Method and system for dynamic secured group communication

• US 8,036,221 B2
• Filed: 09/15/2008
• Issued: 10/11/2011
• Est. Priority Date: 06/14/2004
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Fluhrer, Scott, Rowles, Sheela, Naizi, Haseeb, Sethi, Pratima, Khalid, Mohamed, Wainner, Warren Scott, Kamarthy, Kavitha
• Primary Examiner(s): Ngo; Ricky
• Assistant Examiner(s): KAO, WEI PO ERIC
• Application Number:
  US12/210,821
• Publication Number:
  US 20090034557A1
• Time in Patent Office: 1,121 Days
• Field of Search: 370/389, 370/392, 370/393, 370/396, 370/397, 370/400, 370/409, 370/471, 370/473, 370/474, 370/475, 370/476
• US Class Current: 370/392
• CPC Class Codes: H04L 41/08 Configuration management of networks or network elements address allocation H04L61/50
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

A system and method directed to carrying out dynamic secured group communication is provided. The method includes obtaining a first packet that includes a first header. The first header includes a first source address of a first source node of a first network, and a first destination address of a first destination node of the first network. The method also includes forming a frame that includes the first header in encrypted form, combining the first header and the frame to form a second packet, and forming a second header. This second header includes a second source address of a second source node of a second network, and a second destination address of a second destination node of the second network. The method further includes encapsulating the second packet with the second header to form a third packet, and communicating the third packet into the second network from the second source node for termination to the second-destination node.

Claims

1. A method comprising:

obtaining a first packet that includes a first Internet Protocol (IP) header and a first payload, wherein the first IP header includes a first source address of a first source node of a first private network and a first destination address of a first destination node of the first private network, and the first payload includes a second packet that has a second IP header and a second payload, the second IP header having a second source address of a second source node of a second virtual private network partitioned from resources of, formed over, established within or via, the first private network and a second destination address of a second destination node of the second virtual private network;

encrypting the first packet to form an encrypted-subnet packet;

encapsulating the encrypted-subnet packet with a group-security association formed in accordance with a group-security policy to generate a group-encrypted packet using a tunneling protocol for tunneling the group-encrypted packet between the first source node of the first network and the first destination node of the first private network such that only the first source node of the first private network and the first destination node of the first private network are able to decipher the encrypted-subnet packet that is encapsulated in the group-encrypted packet with a message-authentication code identified for the encrypted-subnet packet, wherein the encrypted-subnet packet comprises a security-encapsulating header configured with identifiers of the first source node, the first destination node, the second source node, and the second destination node;

replicating the group-encrypted packet at the first source node of the first private network such that the group-encrypted packet follows a multicast distribution tree in the first private network; and

transmitting the group-encrypted packet into the second virtual private network from the second source node for delivery to the second destination node.

2. The method of claim 1, further comprising:

receiving the group-encrypted packet at the second destination node of the second virtual private network;

authenticating the group-encrypted packet based on the identifiers in the security-encapsulating header;

extracting the encrypted-subnet packet from the group-encrypted packet;

obtaining the first packet from the encrypted-subnet packet; and

transmitting the first packet to the first destination node.

3. The method of claim 2, further comprising:

receiving the first packet at the first destination node; and

obtaining the first payload of the first packet and the second payload of the second packet.

4. The method of claim 1, wherein encrypting comprises encrypting the first packet with a security association for securing the first packet using a cipher, wherein the cipher is pre-negotiated to be associated to (i) a security credential established by at least one node of the first network and (ii) an indicator that indicates that the first source node and the first destination node belong to the first private network.

5. The method of claim 4, wherein encrypting comprises encrypting the second IP header with a security association for authenticating the second source node.

6. The method of claim 4, wherein encrypting comprises encrypting the second IP header with the security association that comprises a token used for authenticating the group-encrypted packet by the tunneling protocol.

7. The method of claim 6, wherein encrypting comprises encrypting the second IP header using the token that is based on (i) a time system maintained by the second destination node, and (ii) a shared secret maintained by the second destination node.

8. The method of claim 6, wherein encrypting comprises encrypting the second IP header using the token that is based on (i) a time system maintained by the second source node, and (ii) a shared secret maintained by the second source node.

9. The method of claim 1, further comprising at the first source node and the first destination node of the first private network, initiating negotiations for secure transmission of the group-encrypted packet to the second virtual private network.

10. A method comprising:

obtaining a first packet that includes a first Internet Protocol (IP) header, a security-encapsulating header and a first payload, wherein the first IP header includes a first source address of a first source node of a first private network and a first destination address of a first destination node of the first network, the first payload includes a second packet that has a second IP header and a second payload, the second IP header having a second source address of a second source node of a second virtual private network partitioned from resources of, formed over, established within or via, the first private network and an encrypted second destination address of a second destination node of the second virtual private network;

encrypting the first packet to form an encrypted-subnet packet;

encapsulating the encrypted-subnet packet with a group-security association formed in accordance with a group-security policy to generate a group-encrypted packet using a tunneling protocol for tunneling the group-encrypted packet between the first source node of the first network and the first destination node of the first private network such that only the first source node of the first private network and the first destination node of the first private network are able to decipher the encrypted-subnet packet that is encapsulated in the group-encrypted packet with a message-authentication code identified for the encrypted-subnet packet, wherein the encrypted-subnet packet comprises a security-encapsulating header configured with identifiers of the first source node, the first destination node, the second source node, and the second destination node;

replicating the group-encrypted packet at the first source node of the first private network such that the group-encrypted packet follows a multicast distribution tree in the first private network; and

transmitting the group-encrypted packet into the second virtual private network from the first private network for delivery to the second destination node.

