Enabling secure communication in a clustered or distributed architecture

• US 20030093691A1
• Filed: 11/13/2001
• Published: 05/15/2003
• Est. Priority Date: 11/13/2001
• Status: Active Grant

• Current Assignee: Reefedge Networks LLC (IPNav)
• Original Assignee: Reefedge Inc. (Gen Digital Inc.)
• Inventors: Singhal, Sandeep Kishan, Joubert, Philippe Alain Pierre, Neves, Richard Kent, Simon, Thor John Lancelot, Gefflaut, Alain Franck
• Granted Patent: US 7,028,183 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/0471 Key exchange
• CPC Class Codes: H04W 28/18 Negotiating wireless communication parameters
• CPC Class Codes: H04W 40/02 Communication route or path selection, e.g. power-based or shortest path routing

Abstract

Techniques for enhancing security in networking environments, whereby a cryptographic node negotiates a set of security parameters (a “security association”) with an end node, on behalf of a routing node (an “edge router”), and then securely distributes the negotiated security parameters to the edge router and/or to other edge routers in the network. The disclosed negotiation techniques allow the end node to physically move during the negotiation, yet still establish the security association, and the secure distribution enables the end node to move seamlessly through the network yet continue communicating securely. The disclosed techniques may also be used advantageously in other environments, such as clustered server environments, and allow an end node to communicate with multiple routing or server nodes for a variety of reasons (for example, during a hot-swap to a different server during fail-over or as a result of load balancing).

Claims

1. A method of enhancing security in a computing network, the computing network comprising a plurality of routing nodes, a cryptographic node, and an end node, the method comprising steps of:

negotiating a set of security parameters between the end node and the cryptographic node; and

securely distributing the set of security parameters to one or more of the routing nodes.

2. The method according to claim 1, wherein the negotiating step further comprises steps of:

establishing a first communication path between the cryptographic node and a first of the routing nodes; and

performing a key exchange between the end node and the cryptographic node over the first communication path, wherein a result of the key exchange is the set of security parameters.

3. The method according to claim 2, wherein the first routing node routes traffic for the end node.

4. The method according to claim 2, wherein the establishing step occurs responsive to receiving, at the first routing node, an initial key exchange message from the end node.

5. The method according to claim 4, wherein the initial key exchange message is an Internet Key Exchange (“

IKE”

) message and the performed key exchange uses IKE messages.

6. The method according to claim 4, wherein the initial key exchange message is a Kerberized Internet Negotiation of Keys (“

KINK”

) message and the performed key exchange uses this initial KINK message.

7. The method according to claim 2, further comprising the step of establishing a second communication path between the cryptographic node and a second routing node;

and wherein the performing step uses the first communication path for a portion of the key exchange and uses the second communication path to complete the key exchange.

8. The method according to claim 7, wherein the first routing node and the second routing node share a network address.

9. The method according to claim 2, further comprising the step of establishing a plurality of communication paths to the cryptographic node, each of the communication paths originating from a different routing node;

and wherein the performing step uses the first communication path for a portion of the key exchange and uses multiple ones of the plurality of communication paths to complete the key exchange.

10. The method according to claim 9, wherein the first routing node and the different routing nodes share a network address.

11. The method according to claim 2, wherein the communication path is a transport-layer tunnel.

12. The method according to claim 11, wherein the transport-layer tunnel is established using Secure Sockets Layer (“

SSL”

).

13. The method according to claim 11, wherein the transport-layer tunnel is established using Transport Layer Security (“

TLS”

).

14. The method according to claim 11, wherein the transport-layer tunnel is established using Secure Shell (“

SSH”

or “

SECSH”

).

15. The method according to claim 2, wherein the communication path is a network-layer tunnel.

17. The method according to claim 2, wherein the communication path is a link-layer tunnel.

18. The method according to claim 17, wherein the link-layer tunnel is established using Point-to-Point Tunneling Protocol (“

PPTP”

).

19. The method according to claim 17, wherein the link-layer tunnel is established using Layer 2 Tunneling Protocol (“

L2TP”

).

