Method and system for dynamic secured group communication
First Claim
1. One or more non-transitory computer readable storage media encoded with software comprising computer executable instructions and when the software is executed operable to:
- obtain a first packet that includes a first Internet Protocol (IP) header and a first payload, wherein the first IP header includes a first source address of a first source node of a first private network and a first destination address of a first destination node of the first private network, and the first payload includes a second packet that has a second IP header and a second payload, the second IP header having a second source address of a second source node of a second virtual private network partitioned from resources of, formed over, established within or via, the first private network and a second destination address of a second destination node of the second virtual private network;
encrypt the first packet to form an encrypted-subnet packet;
encapsulate the encrypted-subnet packet with a group-security association formed in accordance with a group-security policy to generate a group-encrypted packet using a tunneling protocol for tunneling the group-encrypted packet between the first source node of the first network and the first destination node of the first private network such that only the first source node of the first private network and the first destination node of the first private network are able to decipher the encrypted-subnet packet that is encapsulated in the group-encrypted packet with a message-authentication code identified for the encrypted-subnet packet, wherein the encrypted-subnet packet comprises a first security-encapsulating header configured with identifiers of the first source node, the first destination node, the second source node, and the second destination node;
replicate the group-encrypted packet at the first source node of the first private network such that the group-encrypted packet follows a multicast distribution tree in the first private network; and
transmit the group-encrypted packet into the second virtual private network from the second source node for delivery to the second destination node.
0 Assignments
0 Petitions
Accused Products
Abstract
A system and method directed to carrying out dynamic secured group communication is provided. The method includes: obtaining a first packet that includes a first header; forming a frame that includes the first header in encrypted form; combining the first header and the frame to form a second packet and forming a second header; encapsulating the second packet with the second header to form a third packet, and communicating the third packet into the second network from the second source node for termination to the second-destination node. The first header includes a first source address of a first source node of a first network, and a first destination address of a first destination node of the first network. The second header includes a second source address of a second source node of a second network, and a second destination address of a second destination node of the second network.
22 Citations
22 Claims
-
1. One or more non-transitory computer readable storage media encoded with software comprising computer executable instructions and when the software is executed operable to:
-
obtain a first packet that includes a first Internet Protocol (IP) header and a first payload, wherein the first IP header includes a first source address of a first source node of a first private network and a first destination address of a first destination node of the first private network, and the first payload includes a second packet that has a second IP header and a second payload, the second IP header having a second source address of a second source node of a second virtual private network partitioned from resources of, formed over, established within or via, the first private network and a second destination address of a second destination node of the second virtual private network; encrypt the first packet to form an encrypted-subnet packet; encapsulate the encrypted-subnet packet with a group-security association formed in accordance with a group-security policy to generate a group-encrypted packet using a tunneling protocol for tunneling the group-encrypted packet between the first source node of the first network and the first destination node of the first private network such that only the first source node of the first private network and the first destination node of the first private network are able to decipher the encrypted-subnet packet that is encapsulated in the group-encrypted packet with a message-authentication code identified for the encrypted-subnet packet, wherein the encrypted-subnet packet comprises a first security-encapsulating header configured with identifiers of the first source node, the first destination node, the second source node, and the second destination node; replicate the group-encrypted packet at the first source node of the first private network such that the group-encrypted packet follows a multicast distribution tree in the first private network; and transmit the group-encrypted packet into the second virtual private network from the second source node for delivery to the second destination node. - View Dependent Claims (2, 3, 4, 5, 6)
-
-
7. One or more non-transitory computer readable storage media encoded with software comprising computer executable instructions and when the software is executed operable to:
-
