Data encryption over a plurality of MPLS networks

• US 8,332,639 B2
• Filed: 12/11/2006
• Issued: 12/11/2012
• Est. Priority Date: 12/11/2006
• Status: Active Grant

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Inventors: Wood, Daniel M.
• Primary Examiner(s): Shiferaw, Eleni
• Assistant Examiner(s): Branske, Hilary
• Application Number:
  US11/609,103
• Publication Number:
  US 20080137845A1
• Time in Patent Office: 2,192 Days
• Field of Search: 380/255, 380/258, 380/270, 713/150, 713/153, 713/154, 713/155, 713/160, 713/168, 726/11, 726/12, 726/13, 726/14, 726/22
• US Class Current: 713/168
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/164 at the network layer

Abstract

A network device negotiates an encryption protocol with another network device, receives data from a trusted client device, encrypts the received data with the negotiated encryption protocol, and applies a label switched path (LSP) label to the encrypted data for transmission to the network device through an untrusted Multiprotocol Label Switching (MPLS) network.

Claims

1. A method comprising:

negotiating, by a first encryption device, an encryption protocol with a second encryption device;

negotiating, by the first encryption device, a label switched path (LSP) label with the second encryption device;

storing, by the first encryption device, the LSP label;

storing, by the first encryption device, information identifying the encryption protocol in association with the LSP label;

receiving, by the first encryption device, data from a trusted client device;

encrypting, by the first encryption device, the data with the negotiated encryption protocol based on the information identifying the encryption protocol;

applying, by the first encryption device, the LSP label to the encrypted data based on the information identifying the encryption protocol being stored in association with the LSP label; and

transmitting, by the first encryption device, the encrypted data to the second encryption device through a Multiprotocol Label Switching (MPLS) network.

2. The method of claim 1, where negotiating the encryption protocol includes:

receiving a signal from the second encryption device indicating the encryption protocol; and

selecting the encryption protocol from a memory based on the signal received from the second encryption device.

3. The method of claim 1, where the trusted client device is in a trusted network and the MPLS network is an untrusted network.

4. A network device comprising:

a microprocessor to;

transmit a request to a second network device to negotiate an encryption protocol,

negotiate a label switched path (LSP) label with the second network device,

select the encryption protocol based on a response from the second network device,

store the LSP label,

store information identifying the encryption protocol in association with the LSP label,

receive data from a trusted client device,

encrypt the data with the encryption protocol based on the information identifying the encryption protocol,

apply the LSP label to the encrypted data based on the information identifying the encryption protocol being stored in association with the LSP label, and

transmit the encrypted data to the second network device through an untrusted Multiprotocol Label Switching (MPLS) network.

5. The network device of claim 4, where the trusted client device is in a trusted network.

6. The network device of clam 4, where the microprocessor is further to:

switch the encrypted data to an output port before transmitting the encrypted data.

7. A system comprising:

a first network device to;

negotiate a first encryption protocol and a first label switched path (LSP) label with a second network device,

store the first LSP label,

store first information identifying the first encryption protocol in association with the first LSP label,

receive data from a trusted network,

encrypt the data with the first encryption protocol based on the first information identifying the first encryption protocol,

apply the first LSP label to the encrypted data based on the first LSP label that is stored in association with the information identifying the encryption protocol, and

transmit the encrypted data to the second network device.

8. The system of claim 7, where the first network device is further to:

select the first negotiated encryption protocol from a plurality of encryption protocols.

9. The system of claim 7, where the data received from the trusted network is transmitted from a trusted client device.

10. The system of claim 7, further comprising:

the second network device to;

receive the encrypted data from the first network device,

decrypt the encrypted data with the first negotiated encryption protocol,

negotiate a second encryption protocol and a second LSP label with a third network device,

re-encrypt the decrypted data with the second encryption protocol,

apply the second LSP label to the re-encrypted data, and

transmit the re-encrypted data to the third network device.

11. The system of claim 10, where the second network device negotiates for the second encryption protocol before the first network device encrypts the data with the first negotiated encryption protocol and applies the first LSP label.

12. The system of claim 10, where the second network device is further to:

store second information identifying the second encryption protocol in association with the second LSP label.

13. A network device comprising:

a microprocessor to;

negotiate a first encryption protocol with a first network device,

negotiate a first label switched path (LSP) label with the first network device,

store the first LSP label,

store information identifying the first encryption protocol in association with the first LSP label,

negotiate a second encryption protocol with a second network device,

negotiate a second LSP label with the second network device,

receive encrypted data from the first network device,

the encrypted data including the first LSP label,

decrypt the encrypted data with the first encryption protocol based on the information identifying the first encryption protocol that is stored in association with the first LSP label,

re-encrypt the decrypted data with the second encryption protocol,

apply the second LSP label to the re-encrypted data, and

transmit the re-encrypted data to the second network device.

14. The network device of claim 13, further comprising a memory to store a plurality of encryption protocols, and

where the microprocessor is further to:

select the first encryption protocol and the second encryption protocol from the plurality of encryption protocols stored in the memory.