20. The method according to claim 17, wherein the link-layer tunnel is established using Layer 2 Forwarding Protocol (“

L2F”

).

21. The method according to claim 2, wherein the communication path is established using Network Address Translation (“

NAT”

).

22. The method according to claim 21, wherein the NAT substitutes a destination address of the cryptographic node for a destination address of the first routing node in order to forward messages received from the end node to the cryptographic node during the performing step.

23. The method according to claim 22, wherein the NAT further substitutes a source address of the first routing node for a source address of the end node in order to forward messages received from the end node to the cryptographic node during the performing step, and substitutes a destination address of the end node for a destination address of the first routing node in order to forward messages received from the cryptographic node to the end node to during the performing step.

24. The method according to claim 2, wherein the communication path is established using a connectivity protocol.

25. The method according to claim 24, wherein the connectivity protocol is Routing Information Protocol (“

RIP”

).

26. The method according to claim 24, wherein the connectivity protocol is Open Shortest Path First (“

OSPF”

).

27. The method according to claim 24, wherein the connectivity protocol is a Handoff Management Protocol (“

HMP”

).

28. The method according to claim 24, wherein messages of the key exchange are encapsulated using the connectivity protocol.

29. The method according to claim 1, wherein the securely distributing step occurs upon request.

30. The method according to claim 29, wherein the request is multicast to a plurality of routing nodes and cryptographic nodes.

31. The method according to claim 30, wherein the securely distributing step occurs responsive to arrival of encrypted data from the end node at a selected one of the one or more routing nodes.

32. The method according to claim 30, wherein the securely distributing step occurs responsive to establishment of a link-layer association between the end node and a selected one of the one or more routing nodes.

33. The method according to claim 30, wherein multiple responses to the multicast request are received, and further comprising the step of processing the multiple responses to select a most up-to-date set of security parameters.

34. The method according to claim 1, wherein the securely distributing step occurs pro-actively.

35. The method according to claim 34, wherein the securely distributing step occurs responsive to the step of negotiating the set of security parameters.

36. The method according to claim 34, wherein the securely distributing step occurs responsive to establishment of a link-layer association between the end node and a selected one of the one or more routing nodes.

37. The method according to claim 1, wherein the securely distributing step further comprises the step of sending at least one set of security parameters from the cryptographic node to at least one routing node.

38. The method according to claim 1, wherein the securely distributing step further comprising distributing at least one set of security parameters from a selected one of the one or more routing nodes to at least one other routing node.

39. The method according to claim 2, wherein the securely distributing step further comprises the step of sending at least one set of security parameters from the cryptographic node to at least one routing node.

40. The method according to claim 39, where the sending step uses the first communication path to send traffic to the first routing node.

41. The method according to claim 11, where the sending step uses the transport-layer tunnel.

42. The method according to claim 15, where the sending step uses the network-layer tunnel.

43. The method according to claim 17, where the sending step uses the link-layer tunnel.

44. The method according to claim 21, where the sending step uses a transport-layer tunnel or a network-layer tunnel or a link-layer tunnel.

45. The method according to claim 21, where the sending step uses a connectivity protocol.

46. The method according to claim 24, where the sending step uses the connectivity protocol.

47. The method according to claim 1, wherein functionality of at least one of the routing nodes and the cryptographic node are co-located.

48. The method according to claim 38, wherein the securely distributing step enables the end node to remain securely connected as it moves through the network.

49. The method according to claim 40, wherein the securely distributing step enables the end node to remain securely connected as it moves from the first routing node to the at least one routing node.

50. The method according to claim 1, wherein the securely distributed set of security parameters is used to securely transmit data between the end node and the one or more routing nodes.

51. The method according to claim 1, wherein the security parameters are Internet Protocol Security (“

IPsec”

) security parameters.

52. The method according to claim 1, wherein the negotiation occurs according to Internet Protocol Security (“

IPsec”

).