obtain a first packet that includes a first Internet Protocol (IP) header, a security-encapsulating header and a first payload, wherein the first IP header includes a first source address of a first source node of a first private network and a first destination address of a first destination node of the first network, the first payload includes a second packet that has a second IP header and a second payload, the second IP header having a second source address of a second source node of a second virtual private network partitioned from resources of, formed over, established within or via, the first private network and an encrypted second destination address of a second destination node of the second virtual private network; encrypt the first packet to form an encrypted-subnet packet; encapsulate the encrypted-subnet packet with a group-security association formed in accordance with a group-security policy to generate a group-encrypted packet using a tunneling protocol for tunneling the group-encrypted packet between the first source node of the first network and the first destination node of the first private network such that only the first source node of the first private network and the first destination node of the first private network are able to decipher the encrypted-subnet packet that is encapsulated in the group-encrypted packet with a message-authentication code identified for the encrypted-subnet packet, wherein the encrypted-subnet packet comprises a first security-encapsulating header configured with identifiers of the first source node, the first destination node, the second source node, and the second destination node; replicate the group-encrypted packet at the first source node of the first private network such that the group-encrypted packet follows a multicast distribution tree in the first private network; and transmit the group-encrypted packet into the second virtual private network from the first private network for delivery to the second destination node. - View Dependent Claims (8, 9, 10, 11, 12, 13, 14)
-
-
15. One or more non-transitory computer readable storage media encoded with software comprising computer executable instructions and when the software is executed operable to:
-
obtain a first packet that includes a first Internet Protocol (IP) header and a first payload, wherein the first IP header includes a first source address of a first source node of a first private network and a first destination address of a first destination node of the first network, the first payload includes a second packet that has a second IP header and a second payload, the second IP header having a second source address of a second source node of a second virtual private network partitioned from resources of, formed over, established within or via, the first private network and a second destination address of a second destination node of the second network; encrypt the second packet to form a first encrypted-subnet packet; encapsulate the first encrypted-subnet packet with a first group-security association formed in accordance with a first group-security policy to form a first group-encrypted packet using a tunneling protocol for tunneling the group-encrypted packet between the first source node of the first network and the first destination node of the first private network such that only the first source node of the first private network and the first destination node of the first private network are able to decipher the encrypted-subnet packet that is encapsulated in the group-encrypted packet with a message-authentication code identified for the encrypted-subnet packet, wherein the first encrypted-subnet packet comprises a first security-encapsulating header configured with identifiers of the first source node, the first destination node, the second source node, and the second destination node; encrypt the first group-encrypted packet to form a second encrypted-subnet packet; encapsulate the second encrypted-subnet packet with a second group-security association formed in accordance with a second group-security policy to form a second group-encrypted packet using a tunneling protocol for tunneling the second group-encrypted packet between the second source node of the second private network and the second destination node of the second virtual private network such that only the second source node of the second virtual private network and the second destination node of the second virtual private network are able to decipher the second encrypted-subnet packet that is encapsulated in the second group-encrypted packet with a message-authentication code identified for the second encrypted-subnet packet, wherein the second encrypted-subnet packet comprises a security-encapsulating header configured with identifiers of the second source node, the second destination node, the second source node, and the second destination node; replicate the first group-encrypted packet at the first source node of the first private network such that the first group-encrypted packet follows a multicast distribution tree in the first private network; and transmit the second group-encrypted packet for delivery to the second destination node of the second virtual private network. - View Dependent Claims (16)
-
-
17. An apparatus comprising:
-
an input-output (I/O) interface unit; a memory; and a processor coupled to the I/O interface unit and the memory and configured to; obtain a first packet that includes a first Internet Protocol (IP) header and a first payload, wherein the first IP header includes a first source address of a first source node of a first private network and a first destination address of a first destination node of the first private network, and the first payload includes a second packet that has a second IP header and a second payload, the second IP header having a second source address of a second source node of a second virtual private network partitioned from resources of, formed over, established within or via, the first private network and a second destination address of a second destination node of the second virtual private network; encrypt the first packet to form an encrypted-subnet packet; encapsulate the encrypted-subnet packet with a group-security association formed in accordance with a group-security policy to generate a group-encrypted packet using a tunneling protocol for tunneling the group-encrypted packet between the first source node of the first network and the first destination node of the first private network such that only the first source node of the first private network and the first destination node of the first private network are able to decipher the encrypted-subnet packet that is encapsulated in the group-encrypted packet with a message-authentication code identified for the encrypted-subnet packet, wherein the encrypted-subnet packet comprises a first security-encapsulating header configured with identifiers of the first source node, the first destination node, the second source node, and the second destination node; replicate the group-encrypted packet at the first source node of the first private network such that the group-encrypted packet follows a multicast distribution tree in the first private network; and transmit the group-encrypted packet into the second virtual private network from the second source node for delivery to the second destination node. - View Dependent Claims (18)
