Approaches for switching transport protocol connection keys

• US 20070160063A1
• Filed: 01/10/2006
• Published: 07/12/2007
• Est. Priority Date: 01/10/2006
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Ramaiah, Anantha, Appanna, Chandrashekhar, Mynam, Satish
• Granted Patent: US 7,706,381 B2
• Time in Patent Office: Days
• US Class Current: 370/395.520
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/163 In-band adaptation of TCP data exchange; In-band control procedures

Abstract

Approaches are disclosed for switching transport protocol connection keys. A first node sends a keychange request message to a second node, causing the second node to accept subsequent messages digitally signed with a first or second key. The second node sends an acknowledgment message to the first node, causing the first node to accept subsequent messages digitally signed with the first or second key. The first node receives a new message digitally signed with the second key from the second node and determines that there are no remaining messages to be received digitally signed with the first key. In response thereto, the first node only accepts messages digitally signed with the second key and sends a message signed with the second key to the second node, causing the second node to only accept messages digitally signed with the second key.

Claims

1. A method of switching transport protocol connection keys, the method comprising the computer-implemented steps of:

sending a keychange request message from a first network node to a second node, wherein said keychange request message causes the second node to accept subsequent messages that are digitally signed with either a first key or a second key;

receiving a first response message from the second node acknowledging the receipt of the keychange request message;

based on the first response message, accepting subsequent messages digitally signed with either the first key or the second key;

receiving a first subsequent message digitally signed with the second key from the second node;

determining that there are no remaining messages to be received digitally signed with the first key, and in response thereto, only accepting messages digitally signed with the second key from the second node and sending a second subsequent message digitally signed with the second key to the second node, wherein said second subsequent message causes the second node to accept only messages digitally signed with the second key.

2. The method of claim 1, wherein the keychange request message comprises an Extended Message-Digest5 (MD5) Option in a header of a Transmission Control Protocol (TCP) segment.

3. The method of claim 2, wherein the Extended MD5 Option comprises a last two bytes of a regular MD5 Option in a header of the TCP segment.

4. The method of claim 1, wherein:

the keychange request message includes an Extended MD5 Option with a first setting, wherein the first setting represents an initialization of the keychange request; and

the first response message includes an Extended MD5 Option with a second setting, wherein the second setting represents acknowledgment of the keychange request.

5. The method of claim 1 wherein the first key is an MD5 encryption key and the second key is an MD5 encryption key.

6. The method of claim 1, further comprising the step of determining that the second network node is configured to facilitate a key switchover using an Extended MD5 Option in a header of a TCP segment.

7. The method of claim 1 wherein the first subsequent message is in a new in-sequence TCP segment and the second subsequent message is in a TCP ACK segment.

8. The method of claim 1 wherein said first key and said second key are selected from a list of keys supplied to said first node and said second nodes.

9. An apparatus for switching transport protocol connection keys, comprising:

one or more processors;

one or more stored sequences of instructions which, when executed by the one or more processors, cause the one or more processors to perform the steps of;

sending a keychange request message from a first network node to a second node, wherein said keychange request message causes the second node to accept subsequent messages that are digitally signed with either a first key or a second key;

receiving a first response message from the second node acknowledging the receipt of the keychange request message;

based on the first response message, accepting subsequent messages digitally signed with either the first key or the second key;

receiving a first subsequent message digitally signed with the second key from the second node;

determining that there are no remaining messages to be received digitally signed with the first key, and in response thereto, only accepting messages digitally signed with the second key from the second node and sending a second subsequent message digitally signed with the second key to the second node, wherein said second subsequent message causes the second node to accept only messages digitally signed with the second key.

10. The apparatus of claim 9, wherein the keychange request message comprises an Extended Message-Digest5 (MD5) Option in a header of a Transmission Control Protocol (TCP) segment.

11. The apparatus of claim 10, wherein the Extended MD5 Option comprises a last two bytes of a regular MD5 Option in a header of the TCP segment.

12. The apparatus of claim 9, wherein:

the keychange request message includes an Extended MD5 Option with a first setting, wherein the first setting represents an initialization of the keychange request; and

the first response message includes an Extended MD5 Option with a second setting, wherein the second setting represents acknowledgment of the keychange request.

