Security encapsulation of ethernet frames

• US 20080075073A1
• Filed: 09/25/2006
• Published: 03/27/2008
• Est. Priority Date: 09/25/2006
• Status: Active Grant

• Current Assignee: Certes Networks, Inc.
• Original Assignee: Certes Networks, Inc.
• Inventors: Swartz, Troy A.
• Granted Patent: US 8,379,638 B2
• Time in Patent Office: Days
• US Class Current: 370/389
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04L 63/164 at the network layer

Abstract

A technique for encapsulating data packets at a Data Link Layer to provide security functions. The technique first encrypts a payload to provide an encrypted payload. The encrypted payload is inserted in an output encapsulated frame. Also added to the output encapsulated frame is an encapsulation header that includes security information, such as a security packet index (SPI) value used to identify a security association (SA). Because the output encapsulated frame may now be longer than maximum allowed Ethernet Path Maximum Transmission Unit (PMTU), the encapsulation header also preferably includes a fragmentation field. The fragmentation field supports the ability to fragment the encrypted datagrams into smaller pieces.

Claims

1. A method for encapsulating data packets in a communication network, the method comprising:

receiving a data packet having an Ethernet frame from a communication network, the Ethernet frame having an original header and original payload;

encrypting the original payload to provide an encrypted payload;

determining an encapsulation header for encrypted payload, the encapsulation header including security association information; and

constructing an encapsulated packet from the original header, the encapsulation header, and the encapsulated payload.

2. The method of claim 1 wherein the encapsulation header comprises a fragmentation field.

3. The method of claim 1 wherein the security association in the encapsulation header comprises a Security Parameters Index (SPI) value.

4. The method of claim 1 additionally comprising:

determining an integrity check value for the original payload.

5. The method of claim 4 additionally comprising:

appending the integrity check value to the original payload.

6. The method of claim 1 wherein the Ethernet frame further comprises:

a Virtual Network Identifier (VID); and

the encapsulated packet further comprises the VID.

7. An apparatus comprising:

a receiver for receiving a data packet having an Ethernet frame from a communication device, the Ethernet frame having an original header and original payload;

an encryptor, for encrypting the original payload, to provide an encrypted payload;

a packet processor, for determining an encapsulation header for the encrypted payload, the encapsulation header comprising security association information; and

a packet assembler for assembling an encapsulated packet from the original header, the encapsulation header, and the encapsulated payload.

8. The apparatus of claim 7 wherein the encapsulation header comprises a fragmentation field.

9. The apparatus of claim 7 wherein the security association comprises a Security Parameters Index (SPI) value.

10. The apparatus of claim 7 wherein the packet processor further determines an integrity check value for the original payload.

11. The apparatus of claim 10 wherein the packet processor additionally appends the integrity check value to the original payload.

12. The apparatus of claim 7 wherein Ethernet frame further comprises a Virtual Network Identifier (VID), and the encapsulated packet further comprises the VID.