-
-
19. An apparatus comprising:
-
an input-output (I/O) interface unit; a memory; and a processor coupled to the I/O interface unit and the memory and configured to; obtain a first packet that includes a first Internet Protocol (IP) header, a security-encapsulating header and a first payload, wherein the first IP header includes a first source address of a first source node of a first private network and a first destination address of a first destination node of the first network, the first payload includes a second packet that has a second IP header and a second payload, the second IP header having a second source address of a second source node of a second virtual private network partitioned from resources of, formed over, established within or via, the first private network and an encrypted second destination address of a second destination node of the second virtual private network; encrypt the first packet to form an encrypted-subnet packet; encapsulate the encrypted-subnet packet with a group-security association formed in accordance with a group-security policy to generate a group-encrypted packet using a tunneling protocol for tunneling the group-encrypted packet between the first source node of the first network and the first destination node of the first private network such that only the first source node of the first private network and the first destination node of the first private network are able to decipher the encrypted-subnet packet that is encapsulated in the group-encrypted packet with a message-authentication code identified for the encrypted-subnet packet, wherein the encrypted-subnet packet comprises a first security-encapsulating header configured with identifiers of the first source node, the first destination node, the second source node, and the second destination node; replicate the group-encrypted packet at the first source node of the first private network such that the group-encrypted packet follows a multicast distribution tree in the first private network; and transmit the group-encrypted packet into the second virtual private network from the first private network for delivery to the second destination node. - View Dependent Claims (20)
-
-
21. An apparatus comprising:
-
an input-output (I/O) interface unit; a memory; and a processor coupled to the I/O interface unit and the memory and configured to; obtain a first packet that includes a first Internet Protocol (IP) header and a first payload, wherein the first IP header includes a first source address of a first source node of a first private network and a first destination address of a first destination node of the first network, the first payload includes a second packet that has a second IP header and a second payload, the second IP header having a second source address of a second source node of a second virtual private network partitioned from resources of, formed over, established within or via, the first private network and a second destination address of a second destination node of the second network; encrypt the second packet to form a first encrypted-subnet packet; encapsulate the first encrypted-subnet packet with a first group-security association formed in accordance with a first group-security policy to form a first group-encrypted packet using a tunneling protocol for tunneling the group-encrypted packet between the first source node of the first network and the first destination node of the first private network such that only the first source node of the first private network and the first destination node of the first private network are able to decipher the encrypted-subnet packet that is encapsulated in the group-encrypted packet with a message-authentication code identified for the encrypted-subnet packet, wherein the first encrypted-subnet packet comprises a first security-encapsulating header configured with identifiers of the first source node, the first destination node, the second source node, and the second destination node; encrypt the first group-encrypted packet to form a second encrypted-subnet packet; encapsulate the second encrypted-subnet packet with a second group-security association formed in accordance with a second group-security policy to form a second group-encrypted packet using a tunneling protocol for tunneling the second group-encrypted packet between the second source node of the second private network and the second destination node of the second virtual private network such that only the second source node of the second virtual private network and the second destination node of the second virtual private network are able to decipher the second encrypted-subnet packet that is encapsulated in the second group-encrypted packet with a message-authentication code identified for the second encrypted-subnet packet, wherein the second encrypted-subnet packet comprises a security-encapsulating header configured with identifiers of the second source node, the second destination node, the second source node, and the second destination node; replicate the first group-encrypted packet at the first source node of the first private network such that the first group-encrypted packet follows a multicast distribution tree in the first private network; and transmit the second group-encrypted packet for delivery to the second destination node of the second virtual private network. - View Dependent Claims (22)
-
Specification