VPN enrollment protocol gateway

• US 20040177281A1
• Filed: 03/15/2004
• Published: 09/09/2004
• Est. Priority Date: 04/12/2000
• Status: Abandoned Application

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Balaz, Rudolph, Su, Xiaohong, Vogel, Keith R., Heller, Victor W.
• Application Number:
  US10/801,332
• Publication Number:
  US 20040177281A1
• Time in Patent Office: Days
• US Class Current: 713/202
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/3265 using certificate chains, trees or paths; Hierarchical trust model
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

A virtual private network (VPN) enrollment protocol gateway is described herein. The protocol gateway is implemented as a registration authority that operates as an intermediary between routers and a certificate authority, allowing routers operating in accordance with one protocol to obtain and maintain certificates for a VPN from a certificate authority operating in accordance with another protocol. In accordance with one aspect, the gateway protocol supports various requests from the router, including router enrollment requests, get certificate revocation list request, get certificate requests, get certificate authority certificate requests, and password requests.

Claims

1. A method comprising:

receiving a request, from a requester, for a password to be used by a device when communicating with a registration authority;

authenticating the requestor;

generating the password;

adding the password to a password table; and

returning the password to the requestor for use by the device.

2. A method as recited in claim 1, wherein the device comprises a router.

3. A method as recited in claim 1, wherein generating the password comprises generating a random number as the password.

4. A method as recited in claim 1, wherein receiving, authenticating, and returning include using Secure Sockets Layer (SSL) to maintain secure communication with the device.

5. A method as recited in claim 1, further comprising keeping the password active for a selected amount of time.

6. A method as recited in claim 5, wherein keeping the password active for a selected amount of time comprises marking the password as invalid after the selected amount of time.

7. A method as recited in claim 5, wherein keeping the password active for a selected amount of time comprises removing the password from the password table after the selected amount of time.

8. A method as recited in claim 1, further comprising:

receiving a request from the device, the request including a request password;

checking whether the request password is included in the password table; and

processing the request if the request password is included in the password table, otherwise rejecting the request.

9. A method as recited in claim 8, further comprising removing, if the request password is included in the password table, the request password from the password table.

10. One or more computer-readable media having stored thereon a plurality of instructions that, when executed by one or more processors, causes the one or more processors to perform acts comprising:

receiving a request, from a requester, for a password to be used by a device when communicating with a registration authority;

authenticating the requestor;

generating the password;

adding the password to a password table; and

returning the password to the requestor for use by the device.

11. One or more computer-readable media as recited in claim 10, wherein the device comprises a router.

12. One or more computer-readable media as recited in claim 10, wherein generating the password comprises generating a random number as the password.

13. One or more computer-readable media as recited in claim 10, wherein receiving, authenticating, and returning include using Secure Sockets Layer (SSL) to maintain secure communication with the device.

14. One or more computer-readable media as recited in claim 10, wherein the plurality of instructions further cause the one or more processors to perform acts comprising keeping the password active for a selected amount of time.

15. One or more computer-readable media as recited in claim 14, wherein keeping the password active for a selected amount of time comprises marking the password as invalid after the selected amount of time.

16. One or more computer-readable media as recited in claim 14, wherein keeping the password active for a selected amount of time comprises removing the password from the password table after the selected amount of time.

17. One or more computer-readable media as recited in claim 10, wherein the plurality of instructions further cause the one or more processors to perform acts comprising:

receiving a request from the device, the request including a request password;

checking whether the request password is included in the password table; and

processing the request if the request password is included in the password table, otherwise rejecting the request.

18. One or more computer-readable media as recited in claim 17, wherein the plurality of instructions further cause the one or more processors to perform acts comprising removing, if the request password is included in the password table, the request password from the password table.

19. A system comprising:

means for receiving a request, from a requester, for a password to be used by a device when communicating with a registration authority;

means for authenticating the requestor;

means for generating the password;

means for adding the password to a password table; and

means for returning the password to the requestor for use by the device.

20. A system as recited in claim 19, wherein the device comprises a router.