Key management for network communication

• US 5,825,891 A
• Filed: 10/29/1997
• Issued: 10/20/1998
• Est. Priority Date: 01/16/1996
• Status: Expired due to Term

• Current Assignee: Clouding Corporation (Marathon Patent Group, Inc.)
• Original Assignee: Raptor Systems Inc. (Gen Digital Inc.)
• Inventors: Kraemer, Jeffrey A., Levesque, Roger H., Nadkarni, Ashok P.
• Primary Examiner(s): CANGIALOSI, SALVATORE A
• Application Number:
  US08/959,919
• Time in Patent Office: 356 Days
• Field of Search: 380/23, 380/49, 370/406, 370/466
• US Class Current: 713/153
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/162 involving adaptations of sockets based mechanisms secure socket layer H04L63/168
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

The invention features a method for enabling computers to communicate using encrypted network packets. A configuration request is sent over a network from a first computer to a second computer, and tunnel record information is sent over the network from the second computer to the first computer. The tunnel record information is encrypted in accordance with a temporary configuration password.

The invention also features a method for updating a tunnel record. A connection request is sent from a first computer to a second computer, and the first computer is authorized. A tunnel record corresponding to the connection request with the first computer'"'"'s network address is then updated.

Claims

1. A method for enabling computers to communicate using encrypted network packets, comprising:

sending a configuration request over a network from a first computer to a second computer;

providing a temporary configuration password to the first computer;

encrypting, in accordance with the temporary configuration password, tunnel record information that includes a secret tunnel encryption key assigned to a tunnel between the first computer and the second computer; and

sending the tunnel record information over the network from the second computer to the first computer.

2. The method of claim 1, further comprising, before sending a configuration request over a network:

generating, on the second computer, the tunnel record information.

3. The method of claim 1, further comprising:

after receiving the tunnel record information from the second computer, sending a network packet over the network through a virtual tunnel , the network packet being encrypted in accordance with the secret tunnel encryption key in the tunnel record information corresponding to the virtual tunnel.

4. The method of claim 1, wherein the second computer comprises a firewall computer.

5. The method of claim 1, wherein the network comprises a public network.

6. A method for updating a tunnel record, comprising:

sending a connection request from a first computer to a second computer;

authenticating the first computer; and

updating a tunnel record corresponding to the connection request with the first computer'"'"'s network address.

7. The method of claim 6, wherein authenticating includes:

identifying the first computer.

8. The method of claim 7, wherein authenticating further includes:

prompting the first computer for an authorization code.

9. A method for enabling computers to communicate using encrypted network packets, comprising:

generating a temporary configuration password on a firewall computer;

sending a configuration request over a public network from a second computer to the firewall computer;

sending tunnel record information that includes a tunnel encryption key over the public network from the firewall computer to the second computer, the tunnel record information being encrypted in accordance with the temporary configuration password; and

deleting the temporary configuration password on the firewall computer.