11. The method of claim 10, further comprising:

receiving the group-encrypted packet at the first destination node of the first private network;

authenticating the group-encrypted packet based on the identifiers in the security-encapsulating header;

extracting the encrypted-subnet packet from the group-encrypted packet;

obtaining the first packet from the encrypted-subnet packet; and

transmitting the first packet to the second destination node.

12. The method of claim 11, further comprising:

receiving the first packet at the second destination node; and

obtaining the first payload of the first packet and the second payload of the second packet.

13. The method of claim 10, wherein encrypting comprises encrypting the first packet with a security association for securing the first packet using a cipher, wherein the cipher is pre-negotiated to be associated to (i) a security credential established by at least one node of the second network and (ii) an indicator that indicates that the second source node and the second destination node belong to the first private network.

14. The method of claim 13, wherein encrypting comprises encrypting the second IP header with a security association for authenticating the second source node.

15. The method of claim 13, wherein encrypting comprises encrypting the second IP header with the security association that comprises a token used for authenticating the group-encrypted packet by the tunneling protocol.

16. The method of claim 15, wherein encrypting comprises encrypting the second IP header using the token that is based on (i) a time system maintained by the first destination node, and (ii) a shared secret maintained by the first destination node.

17. The method of claim 15, wherein encrypting comprises encrypting the second IP header using the token that is based on (i) a time system maintained by the first source node, and (ii) a shared secret maintained by the first source node.

18. The method of claim 10, further comprising at the first source node and the first destination node of the first private network, initiating negotiations for secure transmission of the group-encrypted packet to the second virtual private network.

19. A method comprising:

obtaining a first packet that includes a first Internet Protocol (IP) header and a first payload, wherein the first IP header includes a first source address of a first source node of a first private network and a first destination address of a first destination node of the first network, the first payload includes a second packet that has a second IP header and a second payload, the second IP header having a second source address of a second source node of a second virtual private network partitioned from resources of, formed over, established within or via, the first private network and a second destination address of a second destination node of the second network;

encrypting the second packet to form a first encrypted-subnet packet;

encapsulating the first encrypted-subnet packet with a first group-security association formed in accordance with a first group-security policy to form a first group-encrypted packet using a tunneling protocol for tunneling the group-encrypted packet between the first source node of the first network and the first destination node of the first private network such that only the first source node of the first private network and the first destination node of the first private network are able to decipher the encrypted-subnet packet that is encapsulated in the group-encrypted packet with a message-authentication code identified for the encrypted-subnet packet, wherein the first encrypted-subnet packet comprises a security-encapsulating header configured with identifiers of the first source node, the first destination node, the second source node, and the second destination node;

encrypting the first group-encrypted packet to form a second encrypted-subnet packet;

encapsulating the second encrypted-subnet packet with a second group-security association formed in accordance with a second group-security policy to form a second group-encrypted packet using a tunneling protocol for tunneling the second group-encrypted packet between the second source node of the second private network and the second destination node of the second virtual private network such that only the second source node of the second virtual private network and the second destination node of the second virtual private network are able to decipher the second encrypted-subnet packet that is encapsulated in the second group-encrypted packet with a message-authentication code identified for the second encrypted-subnet packet, wherein the second encrypted-subnet packet comprises a security-encapsulating header configured with identifiers of the second source node, the second destination node, the second source node, and the second destination node;

replicating the first group-encrypted packet at the first source node of the first private network such that the first group-encrypted packet follows a multicast distribution tree in the first private network;

transmitting the second group-encrypted packet for delivery to the second destination node of the second virtual private network.

20. The method of claim 19, further comprising:

receiving the second group-encrypted packet at the second destination node of the second virtual private network;

authenticating the second group-encrypted packet based on identifiers in a security-encapsulating header of the second group-encrypted packet;

extracting the second encrypted-subnet packet from the second group-encrypted packet;

obtaining the first group-encrypted packet from the second encrypted-subnet packet; and

transmitting the first group-encrypted packet to an intermediate node between the first private network and second virtual private network.

21. The method of claim 20, further comprising:

receiving the first group-encrypted packet at the intermediate node;

authenticating the first group-encrypted packet from identifiers in a security-encapsulating header of the first group-encrypted packet;

extracting the first encrypted-subnet packet from the first group-encrypted packet;

obtaining the first packet from the first encrypted-subnet packet; and

transmitting the first packet to the first destination node.

22. The method of claim 21, further comprising:

receiving the first packet at the first destination node; and

obtaining the first payload of the first packet and the second payload of the second packet.

23. The method of claim 19, further comprising at the first source node and the first destination node of the first private network, initiating negotiations for secure transmission of the group-encrypted packet to the second virtual private network.