a TLS connection with the server; obtaining a certificate and public key from the server; transferring the received data to an isolated encryption module; creating an encrypted communication channel between the client and the server, if the server certificate is genuine; transferring data between client and server using an encrypted communication channel; an isolated encryption module designed to verify the authenticity of the server certificate by interacting with an isolated certificate control module and, in the case of the authenticity of the certificate, to: create public and private client keys; encrypting data sent by the client to the server using the server’s public key; decrypting data sent by the server to the client using the client’s private key; transferring the client's public key and the result of checking the server certificate to the isolated transport interaction module; isolated certificate control module designed to provide an isolated encryption module with access to the certificate database.

In another embodiment, the security module checks the implementation of security policies each time each module is accessed.

In another embodiment, these modules interact with each other through the security module by exchanging IPC messages.

In another embodiment, the security module intercepts each call from one isolated module to another isolated module, analyzes the intercepted call, and forwards the intercepted call to the designated isolated module if the specified call meets the requirements and conditions of the security policy.

Brief description of drawings

The accompanying drawings illustrate only exemplary embodiments of the invention and therefore should not be considered limiting its scope. Additional objects, features and advantages of the present invention will become apparent from a reading of the following description of the invention with reference to the accompanying drawings, in which:

Fig. 1 illustrates an example of a computer network within which an internetworking system is implemented.

Fig. 2 illustrates a method for internetworking between a client, an internetworking system, and a server.

Fig. 3 illustrates an example of a general purpose computer system.

Carrying out the invention

Objects and features of the present invention, methods for achieving these objects and features will become apparent by reference to exemplary embodiments. However, the present invention is not limited to the exemplary embodiments disclosed below, but may be embodied in various forms. The substance set forth in the specification is nothing more than the specific details necessary to assist one skilled in the art in fully understanding the invention, and the present invention is defined within the scope of the appended claims.

Glossary

SSL/TLS (Secure Socket Layer/Transport Layer Security) is a protocol for secure communication over the Internet in a client-server system.

An SSL/TLS certificate is a digital certificate that authenticates a server and allows an encrypted connection.

IPC (Interprocess Communication) is a mechanism designed for data exchange and synchronization between different processes that run on one or more computer systems.

IPC channel is a channel connecting two entities to each other, used to exchange IPC messages.

Call() is a system call that, in the context of IPC messaging, is used to send a message from one process to another process. This call allows a process to send a request or message to another process and wait until it receives a response message or a specified period of time has passed.

Recv() is a system call that, in the context of IPC messaging, is used to receive a message sent by another process. This call allows a process to enter sleep mode until a message is received from another process or a specified period of time has elapsed.

Reply() is a system call that, in the context of IPC messaging, is used to send a response message to a request received by another process. This call allows a process to send a response to a request and wakes up the process that is waiting for the response.

Virtual file system (from the English Virtual File System, VFS) is an abstraction layer on top of a specific implementation of the file system. A virtual file system can be used to access local devices and files, network devices and files on them, and information from the operating system kernel about system processes. A virtual file system declares a programming interface between the kernel and a specific file system, so adding support for a new file system does not require changes to the operating system kernel.

In FIG. 1 illustrates an example of client 110 interacting with server 160 via internetworking system 120 . In one embodiment, internetworking system 120 is a computer system-based TLS proxy server that acts as an intermediate point between client and server applications.

For the purposes of this invention, a computer system refers to at least one computing device, such as a personal computer, laptop, smartphone, tablet, router, storage system, and server. Elements of the internetworking system, as well as the client and server, may be implemented on a computer, an example of which is shown in FIG. 3 . It is worth noting that the elements of the internetworking system 120 , client 110 and server 160 , may be implemented on a single computer system or on multiple computer systems. For example, internetworking system 120 and client 110 are on one computer system, and server 160 is on another computer system. In another implementation, system 120 and server 160 are on one computer system, and client 110 is on another. In yet another embodiment, both client 110 and server 160 each use systems 120 on a different computer system.

In the preferred implementation as a client 110 is an application installed on the operating system (for example, Kaspersky OS). As a server 160acts as a remote server. In this case, the client 110 implemented on one computer system, internetworking system 120 - on a second computer system, and the server 160is the third computer system.

