IP encryption over resilient BGP/MPLS IP VPN

• US 20080075088A1
• Filed: 01/22/2007
• Published: 03/27/2008
• Est. Priority Date: 09/27/2006
• Status: Active Grant

• Current Assignee: Certes Networks, Inc.
• Original Assignee: Certes Networks, Inc.
• Inventors: Carrasco, Serge-Paul
• Granted Patent: US 8,284,943 B2
• Time in Patent Office: Days
• US Class Current: 370/395.5
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/50 using label swapping, e.g. multi-protocol label switch [MPLS]
• CPC Class Codes: H04L 45/502 Frame based
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Encryption of Internet Protocol (IP) traffic using IP Security (IPSec) at the edge of the enterprise network, in such a way as to support resilient BGP/MPLS IP VPN network designs. The IP traffic is securely tunneled within IPSec tunnels from the edge to the edge of the enterprise network. The IPSec traffic is also tunneled within MPLS tunnels from the edge to the edge of the service provider network. The enterprise network thus manages its own IPSec site-to-site VPN. The service provider thus independently manages its own MPLS network. The result provides an IP VPN or Layer 3 MPLS VPN to the enterprise; the enterprise IPSec network can thus be considered as an overlay to the MPLS service provider network.

Claims

1. A method for operating on a data packet to provide an enterprise networking environment over a service provider network, comprising:

a customer edge (CE) router function, located within the enterprise network, for;

providing the data packet;

a Policy Enforcement Point (PEP) function, for;

applying an IPSec protocol to the data packet; and

applying a security association policy to the data packet;

a provider edge router function, located within the service provider network, for;

applying an MPLS protocol to the data packet; and

forwarding the data packet according to the enterprise network Virtual Private Network (VPN) routing and forwarding (VRF).

2. The method of claim 1, additionally comprising:

receiving the security association from a network overlay that is responsible for distributing at least one of security policies and encryption keys to the PEPs.

3. The method of claim 2 wherein the network overlay additionally comprises:

a security policy layer; and

an encryption key layer.

4. The method of claim 3 wherein the security policy layer is provided by a Management And Policy (MAP) server and the encryption key layer is provided by a Key Authority Point (KAP) server.

5. The method of claim 4 additionally wherein one outbound encryption key is provided for each PEP site that becomes the inbound encryption key for the other PEP sites.

6. The method of claim 4 additionally comprising, by the KAP:

generating outbound keys; and

distributing pairs of inbound and outbound keys for each associated PEP.

7. The method of claim 1, additionally comprising:

maintaining the original IP header in the data packet in the clear as the IP address; and

encrypting the entire IP packet both its header and its payload of the data packet using IPSec ESP;

8. The method of claim 1, additionally comprising:

providing resiliency, by connecting two or more CEs to two or more PEs.

9. The method of claim 8 wherein two PEs are controlled by different service providers.

10. The method of claim 8 wherein full mesh connectivity between n, where n is greater than 2, enterprise sites is provided by no more than n tunnels and no more than 2n security associations.

12. The apparatus of claim 10, wherein the PEP is additionally for

receiving the security association from a network overlay that is responsible for distributing at least one of security policies and encryption keys to the PEPs.

14. The apparatus of claim 12 additionally comprising:

a Management And Policy (MAP) server for providing the security policy layer; and

a Key Authority Point (KAP) for providing the encryption key layer.

17. The apparatus of claim 10, additionally comprising

an Internet Protocol (IP) level packet encryptor, that maintains an original IP header in the data packet in the clear as the IP address, and encrypts the entire IP packet both its header and its payload of the data packet using IPSec ESP;

18. The apparatus of claim 10, additionally comprising:

two or more CEs;

two or more PEs, with connections through the service provider network made between the CEs and PEs.

20. The apparatus of claim 17 wherein full mesh connectivity between n enterprise sites, where n is greater than 2, is provided by no more than n tunnels and no more than 2n security associations.

11. An apparatus for operating on a data packet to provide an enterprise networking environment over a service provider network, comprising:

a customer edge (CE) router within the enterprise network for providing the data packet;

a Policy Enforcement Point (PEP) function arranged to;

apply an IPSec protocol to the data packet;

apply a security association policy to the data packet;

and within the service provider network, a provider edge (PE) router arranged to;

apply an MPLS protocol to the data packet;

forward the data packet according to enterprise network Virtual Private Network (VPN) routing and forwarding (VRF) tables.

13. The apparatus of claim 11 wherein the network overlay additionally comprises:

a security policy layer; and

an encryption key layer.

15. The apparatus of claim 13 wherein one outbound encryption key is provided for each PEP site in the enterprise network, and that key becomes an inbound encryption key for the other PEP sites.

16. The apparatus of claim 13 wherein the KAP additionally generates outbound keys and distributes pairs of inbound and outbound keys for each associated PEP.

19. The apparatus of 17 wherein two PEs are controlled by different service providers.