Virtual security interface

• US 20080104692A1
• Filed: 09/29/2006
• Published: 05/01/2008
• Est. Priority Date: 09/29/2006
• Status: Active Grant

• Current Assignee: Certes Networks, Inc.
• Original Assignee: Certes Networks, Inc.
• Inventors: McAlister, Donald
• Granted Patent: US 8,104,082 B2
• Time in Patent Office: Days
• US Class Current: 726/15
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

In some networking situations, securing an inner packet of a tunnel packet requires an intermediary networking device knowing a destination address of the secured inner packet. Consequently, an identity of a secured network is known to others and presents a security risk. The provided technique addresses this risk by: i) establishing at a first security interface a first secured network connection between a first and second secured network, the connection established for a first packet addressed to a virtual security interface and destined for the second secured network; and ii) responding to a network condition by establishing at a second security interface at least one second secured network connection between the first and second secured network, the connection established for a second packet addressed to the virtual security interface and destined for the second secured network.

Claims

1. A network security method for hiding and securing a network comprising:

establishing at a first security interface a first secured network connection between a first secured network and a second secured network, the first secured network connection established for a first packet which is addressed to a virtual security interface and which is destined for the second secured network; and

responding to a network condition by establishing at a second security interface at least one second secured network connection between the first secured network and the second secured network, the at least one second secured network connection established for a second packet which is addressed to the virtual security interface and which is destined for the second secured network.

2. The method of claim 1 further comprising sharing a security policy between the first security interface and the second security interface, the first secured network connection and the at least one second secured network connection established according to the shared security policy.

3. The method of claim 1 wherein the responding includes offloading a network security burden from the first secured network connection to the at least one second secured network connection.

4. The method of claim 1 wherein the responding includes balancing a network load from the first secured network connection to the at least one second secured network connection.

5. The method of claim 1 wherein the responding includes resiliently routing from the first secured network connection to the at least one second secured network connection.

6. The method of claim 1 wherein the establishing includes securing a packet from the first secured network to the second secured network.

7. The method of claim 6 wherein the securing includes de-encrypting and authenticating a packet from a secured network according a security policy.

8. The method of claim 6 wherein the securing includes encrypting and authenticating a packet from a secured network according a security policy.

9. The method of claim 1 wherein the establishing includes de-encapsulating a tunnel packet addressed to the virtual security interface.

10. The method of claim 1 wherein the establishing includes encapsulating a packet with a tunnel header addressed from the virtual security interface

11. A network security apparatus for hiding and securing a network comprising at least one security interface configured for establishing a secured network connection between a first secured network and a second secured network, the secured network connection established for a packet which is addressed to a virtual security interface and which is destined for the second secured network.

12. The apparatus of claim 11 wherein the at least one security interface includes:

an encapsulator configured to add to a packet a tunnel header addressed from the virtual security interface;

a de-encapsulator configured to remove from a tunnel packet a tunnel header addressed to the virtual security interface;

an encryptor operative coupled to the encapsulator, the encryptor configured to encrypt a packet from a secured network;

an de-encryptor operative coupled to the de-encapsulator, the encryptor configured to de-encrypt a packet; and

an authenticator operatively coupled to the encryptor and the de-encryptor configured for authenticating a packet.

13. The apparatus of claim 11 further comprising a proxy configured to answer a request for an address of the virtual security interface with an address of the at least one security interface.

14. A computer program product comprising:

a computer usable medium embodying computer usable code for hiding and securing a network, the computer program product including;

computer usable program code for establishing at a first security interface a first secured network connection between a first secured network and a second secured network, the first secured network connection established for a first packet which is addressed to a virtual security interface and which is destined for the second secured network; and

computer usable code for responding to a network condition by establishing at a second security interface at least one second secured network connection between the first secured network and the second secured network, the at least one second secured network connection established for a second packet which is addressed to the virtual security interface and which is destined for the second secured network.