Method and Apparatus for Distributing Group Data In A Tunneled Encrypted Virtual Private Network

• US 20100205428A1
• Filed: 04/14/2010
• Published: 08/12/2010
• Est. Priority Date: 04/15/2005
• Status: Active Grant

• Current Assignee: Brian E. Weis, Frederic R.P. Detienne, Jan Vilhuber, Michael Lee Sullenberger
• Original Assignee: Brian E. Weis, Frederic R.P. Detienne, Jan Vilhuber, Michael Lee Sullenberger
• Inventors: Vilhuber, Jan, Detienne, Frederic R.P., Sullenberger, Michael Lee, Weis, Brian E.
• Granted Patent: US 8,250,359 B2
• Time in Patent Office: Days
• US Class Current: 713/153
• CPC Class Codes: H04L 12/1886 with traffic restrictions for efficiency improvement, e.g. involving subnets or subdomains
• CPC Class Codes: H04L 45/16 Multipoint routing
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833

Abstract

A packet forwarding process, on a data communications device, forwards a packet to a plurality of destinations within a network from that data communications device using an “encrypt, then replicate” method. The packet forwarding process receives a packet that is to be transmitted to the plurality of destinations, and applies a security association to the packet using security information shared between the data communications device, and the plurality of destinations, to create a secured packet. The secured packet contains a header that has a source address and a destination address. The source address is inserted into the header, and then the packet forwarding process replicates the secured packet, once for each of the plurality of destinations. After replication, the destination address is inserted into the header, and the packet forwarding process transmits each replicated secured packet to each of the plurality of destinations authorized to maintain the security association.

Claims

1. A method, comprising:

receiving a packet from a sender at a data communication device, wherein the packet is to be multicast to a plurality of destinations, each of which is a member of a multicast group;

identifying a security association related to the packet based, at least in part, on a data stream associated with the packet and security information shared between the data communications device and the plurality of destinations;

in response to determining that the security association related to the packet is shared between the data communications device and the plurality of destinations, processing the packet for the multicast group;

in response to determining that the security association related to the packet is shared between the data communications device and a particular destination but not the plurality of destinations, processing the packet separately for the particular destination;

wherein the method is performed by the data communication device.

2. The method of claim 1, wherein processing the packet for the multicast group comprises:

creating a multicast secured packet by applying the security association to the packet using a group key that is shared between the data communications device and the plurality of destinations;

replicating the multicast secured packet into a plurality of replicated secured packets for each destination from the plurality of destinations;

for a particular replicated secured packet, from the plurality of replicated multicast secured packets, destined to a particular destination from the plurality of destinations;

appending, to the particular replicated secured packet, a new header having a sender address location and an address location of the particular destination;

transmitting the particular replicated secured packets to the particular destination.

3. The method of claim 2, wherein processing the packet separately for the particular destination comprises:

creating a copy of the packet;

creating a secured unicast packet by applying the security association to the copy of the packet using a pair-wise key that is shared between the data communications device and the particular destination;

appending, to the secured unicast packet, a new header having a sender address location and an address location of the particular destination;

transmitting the secured unicast packet to the particular destination.

4. The method of claim 3, further comprising a key distribution management system that is located on a device other than the data communications device, and wherein identifying a security association further comprises:

registering with the key distribution management system by performing an authentication technique with the key distribution management system;

receiving a notification from each of the plurality of destinations by utilizing a tunnel mapping protocol to determine which of the plurality of destinations indicate successful receipt of an encryption key.

5. The method of claim 4, wherein utilizing a tunnel mapping protocol comprises:

identifying at least one destination that does not maintain a shared security association with the plurality of destinations;

applying a security association exclusive to the identified destination to the packet to create an exclusive secured packet that is to be transmitted exclusively to the identified destination;

transmitting the exclusive secured packet to the identified destination;

wherein the tunnel mapping protocol is a next-hop resolution protocol (NHRP).

6. The method of claim 5, wherein applying a security association to the packet to create a secured packet comprises:

encapsulating the packet for transmission throughout a network;

creating a header for the encapsulated packet, the header comprising a source address location for indicating an originating location of the packet, and a destination address location for indicating a final location of the packet;

inserting a source address into the source address location within the header of the packet, the source address indicating an origination location of the packet.