53. The method according to claim 1, wherein:

at least one of the routing nodes has a packet filter;

the packet filter determines selected traffic received from the end node at the at least one routing node for routing to an encryption node; and

the encryption node performs cryptographic operations on the selected traffic before transmitting the selected traffic to its final destination.

54. The method according to claim 53, wherein functionality of at least one of the encryption nodes and the cryptographic node are co-located.

55. The method according to claim 1, further comprising the step of storing, by the cryptographic node, at least one set of security parameters in a repository, and wherein the securely distributing step distributes selected ones of the stored sets.

56. The method according to claim 55, further comprising the step of updating at least one set of the security parameters stored in the repository.

58. The method according to claim 56, wherein functionality of at least one of the encryption nodes and the cryptographic node are co-located.

59. The method according to claim 56, wherein said routing step further comprises routing, to a node that is not an encryption node, selected traffic received from the end node at the at least one routing node in accordance with the packet filter.

61. The system according to claim 59, wherein the means for negotiating step further comprises:

means for establishing a first communication path between the cryptographic node and a first of the routing nodes; and

means for performing a key exchange between the end node and the cryptographic node over the first communication path, wherein a result of the key exchange is the set of security parameters.

16. The method according to claim 16, wherein the network-layer tunnel is established using Internet Protocol Security (“

IPsec”

).

57. A method for enhancing security in a computing network, the computing network comprising a plurality of routing nodes, a plurality of encryption nodes, a cryptographic node, and an end node, wherein:

at least one of the routing nodes has a packet filter;

the method comprising steps of;

negotiating a set of security parameters between the end node and the cryptographic node;

securely distributing the set of security parameters to one or more of the encryption nodes;

routing, to an encryption node, selected traffic received from the end node at the at least one routing node in accordance with the packet filter; and

performing cryptographic operations on the selected traffic at the encryption node before transmitting the selected traffic to its final destination.

60. A system for enhancing security in a computing network, the computing network comprising a plurality of routing nodes, a cryptographic node, and an end node, the system comprising:

means for negotiating a set of security parameters between the end node and the cryptographic node; and

means for securely distributing the set of security parameters to one or more of the routing nodes.

62. A system for enhancing security in a computing network, the computing network comprising a plurality of routing nodes, a plurality of encryption nodes, a cryptographic node, and an end node, wherein:

at least one of the routing nodes has a packet filter;

the system comprising;

means for negotiating a set of security parameters between the end node and the cryptographic node;

means for securely distributing the set of security parameters to one or more of the encryption nodes;

means for routing, to an encryption node, selected traffic received from the end node at the at least one routing node in accordance with the packet filter; and

means for performing cryptographic operations on the selected traffic at the encryption node before transmitting the selected traffic to its final destination.

64. The computer program product according to claim 62, wherein the computer-readable program code means for negotiating further comprises:

computer-readable program code means for establishing a first communication path between the cryptographic node and a first of the routing nodes; and

computer-readable program code means for performing a key exchange between the end node and the cryptographic node over the first communication path, wherein a result of the key exchange is the set of security parameters.

66. The method according to claim 64, wherein the securely distributing step further comprises distributing at least one set of security parameters from a selected one of the server nodes to at least one other server node.

63. A computer program product for enhancing security in a computing network, the computing network comprising a plurality of routing nodes, a cryptographic node, and an end node, the computer program product embodied on one or more computer-readable media and comprising:

computer-readable program code means for negotiating a set of security parameters between the end node and the cryptographic node; and

computer-readable program code means for securely distributing the set of security parameters to one or more of the routing nodes.

65. A method of enhancing security in a clustered server computing environment, the computing environment comprising a cluster of server nodes, a cryptographic node, and at least one end node, the method comprising steps of:

negotiating a set of security parameters between the at least one end node and the cryptographic node; and

securely distributing the set of security parameters to one or more of the server nodes.

67. The method according to claim 65, wherein the securely distributing step enables the at least one end node to remain securely connected during load balancing operations of the computing environment.

68. The method according to claim 65, wherein the securely distributing step enables the at least one end node to remain securely connected during fail-over operations of the computing environment.