Securing network traffic by distributing policies in a hierarchy over secure tunnels

• US 7,774,837 B2
• Filed: 05/25/2007
• Issued: 08/10/2010
• Est. Priority Date: 06/14/2006
• Status: Active Grant

• Current Assignee: Certes Networks, Inc.
• Original Assignee: Certes Networks, Inc.
• Inventors: McAlister, Donald K.
• Primary Examiner(s): Moise; Emmanuel L
• Assistant Examiner(s): Pearson; David J
• Application Number:
  US11/807,187
• Publication Number:
  US 20080016550A1
• Time in Patent Office: 1,173 Days
• Field of Search: None
• US Class Current: 726/15
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A technique for securing message traffic in a data network using a protocol such as IPsec, and more particularly various methods for distributing security policies among peer entities in a network while minimizing the passing and storage of detailed policy or key information except at the lowest levels of a hierarchy.

Claims

1. A method for securing message traffic in a data network by distributing security policies, the method comprising:

at a first distribution point located at a first location, (i) determining a first security policy to be applied to a network connection, the first security policy including at least a definition of a security group and a first network device that is assigned to the security group, and (ii) forwarding the first security policy from the first distribution point to a first managing module;

at the first managing module, (i) recording a first association between the security group and an identifier for the first distribution point, and (ii) sending a first message to a central managing module indicating that the first managing module has recorded the first association between the security group and an identifier for the first distribution point;

at the central managing module, generating a first security group database entry based on the first message;

at a second distribution point located at a second location, (i) determining a second security policy to be applied to a network connection, the second security policy including at least a definition of the security group and a second network device that is assigned to the security group, and (ii) forwarding the second security policy from the second distribution point to a second managing module;

at the second managing module, (i) recording a second association between the security group and an identifier for the second distribution point, and (ii) sending a second message to the central managing module indicating that the second managing module has recorded the second association between the security group and an identifier for the second distribution point;

at the central managing module, (i) generating a second security group database entry based on the second message, (ii) sending a third message to the first managing module indicating that the second managing module has recorded the second association between the security group and an identifier for the second distribution point, and (iii) sending a fourth message to the second managing module indicating that the first managing module has recorded the first association between the security group and an identifier for the first distribution point;

at the first managing module, sending a fifth message to the first distribution point to add the second distribution point to the security group;

at the second managing module, sending a sixth message to the second distribution point to add the first distribution point to the security group;

exchanging keys between the first and second distribution points via one or more secure tunnels;

at the first distribution point, distributing the exchanged keys to one or more security components in the first location; and

at the second distribution point, distributing the exchanged keys to one or more security components in the second location.

2. A method as claimed in claim 1 further comprising:

at a first security component in the first location, applying the first security policy to the network connection in a communications network interfacing a first group of end nodes that are part of the security group.

3. A method as claimed in claim 2 wherein the communications network of the first location includes an Ethernet, an asynchronous transfer mode (ATM), one or more inter-networking or a wireless communication network.

4. A method as claimed in claim 2 wherein the first group of end nodes includes any of a personal computer, a workstation, a personal digital assistant, a digital mobile telephone, a wireless network, a server, a video set top boxes and a data processor.

5. A method as claimed in claim 2 wherein the first security component is a Policy Enforcement Point.

6. A method as claimed in claim 1 wherein the first distribution point forwards an updated version of the first security policy to the first managing module according to a schedule.

7. A method as claimed in claim 1 wherein the first security group database entry indicates that the first security policy is located at the first managing module and that the first security policy can be controlled by the first distribution point.