7. The method of claim 6, where applying a security association to the packet to create a secured packet comprises:

creating a plurality of secured packets, for the plurality of destinations;

inserting a respective destination address into the header within the plurality of the secured packets, the respective destination address indicating a network address of a respective one of the plurality of destinations.

8. The method of claim 6, wherein the network is a Dynamic Multipoint Virtual Private Network (DMVPN), and is a non-broadcast multi-access (NBMA) network;

wherein the security associations include shared encryption information available to the plurality of destinations and to the data communications device;

wherein applying the security association to the packet to create the secured packet comprises applying the shared encryption information to encrypt the packet once regardless of the number of destinations to which the packet is transmitted.

9. A computer-readable medium encoded with one or more sequences of instructions, which when executed on a processor, cause the processor to perform:

receiving a packet from a sender at a data communication device, wherein the packet is to be multicast to a plurality of destinations, each of which is a member of a multicast group;

identifying a security association related to the packet based, at least in part, on a data stream associated with the packet and security information shared between the data communications device and the plurality of destinations;

in response to determining that the security association related to the packet is shared between the data communications device and the plurality of destinations, processing the packet for the multicast group;

in response to determining that the security association related to the packet is shared between the data communications device and a particular destination but not the plurality of destinations, processing the packet separately for the particular destination.

10. The computer-readable medium of claim 9, wherein the instructions that cause the operation of processing the packet for the multicast group further comprise instructions, which when executed cause the processor to perform:

creating a multicast secured packet by applying the security association to the packet using a group key that is shared between the data communications device and the plurality of destinations;

replicating the multicast secured packet into a plurality of replicated secured packets for each destination from the plurality of destinations;

for a particular replicated secured packet, from the plurality of replicated multicast secured packets, destined to a particular destination from the plurality of destinations;

appending, to the particular replicated secured packet, a new header having a sender address location and an address location of the particular destination;

transmitting the particular replicated secured packets to the particular destination.

11. The computer-readable medium of claim 10, wherein the instructions that cause the operation of processing the packet separately for the particular destination further comprise instructions, which when executed cause the processor to perform:

creating a copy of the packet;

creating a secured unicast packet by applying the security association to the copy of the packet using a pair-wise key that is shared between the data communications device and the particular destination;

appending, to the secured unicast packet, a new header having a sender address location and an address location of the particular destination;

transmitting the secured unicast packet to the particular destination.

12. The computer-readable medium of claim 11, wherein the instructions operate with a key distribution management system that is located on a device other than the data communications device, and wherein the instructions that cause the operation of identifying a security association further comprise instructions, which when executed cause the processor to perform:

registering with the key distribution management system by performing an authentication technique with the key distribution management system;

receiving a notification from each of the plurality of destinations by utilizing a tunnel mapping protocol to determine which of the plurality of destinations indicate successful receipt of an encryption key.

13. The computer-readable medium of claim 12, wherein the instructions that cause the operation of utilizing a tunnel mapping protocol further comprise instructions, which when executed cause the processor to perform:

identifying at least one destination that does not maintain a shared security association with the plurality of destinations;

applying a security association exclusive to the identified destination to the packet to create an exclusive secured packet that is to be transmitted exclusively to the identified destination;

transmitting the exclusive secured packet to the identified destination;

wherein the tunnel mapping protocol is a next-hop resolution protocol (NHRP).

14. The computer-readable medium of claim 13, wherein the instructions that cause the operation of applying a security association to the packet to create a secured packet further comprise instructions, which when executed cause the processor to perform:

encapsulating the packet for transmission throughout a network;

creating a header for the encapsulated packet, the header comprising a source address location for indicating an originating location of the packet, and a destination address location for indicating a final location of the packet;

inserting a source address into the source address location within the header of the packet, the source address indicating an origination location of the packet.

15. The computer-readable medium of claim 14, wherein the instructions that cause the operation of applying a security association to the packet to create a secured packet further comprise instructions, which when executed cause the processor to perform:

creating a plurality of secured packets, for the plurality of destinations;

inserting a respective destination address into the header within the plurality of the secured packets, the respective destination address indicating a network address of a respective one of the plurality of destinations.