In one of the private implementation options, the role of client 110 is an application installed on the operating system (for example, Kaspersky OS). The role of server 160 is played by a remote server. In this case, the client 110 and the internetworking system 120 are implemented on one computer system, and the server 160 is implemented on a second computer system.

In another particular implementation, the role of client 110 is an application installed on an operating system (for example, Kaspersky OS). The role of server 160 is a virtual file system. In this case, the client 110 , the internetworking system 120 and the server 160 are implemented on one computer system.

The internetworking system 120 is designed to secure the certificate store as well as create an encrypted communication channel between the client 110 and the server 160 .

The internetworking system 120 initiates, on behalf of the client 110, a request for a TLS connection (hereinafter referred to as the connection) with the server 160 . Next, the internetworking system receives an SSL certificate (hereinafter referred to as the certificate) from the server 160 and verifies its authenticity. If the server 160 certificate is determined to be authentic, the internetworking system 120 creates an encrypted communication channel with the server 160 .

In a particular embodiment, if the client 110 and the internetworking system 120 are implemented on the same computer system, the internetworking system 120 , before initializing a request on behalf of the client 110 to connect to the server 160 , intercepts the client 110's request to connect to the server 160 , and the request may be as follows: both on an unsecured connection and on a TLS connection.

In another particular implementation, if the client 110 and the internetworking system 120 are implemented on different computer systems, the internetworking system 120 creates an encrypted communication channel not only with the server 160 , but also with the client 110 .

The internetworking system 120 consists of a security module 125 , an isolated transport module 130 , an isolated encryption module 140 , and an isolated certificate control module 150 .

The security module 125 is a component of the internetworking system 120 and is designed to isolate the transport interworking module 130 , the encryption module 140 , and the certificate control module 150 .

Security module 125 contains a set of rules (security policies) that allow you to regulate the interaction of modules of the internetworking system 120 both among themselves and with external sources. An example of an external source is a server. These rules contain the requirements and conditions necessary for the interaction of modules. For example, requirements contain a list of modules that can access one or another isolated module, and conditions, in turn, contain, for example, the time at which modules can access each other.

The isolation of each of the modules of the internetworking system 120 is implemented using security policies in accordance with the principle of safe defaults (English - Fail-safe defaults), or rather one of the variants of this principle - default deny (English - default deny). This principle consists in prohibiting any interaction between modules of the internetworking system 120 , both with each other and with external entities. Thus, only those interactions with modules of the internetworking system 120 that are explicitly permitted are permitted.

The modules of the internetworking system 120 communicate with each other through the security module 125 by exchanging IPC messages: an IPC request and an IPC response. Security module 125 intercepts each call from one module to another, analyzes the intercepted call, and forwards the intercepted call to the designated module if such call is allowed. In the interaction of modules, each module is assigned one of the roles: the module that initiates the interaction, and the module that processes the request. In this case, each module of system 120 can be both a module that initiates interaction and a module that processes the request. For example, in FIG. 1, isolated transport interworking module 130 is a module that initiates interaction with isolated encryption module 140 , which in turn is a module that initiates interaction with isolated certificate control module 150 .

The Internetworking System 120 modules use three system calls to exchange IPC messages: Call(), Recv(), and Reply(), and IPC messages are exchanged as follows:

• the module that initiates the interaction sends an IPC request to the module that processes the request. To do this, the module that initiates the interaction executes the Call() system call and goes into the mode of waiting for an IPC response. Security module 125 intercepts this IPC request and analyzes it for compliance with security policies. If the IPC request matches the security policies, the security module 125 sends the IPC request to the module processing the request. Otherwise, if the IPC request does not comply with the security policies, the security module 125 sends to the module initiating the interaction an IPC response denying access to the module processing the request;

• the module processing the request executes the Recv() system call and goes into IPC request waiting mode. When an IPC request is received, the module processing the request wakes up, processes the IPC request, and sends an IPC response by executing the Reply() system call;

• upon receiving an IPC response, the module that initiates the interaction exits the standby mode.

Isolated transport interaction module 130 intended for initializing a connection, obtaining a server certificate 160, receiving server public key 160, creating an encrypted communication channel between the client 110 and server 160, in case the server certificate 160 authentic, and data transfer between the client 110 and server 160.

Isolated transport interworking module 130 is a module that initiates interaction with client 110 , server 160 , and isolated encryption module 140 .