8. A system for securing message traffic in a data network by distributing security policies, the system comprising:

a first distribution point located at a first location;

a first managing module;

a second distribution point located at a second location;

a second managing module; and

a central managing module,

the first distribution point configured to (i) determine a first security policy to be applied to a network connection, the first security policy including at least a definition of a security group and a first network device that is assigned to the security group, and (ii) forward the first security policy from the first distribution point to the first managing module,

the first managing module configured to (i) record a first association between the security group and an identifier for the first distribution point, and (ii) send a first message to the central managing module indicating that the first managing module has recorded the first association between the security group and an identifier for the first distribution point,

the second distribution point configured to (i) determine a second security policy to be applied to a network connection, the second security policy including at least a definition of the security group and a second network device that is assigned to the security group, and (ii) forward the second security policy from the second distribution point to the second managing module,

the second managing module configured to (i) record a second association between the security group and an identifier for the second distribution point, and (ii) send a second message to the central managing module indicating that the second managing module has recorded the second association between the security group and an identifier for the second distribution point,

the central managing module configured to (i) generate a first security group database entry based on the first message, (ii) generate a second security group database entry based on the second message, (iii) send a third message to the first managing module indicating that the second managing module has recorded the second association between the security group and an identifier for the second distribution point, and (iii) send a fourth message to the second managing module indicating that the first managing module has recorded the first association between the security group and an identifier for the first distribution point,

the first and second managing modules further configured to send a fifth and sixth message, respectively, to the first distribution point to add the second distribution point to the security group and to the second distribution point to add the first distribution point to the security group, and

the first and second distribution points further configured to exchange keys via one or more secure tunnels and to distribute the exchanged keys to one or more security components in the first and second locations, respectively.

9. A system as claimed in claim 8 wherein the first location further includes:

a communications network;

a first group of end nodes interfacing the communication network and being part of the security group; and

a first security component interfacing the communications network and configured to apply the first security policy to the network connection.

10. A system as claimed in claim 9 wherein the communications network of the first location includes an Ethernet, an asynchronous transfer mode (ATM), one or more inter-networking or a wireless communication network.

11. A system as claimed in claim 9 wherein the first group of end nodes includes any of a personal computer, a workstation, a personal digital assistant, a digital mobile telephone, a wireless network, a server, a video set top boxes and a data processor.

12. A system as claimed in claim 9 wherein the first security component is a Policy Enforcement Point.

13. A system as claimed in claim 8 wherein the first distribution point is further configured to forward an updated version of the first security policy to the first managing module according to a schedule.

14. A system as claimed in claim 8 wherein the first security group database entry indicates that the first security policy is located at the first managing module and that the first security policy can be controlled by the first distribution point.

15. A system as claimed in claim 8 wherein the first, second, and central managing modules are arranged in a hierarchy.

16. A non-transitory computer-readable medium having computer-readable program codes embodied therein for securing message traffic in a data network by distributing security policies, the computer-readable medium program codes performing functions comprising:

a routine for determining a first security policy to be applied to a network connection, the first security policy including at least a definition of a security group and a first network device at a first location that is assigned to the security group, and (ii) forwarding the first security policy from a first distribution point at the first location to a first managing module;

a routine for (i) recording a first association between the security group and an identifier for the first distribution point, and (ii) sending a first message to a central managing module indicating that the first managing module has recorded the first association between the security group and an identifier for the first distribution point;

a routine for generating a first security group database entry based on the first message;

a routine for (i) determining a second security policy to be applied to a network connection, the second security policy including at least a definition of the security group and a second network device at a second location that is assigned to the security group, and (ii) forwarding the second security policy from a second distribution point at the second location to a second managing module;

a routine for (i) recording a second association between the security group and an identifier for the second distribution point, and (ii) sending a second message to the central managing module indicating that the second managing module has recorded the second association between the security group and an identifier for the second distribution point;

a routine for (i) generating a second security group database entry based on the second message, (ii) sending a third message to the first managing module indicating that the second managing module has recorded the second association between the security group and an identifier for the second distribution point, and (iii) sending a fourth message to the second managing module indicating that the first managing module has recorded the first association between the security group and an identifier for the first distribution point;

a routine for sending a fifth message to the first distribution point to add the second distribution point to the security group;

a routine for sending a sixth message to the second distribution point to add the first distribution point to the security group;

a routine for exchanging keys between the first and second distribution points via one or more secure tunnels;

a routine for distributing the exchanged keys to one or more security components in the first location; and

a routine for distributing the exchanged keys to one or more security components in the second location.