Method and system for including security information with a packet

• US 20060112425A1
• Filed: 11/23/2004
• Published: 05/25/2006
• Est. Priority Date: 11/23/2004
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Fine, Michael, Nallur, Padmanabha, Smith, Michael R., Kok, Wilson
• Granted Patent: US 7,886,145 B2
• Time in Patent Office: Days
• US Class Current: 726/13
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method and system for including security information with a packet is disclosed. A packet is detected as it exits a first network and enters a second network. The first network is configured to support a network security technique, and the second network is not configured to support the network security technique. Network security information associated with the network security technique is included with the packet. A network device is configured to include network security information in overhead of a packet. A method for identifying a first network device in a network is also disclosed. Identification information of the first network is communicated to a second network device.

Claims

1. A method comprising:

detecting a packet exiting a first network and entering a second network, wherein

the first network is configured to support a network security technique, and

the second network is not configured to support the network security technique; and

including network security information with the packet, wherein

the network security information is associated with the network security technique.

2. The method of claim 1, wherein

the including network security information with the packet further comprises:

moving the network security information from a first location in packet overhead to a second location in the packet overhead, wherein

the second location in the packet overhead does not affect forwarding of the packet from the second network to a third network.

3. The method of claim 2, wherein

the first, second and third networks are layer-2 networks,

the first network and the second network are coupled with a first layer-3 router, and

the second network and the third network are coupled with a second layer-3 router.

4. The method of claim 3, wherein

the second location in the packet overhead does not affect the second layer-3 router'"'"'s ability to process the packet;

and

the second layer-3 router is not configured to process the network security information.

5. The method of claim 4, wherein

a layer-2 header of the packet comprises the first location in the packet overhead, and

a layer-3 header of the packet comprises the second location in the packet overhead.

6. The method of claim 1, wherein

the network security information comprises a security group tag.

7. The method of claim 1, further comprising:

determining whether the packet will be processed by a network node capable of processing the network security information before reaching a destination of the packet, wherein

the network node is within a third network.

8. The method of claim 7, wherein

the determining further comprises:

determining whether a perimeter device of the third network is capable of processing the network security information.

9. The method of claim 8, further comprising

determining whether identification information of the third network matches routing information of the packet.

10. The method of claim 9, further comprising:

detecting the packet exiting the second network and entering a third network wherein the third network employs the network security technique; and

processing the network security information.

11. The method of claim 10, wherein

the processing the network security information comprises at least one of:

processing the packet using role based access control,

moving the network security information to a layer-2 header of the packet, and

removing the network security information from the packet.

12. The method of claim 9, further comprising:

obtaining the identification information, wherein

the obtaining the identification information comprises a least one of;

configuring an egress node of the first network to recognize the identification information,

using a network protocol to distribute the identification information, and

storing the identification information at a management station.

13. The method of claim 12, wherein

the storing the identification information at the management station further comprises:

including the identification information in an identification information list.

14. The method of claim 9, wherein

the identification information is a destination prefix, and

the routing information of the packet is a portion of a destination address of the packet.

15. An apparatus comprising:

means for detecting a packet exiting a first network and entering a second network, wherein

the first network is configured to support a network security technique, and

the second network is not configured to support the network security technique; and

means for including network security information with the packet, wherein

the network security information is associated with the network security technique.

16. The apparatus of claim 15, wherein

the means for including network security information with the packet further comprises:

means for moving the network security information from a first location in packet overhead to a second location in the packet overhead, wherein

the second location in the packet overhead does not affect forwarding of the packet from the second network to a third network.

17. The apparatus of claim 16, wherein

the first, second and third networks are layer-2 networks,

the first network and the second network are coupled with a first layer-3 router, and

the second network and the third network are coupled with a second layer-3 router.

18. The apparatus of claim 17, wherein

the second location in the packet overhead does not affect the second layer-3 router'"'"'s ability to process the packet;

and

the second layer-3 router is not configured to process the network security information.

19. The apparatus of claim 18, wherein

a layer-2 header of the packet comprises the first location in the packet overhead, and

a layer-3 header of the packet comprises the second location in the packet overhead.

20. The apparatus of claim 15, wherein

the network security information comprises a security group tag.

21. The apparatus of claim 15, further comprising:

means for determining whether the packet will be processed by a network node capable of processing the network security information before reaching a destination of the packet, wherein

the network node is within a third network.

22. The apparatus of claim 21, wherein

the means for determining further comprises:

means for determining whether a perimeter device of the third network is capable of processing the network security information.

23. The apparatus of claim 22, further comprising

means for determining whether identification information of the third network matches routing information of the packet.

24. The apparatus of claim 23, further comprising:

means for detecting the packet exiting the second network and entering a third network wherein the third network employs the network security technique; and

means for processing the network security information.

25. The apparatus of claim 24, wherein

the means for processing the network security information comprises at least one of:

means for processing the packet using role based access control,

means for moving the network security information to a layer-2 header of the packet, and

means for removing the network security information from the packet.

26. The apparatus of claim 23, further comprising:

means for obtaining the identification information, wherein

the means for obtaining the identification information comprises a least one of;

means for configuring an egress node of the first network to recognize the identification information,

means for using a network protocol to distribute the identification information, and

means for storing the identification information at a management station.