13. The apparatus of claim 9 wherein the first key is an MD5 encryption key and the second key is an MD5 encryption key.

14. The apparatus of claim 9, wherein the one or more stored sequences of instructions further cause the one or more processors to perform the step of determining that the second network node is configured to facilitate a key switchover using an Extended MD5 Option in a header of a TCP segment.

15. The apparatus of claim 9 wherein the first subsequent message is in a new in-sequence TCP segment and the second subsequent message is in a TCP ACK segment.

16. The apparatus of claim 9 wherein said first key and said second key are selected from a list of keys supplied to said first node and said second nodes.

17. An apparatus for switching transport protocol connection keys, comprising:

means for sending a keychange request message from a first network node to a second node, wherein said keychange request message causes the second node to accept subsequent messages that are digitally signed with either a first key or a second key;

means for receiving a first response message from the second node acknowledging the receipt of the keychange request message;

based on the first response message, means for accepting subsequent messages digitally signed with either the first key or the second key;

means for receiving a first subsequent message digitally signed with the second key from the second node;

means for determining that there are no remaining messages to be received digitally signed with the first key, and in response thereto, only accepting messages digitally signed with the second key from the second node and sending a second subsequent message digitally signed with the second key to the second node, wherein said second subsequent message causes the second node to accept only messages digitally signed with the second key.

18. The apparatus of claim 17, wherein the keychange request message comprises an Extended Message-Digest5 (MD5) Option in a header of a Transmission Control Protocol (TCP) segment.

19. The apparatus of claim 18, wherein the Extended MD5 Option comprises a last two bytes of a regular MD5 Option in a header of the TCP segment.

20. The apparatus of claim 17, wherein:

the keychange request message includes an Extended MD5 Option with a first setting, wherein the first setting represents an initialization of the keychange request; and

the first response message includes an Extended MD5 Option with a second setting, wherein the second setting represents acknowledgment of the keychange request.

21. The apparatus of claim 17 wherein the first key is an MD5 encryption key and the second key is an MD5 encryption key.

22. The apparatus of claim 17, further comprising the step of determining that the second network node is configured to facilitate a key switchover using an Extended MD5 Option in a header of a TCP segment.

23. The apparatus of claim 17 wherein the first subsequent message is in a new in-sequence TCP segment and the second subsequent message is in a TCP ACK segment.

24. The apparatus of claim 17 wherein said first key and said second key are selected from a list of keys supplied to said first node and said second nodes.

25. A computer-readable medium carrying one or more sequences of instructions for switching transport protocol connection keys, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of:

sending a keychange request message from a first network node to a second node, wherein said keychange request message causes the second node to accept subsequent messages that are digitally signed with either a first key or a second key;

receiving a first response message from the second node acknowledging the receipt of the keychange request message;

based on the first response message, accepting subsequent messages digitally signed with either the first key or the second key;

receiving a first subsequent message digitally signed with the second key from the second node;

determining that there are no remaining messages to be received digitally signed with the first key, and in response thereto, only accepting messages digitally signed with the second key from the second node and sending a second subsequent message digitally signed with the second key to the second node, wherein said second subsequent message causes the second node to accept only messages digitally signed with the second key.

26. A computer-readable medium as in claim 25, wherein the keychange request message comprises an Extended Message-Digest5 (MD5) Option in a header of a Transmission Control Protocol (TCP) segment.

27. A computer-readable medium as in claim 26, wherein the Extended MD5 Option comprises a last two bytes of a regular MD5 Option in a header of the TCP segment.

28. A computer-readable medium as in claim 25, wherein:

the keychange request message includes an Extended MD5 Option with a first setting, wherein the first setting represents an initialization of the keychange request; and

the first response message includes an Extended MD5 Option with a second setting, wherein the second setting represents acknowledgment of the keychange request.

29. A computer-readable medium as in claim 25 wherein the first key is an MD5 encryption key and the second key is an MD5 encryption key.

30. A computer-readable medium as in claim 25, further comprising instructions, which, when executed by one or more processors, cause the one or more processors to carry out the step of determining that the second network node is configured to facilitate a key switchover using an Extended MD5 Option in a header of a TCP segment.

31. A computer-readable medium as in claim 25 wherein the first subsequent message is in a new in-sequence TCP segment and the second subsequent message is in a TCP ACK segment.

32. A computer-readable medium as in claim 25 wherein said first key and said second key are selected from a list of keys supplied to said first node and said second nodes.