NEGOTIATION OF SECURITY PROTOCOLS AND PROTOCOL ATTRIBUTES IN SECURE COMMUNICATIONS ENVIRONMENT

• US 20140317720A1
• Filed: 09/30/2013
• Published: 10/23/2014
• Est. Priority Date: 01/31/2005
• Status: Active Grant

• Current Assignee: Unisys Corporation
• Original Assignee: Unisys Corporation
• Inventors: Johnson, Robert A., Wild, Kathleen, Inforzato, Sarah K., Hinaman, Ted
• Granted Patent: US 10,454,890 B2
• Time in Patent Office: Days
• US Class Current: 726/14
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0485 Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 69/18 Multiprotocol handlers, e.g. single devices capable of handling multiple protocols
• CPC Class Codes: H04L 9/0838 Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these network architectures or network communication protocols for key exchange in a packet data network H04L63/061
• CPC Class Codes: H04L 9/0841 involving Diffie-Hellman or related key agreement protocols

Abstract

Methods of communicatively connecting first and second endpoints are disclosed. One method includes transmitting from a first endpoint to a second endpoint a connection request, the connection request including an IP address of the second endpoint. The method further includes, based at least in part on the IP address of the second endpoint, selecting IPsec from among a plurality of available security protocols to first attempt to use in forming a tunnel between the first and second endpoints, and forming the tunnel between the first and second endpoints based on the connection request.

Claims

1. A method of communicatively connecting first and second endpoints, the method comprising:

transmitting from a first endpoint to a second endpoint a connection request, the connection request including an IP address of the second endpoint;

based at least in part on the IP address of the second endpoint, selecting IPsec from among a plurality of available security protocols to first attempt to use in forming a tunnel between the first and second endpoints; and

forming the tunnel between the first and second endpoints based on the connection request.

2. The method of claim 1, wherein forming the tunnel comprises forming the tunnel using the IPsec protocol.

3. The method of claim 2, wherein the first endpoint comprises a computing system having an operating system supporting a native IPsec implementation.

4. The method of claim 3, wherein the second endpoint comprises a computing system having an operating system supporting a native IPsec implementation.

5. The method of claim 2, wherein the tunnel is formed based on one or more attributes set at a user-level protocol service, the one or more attributes comprising IPsec attributes selected from a group of IPsec attributes consisting of:

encryption type;

authentication mechanism;

Elliptic Curve cryptography; and

IKE version.

6. The method of claim 1, wherein the second endpoint has an IPv6 address.

7. The method of claim 1, wherein the second endpoint has an IPv4 address.

8. The method of claim 7, wherein, upon determining that the first endpoint does not support IPsec, forming the tunnel using a second security protocol from among the plurality of available security protocols.

9. The method of claim 8, wherein the second security protocol comprises the SecureParser proprietary security protocol.

10. A method of communicatively connecting endpoints in a network, the method comprising:

selecting an IPsec security protocol from among a plurality of security protocols available at the first endpoint, wherein selecting the IPsec security protocol is based at least in part on an IP address of a second endpoint;

transmitting from a first endpoint to a second endpoint a connection request, the connection request identifying the IPsec security protocol;

forming an IPsec-based tunnel between the first and second endpoints;

selecting an IPsec security protocol from among a plurality of security protocols available at the first endpoint, wherein selecting the IPsec security protocol is based at least in part on an IP address of a third endpoint;

receiving an indication from the third endpoint that the third endpoint does not natively support the IPsec security protocol;

forming a second tunnel between the first and third endpoints, wherein the second tunnel uses a second security protocol other than the IPsec security protocol.

11. The method of claim 10, wherein the IP address of the second endpoint is an IPv6 address.

12. The method of claim 10, wherein the IP address of the third endpoint is an IPv4 address.

13. The method of claim 12, wherein the second security protocol comprises the SecureParser proprietary security protocol.

14. The method of claim 10, further comprising opening a tunnel between the first endpoint and a security appliance, the tunnel between the first endpoint and the security appliance uses the second security protocol.

15. The method of claim 10, wherein the IPsec-based tunnel is formed based on one or more attributes set at a user-level protocol service, the one or more attributes comprising IPsec attributes selected from a group of IPsec attributes consisting of:

encryption type;

authentication mechanism;

Elliptic Curve cryptography; and

IKE version.

16. The method of claim 10, wherein the second endpoint comprises a computing system having a first operating system that natively supports the IPsec security protocol and the third endpoint comprises a computing system having a second operating system different from the first operating system and that lacks native IPsec support.

17. The method of claim 16, wherein the first operating system and the second operating system are provided by different operating system developers.

18. The method of claim 16, wherein the first operating system and the second operating system are different operating system versions provided by the same operating system developer.

19. A computer-readable storage device comprising computer-executable instructions stored thereon which, when executed, cause a computing system to perform a method of communicatively connecting to a remote endpoint, the method comprising:

transmitting to a remote endpoint a connection request, the connection request including an IP address of the remote endpoint;

based at least in part on the IP address of the remote endpoint, selecting IPsec from among a plurality of available security protocols to first attempt to use in forming a tunnel between the computing system and the remote endpoint; and

forming the tunnel between the computing system and the remote endpoint based on the connection request.

20. The computer-readable storage device of claim 19, further comprising:

transmitting to a second remote endpoint a connection request, the connection request including an IP address of the second remote endpoint;

based at least in part on the IP address of the remote endpoint, selecting an IPsec security protocol from among a plurality of available security protocols to first attempt to use in forming a tunnel between the computing system and the second remote endpoint;

receiving an indication from the second remote endpoint that the second remote endpoint does not natively support the IPsec security protocol; and

forming the tunnel between the computing system and the remote endpoint based on the connection request using a second security protocol of the plurality of available security protocols the second security protocol being a security protocol other than the IPsec security protocol.