In a particular embodiment, an isolated transport module 130 intercepts a connection request from a client 110 to a server 160 . Then sends server 160 a connection request. In response, module 130 receives from server 160 a certificate and public key of server 160 , which it sends over an IPC channel to isolated encryption module 140 .

The isolated encryption module 140 is designed to create encryption keys, encrypt data sent by client 110 to server 160 using the public key of server 160 , decrypt data sent by server 160 to client 110 using the private key of client 110 , and also verify the authenticity of the server 160 certificate .

The isolated encryption module 140 on the one hand is a module that initiates interaction with the isolated certificate control module 150 , and on the other hand is a module that processes the request of the isolated transport interaction module 130 .

The isolated transport interaction module 130 sends an IPC request to verify the received data from the server 160 to the isolated encryption module 140 and goes into the IPC response mode. The IPC request contains at least a certificate and a public key of the server 160 .

Isolated encryption module 140accepts an IPC request to verify the server certificate 160 from an isolated transport interaction module 130. Then, through the isolated certificate control module 150 (described below) isolated encryption module 140checks the server certificate 160 for authenticity.

If the server 160 certificate is not genuine, the isolated cryptographic module 140 does not create the public and private encryption keys of the client 110 and sends an IPC response with the result of verifying the server 160 certificate to the isolated transport module 130 to cancel the creation of the connection with the server 160 .

If the server 160 certificate is genuine, the isolated encryption module 140 generates the client 110 's public and private encryption keys. The isolated encryption module 140 sends an IPC response with the result of verifying the server 160 certificate and the client's public key 110 to the isolated transport module 130 to create a connection with the server 160 .

In a particular implementation, if the client 110 has public and private encryption keys, the isolated encryption module 140 creates the public and private encryption keys of the internetworking system 120 to create an encrypted communication channel not only with the server 160 , but also with the client 110 .

The isolated transport interworking module 130 receives the IPC response from the isolated encryption module 140 . If the server 160 certificate is not genuine, the isolated transport module 130 does not create a connection to the server 160 . If the certificate of server 160 is genuine, isolated transport module 130 sends the public key of client 110 to server 160 and creates an encrypted communication channel with server 160 .

In a particular embodiment, isolated transport module 130 exchanges public keys with server 160 and client 110 and creates encrypted communication channels with server 160 and client 110 .

The isolated certificate control module 150 is designed to provide the isolated encryption module 140 with access to the certificate database.

In a preferred embodiment, the certificate database is implemented on a computer-readable storage medium, such as an SD card, with an isolated certificate control module 150 accessing the certificate database via a virtual file system 152 .

The isolated certificate control module 150 is the module that processes the request of the isolated encryption module 140 .

Fig. 2 illustrates a method for internetworking between a client, an internetworking system, and a server.

In a preliminary step 205, the connection request from the client 110 to the server 160 is intercepted by the internetworking system 120 , in particular by the transport interworking module 130 .

In a private embodiment, the role of client 110 is an application installed on the operating system (for example, Kaspersky OS, Linux OS). In this case, the client 110 and the internetworking system 120 are implemented within a single computer system.

In a private embodiment, the role of client 110 is an application installed on the operating system (for example, Kaspersky OS, Linux OS). The role of server 160 is a virtual file system. In this case, the client 110 , the internetworking system 120 and the server 160 are implemented within a single computer system.

At step 210 , the internetworking system 120 initiates a request to connect to the server 160 on behalf of the client 110 .

At step 220, the certificate and public key of the server 160 are received from the server 160 by the internetworking system 120 .

At step 230 , the certificate of the server 160 is verified for authenticity by the isolated encryption module 140 using a certificate database accessed by the isolated certificate control module 150 .

At step 240 , the public and private encryption keys of the client 110 are created through the isolated encryption module 140 and the public encryption keys are exchanged through the isolated transport module 130 with the server 160 to create an encrypted communication channel with the server 160 .

Encryption of data sent from client 110 to server 160 is accomplished using the public key of server 160 , and decryption of data sent from server 160 to client 110 is accomplished using client 110 's private key.

In a particular embodiment, in which the client 110 has public and private encryption keys to communicate with the internetworking system 120 , the public and private encryption keys of the internetworking system 120 are generated and the public encryption keys are exchanged via an isolated transport interworking module 130 with the server 160 and the client. 110 and create encrypted communication channels with the server 160 and the client 110 .

