PROVIDING SECURE NETWORKS

• US 20160373441A1
• Filed: 06/16/2015
• Published: 12/22/2016
• Est. Priority Date: 06/16/2015
• Status: Abandoned Application

• Current Assignee: Extreme Networks, Inc.
• Original Assignee: Avaya Incorporated
• Inventors: SIRIVARA, Seema
• Application Number:
  US14/740,454
• Publication Number:
  US 20160373441A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/3273 for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869

Abstract

Implementations generally relate to providing secure networks. In some implementations, a method includes determining one or more nodes in a network system with at least one port that is enabled for security enabled services. The method also includes provisioning a connectivity association for each node, wherein each connectivity association is provisioned with a connectivity association key. The method also includes associating each connectivity association with a virtual service network (VSN). The method also includes mutually authenticating nodes on each VSN based on each respective connectivity association key.

Claims

1. A computer-implemented method comprising:

determining one or more nodes in a network system with at least one port that is enabled for security enabled services;

provisioning a connectivity association for each node, wherein each connectivity association is provisioned with a connectivity association key;

associating each connectivity association with a virtual service network (VSN); and

mutually authenticating nodes on each VSN based on each respective connectivity association key.

2. The method of claim 1, wherein the one or more ports are Ethernet ports.

3. The method of claim 1, further comprising enabling multiple encryption keys to be derived from the connectivity association key.

4. The method of claim 1, further comprising generating an intermediate system to intermediate system (ISIS) type-length-value (TLV).

5. The method of claim 1, further comprising scrambling the connectivity association key.

6. The method of claim 1, further comprising advertising media access control security (MACsec) capabilities for the node.

7. The method of claim 1, further comprising building VSN trees based on mutual authentication.

8. A non-transitory computer-readable storage medium carrying program instructions thereon, the instructions when executed by one or more processors cause the one or more processors to perform operations comprising:

determining one or more nodes in a network system with at least one port that is enabled for security enabled services;

provisioning a connectivity association for each node, wherein each connectivity association is provisioned with a connectivity association key;

associating each connectivity association with a virtual service network (VSN); and

mutually authenticating nodes on each VSN based on each respective connectivity association key.

9. The computer-readable storage medium of claim 8, wherein the one or more ports are Ethernet ports.

10. The computer-readable storage medium of claim 8, wherein the instructions further cause the one or more processors to perform operations comprising enabling multiple encryption keys to be derived from the connectivity association key.

11. The computer-readable storage medium of claim 8, wherein the instructions further cause the one or more processors to perform operations comprising generating an intermediate system to intermediate system (ISIS) type-length-value (TLV).

12. The computer-readable storage medium of claim 8, wherein the instructions further cause the one or more processors to perform operations comprising scrambling the connectivity association key.

13. The computer-readable storage medium of claim 8, wherein the instructions further cause the one or more processors to perform operations comprising advertising media access control security (MACsec) capabilities for the node.

14. The computer-readable storage medium of claim 8, wherein the instructions further cause the one or more processors to perform operations comprising building VSN trees based on mutual authentication.

15. A system comprising:

one or more processors; and

logic encoded in one or more tangible media for execution by the one or more processors and when executed operable to perform operations comprising;

determining one or more nodes in a network system with at least one port that is enabled for security enabled services;

provisioning a connectivity association for each node, wherein each connectivity association is provisioned with a connectivity association key;

associating each connectivity association with a virtual service network (VSN); and

mutually authenticating nodes on each VSN based on each respective connectivity association key.

16. The system of claim 15, wherein the one or more ports are Ethernet ports.

17. The system of claim 15, wherein the logic when executed is further operable to perform operations comprising enabling multiple encryption keys to be derived from the connectivity association key.

18. The system of claim 15, wherein the logic when executed is further operable to perform operations comprising generating an intermediate system to intermediate system (ISIS) type-length-value (TLV).

19. The system of claim 15, wherein the logic when executed is further operable to perform operations comprising scrambling the connectivity association key.

20. The system of claim 15, wherein the logic when executed is further operable to perform operations comprising advertising media access control security (MACsec) capabilities for the node.