Remote IPSec security association management

• US 20050066159A1
• Filed: 11/25/2003
• Published: 03/24/2005
• Est. Priority Date: 09/22/2003
• Status: Abandoned Application

• Current Assignee: Nokia Corporation
• Original Assignee: Nokia Corporation
• Inventors: Poussa, Sakari, Latvala, Mikael
• Application Number:
  US10/720,054
• Publication Number:
  US 20050066159A1
• Time in Patent Office: Days
• US Class Current: 713/151
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/164 at the network layer

Abstract

The present invention concerns a method and a system for remotely and transparently managing security associations of Internet Protocol Security. The system comprises one or more application devices, each of which comprises at least one management client for issuing security association management requests. The system further comprises a service device comprising an Internet Protocol Security service means for providing one or more Internet Protocol Security services, and a management server for receiving the issued requests and for responding, in connection with the Internet Protocol Security service means, to the received requests. The system further comprises a communication network for securely connecting the application devices to the service device.

Claims

1. A system for remotely and transparently managing security associations of Internet Protocol Security, the system comprising:

an application device, said application device comprising at least one management client for issuing security association management requests;

a service device comprising an Internet Protocol Security service means for providing one or more Internet Protocol Security services, and a management server for receiving said security association management requests issued from said at least one management client and for responding, in connection with said Internet Protocol Security service means, to said security association management requests received at said management server; and

a communication network for connecting said application device to said service device.

2. The system according to claim 1, wherein said application device further comprises an interface means for providing an interface for communicating between said at least one management client associated with said application device and said management server.

3. The system according to claim 1, wherein said security association management requests include at least one of adding requests for adding security associations, deleting requests for deleting security associations, and querying requests for querying about security associations.

4. The system according to claim 2, wherein said interface means are arranged to use sockets for communication with said management server.

5. The system according to claim 2, wherein said interface means includes data structures used in communication between said management client and said management server.

6. The system according to claim 2, wherein said interface means are implemented as a software library linked dynamically or statistically into a corresponding management client.

7. The system according to claim 1, wherein said Internet Protocol Security service means and said management server are arranged to use a local communication channel for communications between said Internet Protocol Security service means and said management server.

8. The system according to claim 1, wherein at least one application device comprises two or more management clients, at least two of said management clients use different session key management protocols.

9. The system according to claim 1, wherein said communication network comprises a Local Area Network.

10. A method for remotely and transparently managing security associations of Internet Protocol Security, the method comprising the steps of:

providing one or more Internet Protocol Security services in a service device;

issuing security association management requests from an application device, said application device being connected to said service device by a communication network;

receiving in said service device said security association management requests issued from said application device; and

responding, in connection with an Internet Protocol Security service, to said security association management requests received in said service device.

11. The method according to claim 10, wherein at least one of said security association management requests issued from an application device and corresponding responses are communicated via an interface associated with said application device.

12. The method according to claim 10, wherein said security association management requests include at least one of adding requests for adding security associations, deleting requests for deleting security associations, and querying requests for querying about security associations.