At step 250 , an encrypted communication channel is used to transmit data between client 110 and server 160 .

In FIG. 3 illustrates a computer system on which various embodiments of the systems and methods disclosed herein can be implemented. The computer system 20 may be a system configured to implement the present invention and may be in the form of a single computing device or multiple computing devices, such as a desktop computer, a laptop computer, a notebook computer, a mobile computing device, a smartphone, a tablet computer, a server, mainframe, embedded device and other forms of computing devices.

As shown in FIG. 3 , computer system 20 includes: a central processing unit 21 , system memory 22 , and a system bus 23 that communicates various system components, including memory, coupled to the central processing unit 21 . System bus 23 is implemented like any bus structure known in the art, which in turn includes a bus memory or bus memory controller, a peripheral bus, and a local bus capable of interfacing with any other bus architecture. Examples of buses include: PCI, ISA, PCI-Express, HyperTransport™, InfiniBand™, Serial ATA, I2C and other suitable connections between computer system components 20 . The central processing unit 21 contains one or more processors having one or more cores. The central processing unit 21 executes one or more sets of computer-readable instructions implementing the methods presented herein. System memory 22 may be any memory for storing data and/or computer programs executable by the central processing unit 21 . System memory can contain both read-only memory (ROM) 24 and random access memory (RAM) 25 . The basic input/output system (BIOS) 26 contains the basic procedures that ensure the transfer of information between elements of the computer system 20 , for example, when the operating system is loaded using ROM 24 .

Computer system 20 includes one or more data storage devices, such as one or more removable storage devices 27 , one or more non-removable storage devices 28 , or combinations of removable and non-removable devices. One or more removable storage devices 27 and/or non-removable storage devices 28 are connected to the system bus 23 via an interface 32 . In one embodiment, removable storage devices 27 and associated computer-readable storage media are nonvolatile modules for storing computer instructions, data structures, program modules, and other computer system 20 data. System memory 22 , removable storage devices 27 , and non-removable storage devices 28 may use various computer readable media. Examples of computer-readable storage media include computer memory such as cache memory, SRAM, DRAM, capacitorless RAM (Z-RAM), thyristor memory (T-RAM), eDRAM, EDO RAM, DDR RAM, EEPROM, NRAM , RRAM, SONOS, PRAM; flash memory or other memory technologies such as solid-state drives (SSDs) or flash drives; magnetic cassettes, magnetic tapes and magnetic disks such as hard disks or floppy disks; optical media such as compact discs (CD-ROMs) or digital versatile discs (DVDs); and any other media that can be used to store the desired data and that can be accessed by the computer system 20 .

System memory 22 , removable storage devices 27 , and non-removable storage devices 28 contained in the computer system 20 are used to store the operating system 35 , applications 37 , other program modules 38 , and program data 39 . Computer system 20 includes a peripheral interface 46 for transmitting data from input devices 40 such as a keyboard, mouse, stylus, game controller, voice input device, touch input device, or other peripheral devices such as a printer or scanner through one or more input/output ports, such as a serial port, parallel port, universal serial bus (USB), or other peripheral interface. A display device 47 , such as one or more monitors, projectors, or embedded displays, is also connected to the system bus 23 through an output interface 48 , such as a video adapter. In addition to the display devices 47 , the computer system 20 is equipped with other peripheral output devices (not shown in FIG. 3), such as speakers and other audiovisual devices.

The computer system 20 may operate in a networked environment using a network connection to one or more remote computers 49 . The remote computer(s) 49 is a working personal computer or server that contains most or all of the components noted previously in describing the nature of the computer system 20 shown in FIG. 3 . There may also be other devices in the network environment, such as routers, network stations or other network nodes. The computer system 20 may include one or more network interfaces 51 or network adapters for communicating with remote computers 49 over one or more networks, such as a local area network (LAN) 50 , a wide area network (WAN), an intranet, and the Internet. Examples of network interface 51 are an Ethernet interface, a Frame Relay interface, a SONET interface, and wireless interfaces.

Embodiments of the present invention may be a system, a method, or a computer-readable medium (or storage medium).

