VPN enrollment protocol gateway

• US 7,069,441 B2
• Filed: 09/21/2004
• Issued: 06/27/2006
• Est. Priority Date: 04/12/2000
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Balaz, Rudolph, Su, Xiaohong, Vogel, Keith R., Heller, Victor W.
• Primary Examiner(s): REVAK, CHRISTOPHER A
• Application Number:
  US10/946,280
• Publication Number:
  US 20050039055A1
• Time in Patent Office: 644 Days
• Field of Search: None
• US Class Current: 713/175
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/3265 using certificate chains, trees or paths; Hierarchical trust model
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

A virtual private network (VPN) enrollment protocol gateway is described herein. The protocol gateway is implemented as a registration authority that operates as an intermediary between routers and a certificate authority, allowing routers operating in accordance with one protocol to obtain and maintain certificates for a VPN from a certificate authority operating in accordance with another protocol. In accordance with one aspect, the gateway protocol supports various requests from the router, including router enrollment requests, get certificate revocation list request, get certificate requests, get certificate authority certificate requests, and password requests.

Claims

1. A registration authority comprising:

means for receiving, from a device, a first message in accordance with a first protocol, wherein the first message comprises an enrollment message;

means for generating, based on the first message, a second message in accordance with a second protocol;

means for sending the second message to a certificate authority;

means for receiving, from the certificate authority, a third message in response to the second message and in accordance with the second protocol, wherein the third message comprises a certificate authority pending response;

means for generating, based on the third message, a fourth message in accordance with the first protocol;

means for sending the fourth message to the device as a response to the first message; and

means for generating, in response to the certificate authority pending response;

a hash value based on the enrollment message;

a hash table entry mapping a pending response ID, corresponding to the certificate authority pending response, to the hash value; and

a transaction ID table entry mapping the transaction ID, corresponding to the enrollment message, to a pending response ID corresponding to the certificate authority pending response.

2. A registration authority as recited in claim 1, wherein the device comprises a router.

3. A registration authority as recited in claim 1, wherein the means for generating the second message comprises:

means for verifying that the first message has been digitally signed by the device;

means for decrypting the first message;

means for extracting a certificate enrollment request from the first message;

means for generating a certificate authority request including the certificate enrollment request and a subject alternative names extension; and

means for creating the second message by digitally signing the certificate authority request.

4. A registration authority as recited in claim 1, wherein the means for generating the fourth message comprises:

means for generating a pending response;

means for encrypting the pending response; and

means for creating the fourth message by digitally signing the encrypted pending response.

5. A registration authority as recited in claim 1, further comprising:

means for receiving an additional enrollment message from the device;

means for generating a new hash value based on the additional enrollment message;

means for checking whether an entry in the hash table matches the new hash value; and

means for, if an entry in the hash table matches the new hash value,

obtaining a pending response ID, from the hash table, corresponding to the new hash value, and

transmitting, to the certificate authority, a certificate request including the pending response ID.