27. The apparatus of claim 26, wherein

the means for storing the identification information at the management station further comprises:

means for including the identification information in an identification information list.

28. The apparatus of claim 23, wherein

the identification information is a destination prefix, and

the routing information of the packet is a portion of a destination address of the packet.

29. A computer program product comprising:

a first set of instructions, executable on a computer system, configured to detect a packet exiting a first network and entering a second network, wherein

the first network is configured to support a network security technique, and

the second network is not configured to support the network security technique;

a second set of instructions, executable on the computer system, configured to include network security information with the packet, wherein

the network security information is associated with the network security technique; and

computer readable media, wherein the computer program product is encoded in the computer readable media.

30. The computer program product of claim 29, wherein the second set of instructions comprises:

a first subset of instructions, executable on the computer system, configured to move the network security information from a first location in packet overhead to a second location in the packet overhead, wherein

the second location in the packet overhead does not affect forwarding of the packet from the second network to a third network.

31. The computer program product of claim 30, wherein

the first, second and third networks are layer-2 networks,

the first network and the second network are coupled with a first layer-3 router, and

the second network and the third network are coupled with a second layer-3 router.

32. The computer program product of claim 31, wherein

the second location in the packet overhead does not affect the second layer-3 router'"'"'s ability to process the packet;

and

the second layer-3 router is not configured to process the network security information.

33. The computer program product of claim 32, wherein

a layer-2 header of the packet comprises the first location in the packet overhead, and

a layer-3 header of the packet comprises the second location in the packet overhead.

34. The computer program product of claim 29, wherein the network security information comprises a security group tag.

35. The computer program product of claim 29, further comprising:

a third set of instructions, executable on the computer system, configured to determine whether the packet will be processed by a network node capable of processing the network security information before reaching a destination of the packet, wherein

the network node is within a third network.

36. The computer program product of claim 35, wherein the third set of instructions further comprises:

a first subset of instructions, executable on the computer system, configured to determine whether a perimeter device of the third network is capable of processing the network security information.

37. The computer program product of claim 36, further comprising:

a fourth set of instructions, executable on the computer system, configured to determine whether identification information of the third network matches routing information of the packet.

38. The computer program product of claim 37, further comprising:

a fifth set of instructions, executable on the computer system, configured to detect the packet exiting the second network and entering a third network wherein

the third network employs the network security technique; and

a sixth set of instructions, executable on the computer system, configured to process the network security information.

39. The computer program product of claim 38, wherein

the sixth set of instructions comprises at least one of:

a second subset of instructions, executable on the computer system, configured to process the packet using role based access control,

a third subset of instructions, executable on the computer system, configured to move the network security information to a layer-2 header of the packet, and

a fourth subset of instructions, executable on the computer system, configured to remove the network security information from the packet.

40. The computer program product of claim 37, further comprising:

a seventh set of instructions, executable on the computer system, configured to obtain the identification information, wherein

the seventh set of instructions comprises a least one of;

a second subset of instructions, executable on the computer system, configured to configure an egress node of the first network to recognize the identification information,

a third subset of instructions, executable on the computer system, configured to use a network protocol to distribute the identification information, and

a fourth subset of instructions, executable on the computer system, configured to store the identification information at a management station.

41. The computer program product of claim 40, wherein

the fourth subset of instructions further comprises:

a fifth subset of instructions, executable on the computer system, configured to include the identification information in an identification information list.

42. The computer program product of claim 37, wherein

the identification information is a destination prefix, and

the routing information of the packet is a portion of a destination address of the packet.

43. An apparatus comprising:

a first network device configured to include network security information in overhead of a packet in the event of the packet being conveyed from the first network device to a second network device, wherein

the first network device supports a first network protocol layer, and

the second network device is incapable of processing the network security information.

44. The apparatus of claim 43, wherein

the second network device is configured to support at least one of:

the first network protocol layer, and

a second network protocol layer.

45. The apparatus of claim 44, wherein

the first network device is configured to process the packet using role based access control.

46. The apparatus of claim 44, wherein

the first network device is configured to move the network security information to a new location in the overhead of the packet, wherein the new location in the overhead of the packet does not affect forwarding of the packet by the second network device.

47. The apparatus of claim 46, wherein

the first network device is configured to move the network security information to a location in the overhead of the packet that is accessible to a third network device, wherein

the third network device is capable of processing the network security information.

48. The apparatus of claim 46, wherein

the first network protocol layer is a layer-3 network protocol, and

the second network protocol layer is a layer-2 network protocol.

49. The apparatus of claim 48, wherein

the second network device is a layer-2 switch.

50. The apparatus of claim 49, wherein

the network security information comprises a security group tag.

51. A method comprising:

identifying a first network device in a network, and

communicating identification information to a second network device in the network, wherein

the identification information is associated with the first network device,

the first and second network devices are each capable of processing network security information, and

a third network device within the network is incapable of processing the network security information.

52. The method of claim 51, further comprising:

including the identification information in an identification information list; and

storing the identification information list at a network management station.

53. The method of claim 52, wherein

the network security information comprises a security group tag.

54. The method of claim 52, wherein

the identification information is a destination prefix.

55. The method of claim 52, further comprising:

including the network security information in a location in a packet that is accessible by the second network device.

56. The method of claim 55, wherein

the including the network security information is performed by the first network device.