A computer-readable storage medium is a tangible device that stores and stores program code in the form of machine-readable instructions or data structures that are accessible by the central processing unit 21 of a computer system 20 . A computer-readable medium may be an electronic, magnetic, optical, electromagnetic, semiconductor storage device, or any suitable combination thereof. By way of example, such a computer-readable storage medium may include random access memory (RAM), read-only memory (ROM), EEPROM, portable compact disc read-only memory (CD-ROM), digital versatile disk (DVD) ), flash memory, hard drive, portable computer floppy disk, memory card, floppy disk, or even a mechanically encoded device such as punch cards or embossed structures with instructions written on them.

The system and method of the present invention can be thought of in terms of means. The term "device" as used herein refers to an actual device, component, or group of components implemented in hardware, such as an application-specific integrated circuit (ASIC) or FPGA, or a combination of hardware and software. providing, for example, using a microprocessor system and a set of machine-readable instructions to implement the functionality of a tool that (in the process of execution) turns the microprocessor system into a special-purpose device. The tool may also be implemented as a combination of these two components, with some functions being implemented by hardware alone and other functions being implemented by a combination of hardware and software. In some embodiments, at least a portion, and in some cases all, of the means may be executed on the central processing unit 21 of the computer system 20 . Accordingly, each means may be implemented in various suitable configurations and should not be limited to any particular embodiment set forth herein.

In conclusion, it should be noted that the information given in the description are examples that do not limit the scope of the present invention as defined by the formula. One skilled in the art will appreciate that in developing any actual embodiment of the present invention, many decisions specific to the particular implementation must be made to achieve specific objectives, and these specific objectives will differ from one embodiment to another. It is understood that such development efforts can be complex and time-consuming, but would nevertheless be a routine engineering task for those of ordinary skill in the art using the present disclosure.

Claims (27)

1. An internetworking system consisting of at least one computer system and containing: a) a security module designed to isolate the transport interaction module, the encryption module and the certificate control module, while the isolation is carried out on the basis of security policies that contain the requirements and conditions for interaction with each mentioned module; b) an isolated transport interaction module that interacts with the client, server and isolated encryption module and is intended for: • intercepting a connection request from a client to a server; • initializing a TLS connection with the server; • obtaining a certificate and public key from the server; • transferring the received data to an isolated encryption module; • creating an encrypted communication channel between the client and the server, if the server certificate is genuine; • data transfer between client and server using an encrypted communication channel; c) an isolated encryption module designed to verify the authenticity of a server certificate through interaction with an isolated certificate control module and, in the case of the authenticity of the certificate, for: • creating public and private client keys; • encryption using the server's public key of data sent by the client to the server; • decryption using the client's private key of data sent by the server to the client; • transferring the client's public key and the result of checking the server certificate to an isolated transport interaction module; d) an isolated certificate control module, designed to provide an isolated encryption module with access to the certificate database. 2. The system according to claim 1, in which the security module checks the implementation of security policies every time each module is accessed. 3. The system according to claim 1, in which these modules interact with each other through a security module by exchanging IPC messages. 4. The system according to claim 1, in which the security module intercepts each request from one isolated module to another isolated module, analyzes the intercepted request and transfers the intercepted request to the assigned isolated module if the specified request meets the requirements and conditions of the security policy. 5. A method of internetworking, implemented on at least one computer system and containing the steps of: a) intercept, using an isolated transport interaction module, a connection request from a client to a server; b) initialize, using an isolated transport interaction module on behalf of the client, a request for a TLS connection with the server; c) receive, using an isolated transport interaction module, a certificate and a public key from the server, which are transferred to the isolated encryption module; d) using an isolated encryption module, check the received server certificate for authenticity by interacting with the certificate database through an isolated certificate control module; e) if the server certificate is determined to be authentic, create the client's public and private encryption keys through an isolated encryption module and exchange public encryption keys through an isolated transport interaction module with the server to create an encrypted communication channel, wherein the encryption of data sent from the client to the server is implemented with using the server's public key, and decryption of data sent from the server to the client is implemented using the client's private key. 6. The method according to claim 5, in which the isolation of the transport interaction module, the encryption module and the certificate control module is carried out using a security module based on security policies that contain the requirements and conditions for interaction with each mentioned module. 7. The method of claim 5, wherein during each interaction between the isolated transport interworking module, the isolated encryption module and the isolated certificate control module, compliance with security policies is checked using the security module. 8. The method according to claim 5, in which each request from one isolated module to another isolated module is intercepted, the intercepted request is analyzed and the intercepted request is transferred to the assigned isolated module if the specified request complied with the requirements and conditions of the security policy.