TECHNIQUE FOR CHANGING GROUP MEMBER REACHABILITY INFORMATION

• US 20080298592A1
• Filed: 05/29/2007
• Published: 12/04/2008
• Est. Priority Date: 05/29/2007
• Status: Abandoned Application

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Khalid, Mohamed, Asati, Rajiv, Weis, Brian E., Akhter, Aamer S.
• Application Number:
  US11/754,780
• Publication Number:
  US 20080298592A1
• Time in Patent Office: Days
• US Class Current: 380/278
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 9/0833 involving conference or group key network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying

Abstract

In one embodiment, a technique for updating an address associated with a first entity in a communications network with a second entity in the communications network wherein the address is used to forward information to the first entity from the second entity. The first entity registers a first address associated with the first entity with the second entity. The first entity determines that a second address associated with the first entity is to be used instead of the first address to communicate with the first entity. The first entity generates an update message containing the second address, the update message obviating having to register the second address with the second entity. The first entity forwards the update message to the second entity to cause the second entity to use the second address instead of the first address to forward information to the first entity.

Claims

1. A method comprising:

registering a first address, associated with a first entity in a communications network, with a second entity in the communications network to cause the second entity to forward keying information to the first entity using the first address;

acquiring a second address;

generating an update message containing the second address; and

forwarding the update message to the second entity to cause the second entity to use the second address instead of the first address to forward keying information to the first entity.

2. A method as defined in claim 1 further comprising:

associating the first address with a security association (SA).

3. A method as defined in claim 2 wherein the SA is an authentication SA.

4. A method as defined in claim 2 further comprising:

associating the second address with the SA.

5. A method as defined in claim 2 further comprising:

acquiring keying information forwarded by the second entity; and

associating the keying information with the SA.

6. A method as defined in claim 1 wherein the first entity is a group member of a Virtual Private Network (VPN) group.

7. A method as defined in claim 1 wherein the second entity is a key server.

8. A method as defined in claim 1 wherein the update message is encrypted.

9. A method as defined in claim 1 wherein the update message contains a secret key.

10. A method comprising:

using a first address, associated with a first entity in a communications network, to forward keying information to the first entity;

acquiring an update message containing a second address associated with the first entity; and

using the second address instead of the first address to forward keying information to the first entity.

11. A method as defined in claim 10 further comprising:

establishing a security association (SA) with the first entity.

12. A method as defined in claim 11 wherein the SA is an authentication SA.

13. A method as defined in claim 10 wherein the first entity is associated with a Virtual Private Network (VPN) group.

14. A method as defined in claim 13 further comprising:

determining if acquiring the update message causes a high water mark to be reached; and

if so, ejecting the first entity from the VPN group.

15. A method as defined in claim 10 further comprising:

determining if acquiring the update message causes a warning alert threshold to be reached; and

if so, forwarding a warning message to a recipient in the communications network.

16. A method as defined in claim 10 further comprising:

authenticating the update message using an integrity check value that is contained in the update message.

17. An apparatus comprising:

a network interface coupled to a communications network; and

a processor configured to;

register a first address, associated with a first entity in the communications network, with a second entity in the communications network to cause the second entity to forward keying information to the first entity using the first address;

acquire a second address;

generate an update message containing the second address; and

forward the update message, via the network interface, to the second entity to cause the second entity to use the second address instead of the first address to forward keying information to the first entity.

18. An apparatus comprising:

a network interface coupled to a communications network; and

a processor configured to;

use a first address, associated with a first entity in the communications network, to forward keying information, via the network interface, to the first entity;

acquire an update message containing a second address associated with the first entity; and

use the second address instead of the first address to forward keying information, via the network interface, to the first entity.

19. An apparatus comprising:

means for registering a first address, associated with a first entity in a communications network, with a second entity in the communications network to cause the second entity to forward keying information to the first entity using the first address;

means for acquiring a second address;

means for generating an update message containing the second address; and

means for forwarding the update message to the second entity to cause the second entity to use the second address instead of the first address to forward keying information to the first entity.

20. An apparatus comprising:

means for using a first address, associated with a first entity in a communications network, to forward keying information to the first entity;

means for acquiring an update message containing a second address associated with the first entity; and

means for using the second address instead of the first address to forward keying information to the first entity.

21. Logic encoded on one or more tangible computer readable media for execution, and when executed, operable to:

register a first address, associated with a first entity in a communications network, with a second entity in the communications network to cause the second entity to forward keying information to the first entity using the first address;

acquire a second address;

generate an update message containing the second address; and

forward the update message to the second entity to cause the second entity to use the second address instead of the first address to forward keying information to the first entity.

22. Logic encoded on one or more tangible computer readable media for execution, and when executed, operable to:

use a first address, associated with a first entity in a communications network, to forward keying information to the first entity;

acquire an update message containing a second address associated with the first entity; and

use the second address instead of the first address to forward keying information to the first entity.