DYNAMIC GROUP CREATION AND TRAFFIC FLOW REGISTRATION UNDER A GROUP IN A GROUP KEY INFRASTRUCTURE

• US 20130219035A1
• Filed: 02/21/2012
• Published: 08/22/2013
• Est. Priority Date: 02/21/2012
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Detienne, Frederic R. P., Sethi, Pratima, Wijnands, Ijsbrand
• Granted Patent: US 9,009,302 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 9/0833 involving conference or group key network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

Upon detection of a new traffic flow, a registration node can dynamically register the new traffic flow with a key server policy manager by sending a registration request on behalf of the new traffic flow. A registration request indicates the new traffic flow should be protected by a security group. A registration request may also include a request to dynamically generate a new security group to protect the traffic flow. The registration request is received by a key server policy manager, which performs authentication and authorization checks of the requesting registration node, and determines whether to accept or reject the registration request. If accepted, the key server policy manager registers the new traffic flow by including a description of the traffic flow in a group policy of an existing security group or a newly created security group, depending on the registration request.

Claims

1. A method, comprising:

receiving a registration request to dynamically register a traffic flow, wherein the registration request is sent from a registration node;

determining whether to accept the registration request; and

performing the registration request, in response to a determination to accept the registration request.

2. The method of claim 1, wherein

the registration request comprises a group identifier and a traffic flow identifier,

the group identifier identifies a group,

the traffic flow identifier identifies the traffic flow, and

the registration request indicates that the group should protect the traffic flow.

3. The method of claim 2, wherein the determining whether to accept the registration request further comprises:

determining whether a group policy associated with the group presently exists.

4. The method of claim 3, wherein the performing the registration request further comprises:

in response to a determination that a group policy associated with the group presently exists, augmenting the group policy to include the traffic flow.

5. The method of claim 3, wherein the performing the registration request further comprises:

in response to a determination that a group policy associated with the group does not presently exist, generating a new group policy, wherein the new group policy includes the traffic flow.

6. The method of claim 1, further comprising:

publishing a group policy to group members, subsequent to the performing the registration request, wherein

the performing the registration request further comprises including the traffic flow in the group policy.

7. The method of claim 1, further comprising:

authenticating the registration node using a registration node identifier; and

verifying authorization of the registration node to make the registration request.

8. A method, comprising:

detecting a new traffic flow; and

sending a registration request to a key server policy manager, wherein

the registration request comprises a traffic flow identifier that identifies the new traffic flow.

9. The method of claim 8, further comprising:

receiving an acknowledgement from the key server policy manger, wherein

the acknowledgement indicates acceptance or rejection of the registration request.

10. The method of claim 8, further comprising:

receiving publication of a group policy, wherein the group policy includes the traffic flow identifier; and

refreshing the group policy, wherein the refreshing renews an expiration period associated with the group policy.

11. A system comprising:

a policy manager configured to

receive a registration request to dynamically register a traffic flow,

wherein

the registration request is sent from a registration node,

determine whether to accept the registration request, and

perform the registration request, in response to a determination to accept the registration request.

12. The system of claim 11, wherein

the registration request comprises a group identifier and a traffic flow identifier,

the group identifier identifies a group,

the traffic flow identifier identifies the traffic flow, and

the registration request indicates that the group should protect the traffic flow.

13. The system of claim 12, wherein

the policy manager is further configured to

determine whether a group policy associated with the group presently exists.

14. The system of claim 13, wherein

the policy manager is further configured to

augment the group policy to include the traffic flow, in response to a determination that a group policy associated with the group presently exists.

15. The system of claim 13, wherein

the policy manager is further configured to

generate a new group policy, in response to a determination that a group policy associated with the group does not presently exist, wherein the new group policy includes the traffic flow.

16. The system of claim 11, further comprising:

a key server configured to

publish a group policy to group members, subsequent to performance of the registration request, wherein

performance of the registration request results in the traffic flow being included in the group policy.

17. The system of claim 11, wherein

the policy manager is further configured to

authenticate the registration node using a registration node identifier, and

verify authorization of the registration node to make the registration request.

18. The system of claim 11, further comprising:

a registration node module configured to

detect a new traffic flow; and

send a registration request to the policy manager, wherein

the registration request comprises a traffic flow identifier that identifies the new traffic flow.

19. The system of claim 18, wherein

the registration node module is further configured to

receive an acknowledgement from the policy manger, wherein

the acknowledgement indicates acceptance or rejection of the registration request.

20. The system of claim 18, wherein

the registration node module is further configured to

receive publication of a group policy, wherein the group policy includes the traffic flow identifier;

and

refresh the group policy, wherein the refreshing renews an expiration period associated with the group policy.

21. An apparatus comprising:

a line card configured to receive a registration request to dynamically register a traffic flow, wherein

the registration request is sent from a registration node; and

a control module coupled to the line card, the control module configured to determine whether to accept the registration request, and

perform the registration request, in response to a determination to accept the registration request.

22. An apparatus comprising:

a line card configured to receive packets; and

a control module coupled to the line card, the control module configured to detect packets of a new traffic flow, and

send a registration request to a key server policy manager, wherein

the registration request comprises a traffic flow identifier that identifies the new traffic flow.