Transporting keys between security protocols

• US 20080104693A1
• Filed: 09/29/2006
• Published: 05/01/2008
• Est. Priority Date: 09/29/2006
• Status: Active Grant

• Current Assignee: Certes Networks, Inc.
• Original Assignee: Certes Networks, Inc.
• Inventors: McAlister, Donald
• Granted Patent: US 8,046,820 B2
• Time in Patent Office: Days
• US Class Current: 726/15
• CPC Class Codes: H04L 61/2564 for a higher-layer protocol, e.g. for session initiation protocol [SIP]
• CPC Class Codes: H04L 61/2578 without involvement of the NAT server
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method for providing network security comprising a step of configuring a remote network to engage network security negotiation with a local network. The method includes a step of configuring a first security policy of a security component within the local network to pass through a network security negotiating communication between the local network and the remote network, and a step of establishing a network security negotiation between the remote network and a security parameter generator via the security component. The security parameter generator can be located within the local network and configured to provide secure communication with the remote network.

Claims

1. A method for providing network security comprising:

configuring a remote network to engage network security negotiation with a local network;

configuring a first security policy of a security component within the local network to pass through a network security negotiating communication between the local network and the remote network; and

establishing a network security negotiation between the remote network and a security parameter generator via the security component, the security parameter generator located within the local network and configured to provide secure communication with the remote network.

2. The method of claim 1, wherein the remote network includes a device using standard security negotiation protocols.

3. The method of claim 1, wherein the security component is a policy enforcement point (PEP).

4. The method of claim 1, wherein the security parameter generator is a key authorization point (KAP).

5. The method of claim 1, wherein the step of establishing a security negotiation between the remote network and a security parameter generator via the security component includes establishing a secure association between the remote network and the local network.

6. The method of claim 1, wherein the step of establishing a security negotiation between the remote network and a security parameter generator via the security component includes performing an Internet Key Exchange (IKE) negotiation between the security parameter generator and the remote network.

7. The method of claim 6, wherein the network security negotiating communication is a UDP message with the source and destination user datagram protocol (UDP) ports set to 500.

8. The method of claim 5, wherein the step of establishing a network security negotiation between the remote network and the local network includes one or more authentication mechanisms.

9. The method of claim 8, wherein the authentication mechanisms include one or more of the following mechanisms:

pre-shared keys, certification, nonce, Kerberos token, hash/notification, and signature.

10. The method of claim 8 further including the step of creating a second security policy by the security parameter generator and implementing at the security component.

11. The method of claim 10, wherein the second security policy comprises any one of:

establishing local remote IP addresses or ranges for an encrypted traffic from the remote network, remote tunnel IP address, selector settings, security policy setting, encryption, authentication keys, security parameter index and tunnel termination.

12. The method of claim 10 further includes the following steps:

i) establishing a secure tunnel for exchanging an encrypted packet between the local network and the remote network;

ii) decrypting the encrypted packet according to the second security policy; and

iii) optionally conducting an additional security negotiation between the remote network and the security parameter generator via the security component.

13. The method of claim 12, wherein the step of decrypting the encrypted packet according to the second security policy includes stripping an IP (internet protocol) header of the encrypted packet to route the encrypted packet to a device within the local network.

14. The method of claim 10 further including distributing the second security policy to other security components within the local network.

15. A apparatus for providing network security comprising:

a remote network configured to engage network security negotiation with a local network;

a security component within the local network with a security policy that can pass through a network security negotiating communication from the remote network, the security component located within the local network, and

a security parameter generator configured to provide a secure communication with the remote network via the security component.

16. The network security apparatus of claim 15, wherein the remote network includes a device using standard security negotiation protocols.

17. The network security apparatus of claim 15, wherein the security component is a policy enforcement point (PEP).

18. The network security apparatus of claim 15, wherein the security parameter generator is a key authorization point (KAP).

19. The network security apparatus of claim 15, wherein the security parameter generator and the remote network are configured to perform an Internet Key Exchange (IKE) negotiation.

20. The network security apparatus of claim 19, wherein the network security negotiating communication is a UDP message with the source and destination UDP ports set to 500.

21. The network security apparatus of claim 15 further includes a secure association between the remote network and the local network.

22. The network security apparatus of claim 21, wherein the network security negotiation between the remote network and the local network includes one or more authentication mechanisms.

23. The network security apparatus of claim 22, wherein the authentication mechanisms include one or more of the following mechanisms:

pre-shared keys exchange, certification, nonce, Kerberos token, hash/notification, and signature.

24. The network security apparatus of claim 22, wherein the security parameter generator is configured to that the security parameter generator can create a second security policy for the security component after conducting the one or more authentication mechanisms.

25. The network security apparatus of claim 24, wherein the second security policy defines of the following security parameters:

local remote IP addresses or ranges for an encrypted traffic from the remote network, remote tunnel IP address, selector settings, security policy setting, encryption, authentication keys, security parameter index and tunnel termination.

26. The network security apparatus of claim 24, wherein the security component is configured to:

i) establish a secure tunnel for exchanging an encrypted packet between the local network and the remote network;

ii) decrypt the encrypted packet according to the second security policy; and

iii) optionally conduct an additional security negotiation between the remote network and the local network.