16. The computer-readable medium of claim 14, wherein the network is a Dynamic Multipoint Private Network (DMVPN), and is a non-broadcast multi-access (NBMA) network;

wherein the security associations include shared encryption information available to the plurality of destinations and to the data communications device;

wherein applying the security association to the packet to create the secured packet comprises applying the shared encryption information to encrypt the packet once regardless of the number of destinations to which the packet is transmitted.

17. An apparatus, comprising:

one or more processors;

a computer-readable medium encoded with one or more sequences of instructions, which when executed on a processor, cause the processor to perform;

receiving a packet from a sender at a data communication device, wherein the packet is to be multicast to a plurality of destinations, each of which is a member of a multicast group;

identifying a security association related to the packet based, at least in part, on a data stream associated with the packet and security information shared between the data communications device and the plurality of destinations;

in response to determining that the security association related to the packet is shared between the data communications device and the plurality of destinations, processing the packet for the multicast group;

in response to determining that the security association related to the packet is shared between the data communications device and a particular destination but not the plurality of destinations, processing the packet separately for the particular destination.

18. The apparatus of claim 17, wherein the instructions that cause the operation of processing the packet for the multicast group further comprise instructions, which when executed cause the processor to perform:

creating a multicast secured packet by applying the security association to the packet using a group key that is shared between the data communications device and the plurality of destinations;

replicating the multicast secured packet into a plurality of replicated secured packets for each destination from the plurality of destinations;

for a particular replicated secured packet, from the plurality of replicated multicast secured packets, destined to a particular destination from the plurality of destinations;

appending, to the particular replicated secured packet, a new header having a sender address location and an address location of the particular destination;

transmitting the particular replicated secured packets to the particular destination.

19. The apparatus of claim 18, wherein the instructions that cause the operation of processing the packet separately for the particular destination further comprise instructions, which when executed cause the processor to perform:

creating a copy of the packet;

creating a secured unicast packet by applying the security association to the copy of the packet using a pair-wise key that is shared between the data communications device and the particular destination;

appending, to the secured unicast packet, a new header having a sender address location and an address location of the particular destination;

transmitting the secured unicast packet to the particular destination.

20. The apparatus of claim 19, wherein the instructions operate with a key distribution management system that is located on a device other than the data communications device, and wherein the instructions that cause the operation of identifying a security association further comprise instructions, which when executed cause the processor to perform:

registering with the key distribution management system by performing an authentication technique with the key distribution management system;

receiving a notification from each of the plurality of destinations by utilizing a tunnel mapping protocol to determine which of the plurality of destinations indicate successful receipt of an encryption key.

21. The apparatus of claim 20, wherein the instructions that cause the operation of utilizing a tunnel mapping protocol further comprise instructions, which when executed cause the processor to perform:

identifying at least one destination that does not maintain a shared security association with the plurality of destinations;

applying a security association exclusive to the identified destination to the packet to create an exclusive secured packet that is to be transmitted exclusively to the identified destination;

transmitting the exclusive secured packet to the identified destination;

wherein the tunnel mapping protocol is a next-hop resolution protocol (NHRP).

22. The apparatus of claim 21, wherein the instructions that cause the operation of applying a security association to the packet to create a secured packet further comprise instructions, which when executed cause the processor to perform:

encapsulating the packet for transmission throughout a network;

creating a header for the encapsulated packet, the header comprising a source address location for indicating an originating location of the packet, and a destination address location for indicating a final location of the packet;

inserting a source address into the source address location within the header of the packet, the source address indicating an origination location of the packet.

23. The apparatus of claim 22, wherein the instructions that cause the operation of applying a security association to the packet to create a secured packet further comprise instructions, which when executed cause the processor to perform:

creating a plurality of secured packets, for the plurality of destinations;

inserting a respective destination address into the header within the plurality of the secured packets, the respective destination address indicating a network address of a respective one of the plurality of destinations.

24. The apparatus of claim 22, wherein the network is a Dynamic Multipoint Private Network (DMVPN), and is a non-broadcast multi-access (NBMA) network;

wherein the security associations include shared encryption information available to the plurality of destinations and to the data communications device;

wherein applying the security association to the packet to create the secured packet comprises applying the shared encryption information to encrypt the packet once regardless of the number of destinations to which the packet is transmitted.