DATA ENCRYPTION OVER A PLURALITY OF MPLS NETWORKS

• US 20080137845A1
• Filed: 12/11/2006
• Published: 06/12/2008
• Est. Priority Date: 12/11/2006
• Status: Active Grant

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: Federal Network Systems LLC (Jacobs Solutions, Inc.)
• Inventors: WOOD, Daniel M.
• Granted Patent: US 8,332,639 B2
• Time in Patent Office: Days
• US Class Current: 380/33
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/164 at the network layer

Abstract

A network device negotiates an encryption protocol with another network device, receives data from a trusted client device, encrypts the received data with the negotiated encryption protocol, and applies a label switched path (LSP) label to the encrypted data for transmission to the network device through an untrusted Multiprotocol Label Switching (MPLS) network.

Claims

1. A method comprising:

negotiating an encryption protocol with a network device;

receiving data from a trusted client device;

encrypting the received data with the negotiated encryption protocol; and

applying a label switched path (LSP) label to the encrypted data for transmission to the network device through a Multiprotocol Label Switching (MPLS) network.

2. The method of claim 1, further comprising:

receiving a signal from the network device indicating the negotiated encryption protocol.

3. The method of claim 2, further comprising:

selecting the negotiated encryption protocol from a memory based on the received signal from the network device.

4. The method of claim 1, further comprising:

negotiating the LSP label with the network device.

5. The method of claim 1, wherein the trusted client device is in a trusted network and the MPLS network is an untrusted network.

6. A network device comprising:

a memory for storing a plurality encryption protocols; and

logic configured to;

transmit a request to a second network device to negotiate an encryption protocol,

select one of the encryption protocols from the memory based on a response from the second network device,

receive data from a trusted client device,

encrypt the received data with the selected encryption protocol, and

apply a label switched path (LSP) label to the encrypted data for transmission to the second network device through an untrusted Multiprotocol Label Switching (MPLS) network.

7. The network device of claim 6, wherein the logic is further configured to:

negotiate the LSP label with the second network device.

8. The network device of claim 7, wherein the negotiated LSP label is stored in the memory.

9. The network device of claim 6, wherein the trusted client device is in a trusted network.

10. The network device of claim 6, wherein the logic is further configured to:

switch data received from an input port through an encryption engine to an output port.

11. A system comprising:

a first network device;

a second network device; and

a third network device,

wherein the first network device is configured to;

negotiate a first encryption protocol and a first label switched path (LSP) label with a second network device,

receive data from a trusted network, and

encrypt the received data with the first negotiated encryption protocol and apply the first LSP label for transmission of the encrypted data to the second network device, and

wherein the second network device is configured to;

receive the encrypted data from the first network device,

decrypt the received data with the first negotiated encryption protocol,

negotiate a second encryption protocol and a second LSP label with the third network device,

re-encrypt the decrypted data with the second encryption protocol, and

apply the second LSP label for transmission of the re-encrypted data to the third network device.

12. The system of claim 11, wherein the first network device is further configured to:

store the first negotiated LSP in memory.

13. The system of claim 12, wherein the first network device is further configured to:

select the first negotiated encryption protocol from a plurality of encryption protocols.

14. The system of claim 11, wherein the received data from the trusted network is transmitted from a trusted client device.

15. The method of claim 11, wherein the second network device is further configured to:

store the first and second negotiated encryption protocols in memory.

16. A network device comprising:

a memory for storing a plurality of encryption protocols; and

logic configured to;

negotiate a first encryption protocol with a first network device,

negotiate a second encryption protocol with a second network device,

receive encrypted data from the first network device,

decrypt the received data with the first encryption protocol and re-encrypt the data with the second encryption protocol, and

apply a label switched path (LSP) label for transmission of the re-encrypted data to the second network device.

17. The network device of claim 16, wherein the logic is further configured to:

negotiate a first LSP label with the first network device.

18. The network device of claim 17, wherein the logic is further configure to:

negotiate a second LSP label with the second network device.

19. The network device of claim 18, wherein the first and second LSP labels are stored in the memory.

20. The network device of claim 16, wherein the logic is further configured to:

select the first and second encryption protocols from the memory.