Providing internet protocol (IP) security

• US 6,928,553 B2
• Filed: 09/18/2001
• Issued: 08/09/2005
• Est. Priority Date: 09/18/2001
• Status: Expired due to Term

• Current Assignee: Mitel Networks Corporation
• Original Assignee: Aastra Technologies Limited (Mitel Networks Corporation)
• Inventors: Freedman, Jerome, Xiong, Jize
• Primary Examiner(s): Song, Hosuk
• Application Number:
  US09/954,955
• Publication Number:
  US 20030061507A1
• Time in Patent Office: 1,421 Days
• Field of Search: 713150-154, 713160-162, 713/166, 713/168, 713/170, 713200-201, 711/100, 711/118, 711/126, 711/163, 709/200, 709/217, 709/219, 707/1, 707/3, 707/9, 707/10
• US Class Current: 726/8
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method of providing Internet Protocol (IP) security at a network layer, that includes using two or more independent databases to process secure information, with a first database specifying a set of rules for the IP security and a level of security, and with a second database maintaining security information for at least two systems.

Claims

1. A method of providing Internet Protocol (IP) security at a network layer, the method comprising:

using two or more independent databases to process secure information, with a first database specifying rules for the IP security and a level of security, and with a second database maintaining security information for at least two systems, by;

determining if a selector matches an entry in the first database for processing an outbound IP packet; and

assembling an index into the second database and using the index to perform a lookup in the second database for processing an inbound IP packet.

2. The method of claim 1, wherein the first database includes security policy entries.

3. The method of claim 2, wherein the security policy entries include a source IP address, a destination IP address, an IP protocol, a source port, and/or a destination port.

4. The method of claim 2, wherein the first database uses a Practical Algorithm to Retrieve Information coded in Alphanumeric (PATRICIA) tree to look-up security policy entries.

5. The method of claim 1, wherein the first database is cached.

6. The method of claim 1, wherein the second database includes security association entries.

7. The method of claim 6, wherein each security association defines one or more parameters required for the IP security.

8. The method of claim 6, wherein a hash table is used to look-up security association entries.

9. The method of claim 7, wherein the one or more parameters include an IP destination, an IP security protocol, and a security parameter index.

10. The method of claim 9, wherein the IP security protocol is in an authentication header format.

25. The method of claim 8, further comprising using the IP destination, the IP security protocol and the security parameter index as a hash key in a hash table lookup for a security association.

26. The method of claim 25, further comprising selecting a prime number.

27. The method of claim 26, wherein selecting comprises selecting ‘

389’

.

28. The method of claim 4, wherein the PATRICIA tree includes nodes and each node comprises a rule for the IP security and an index into the second database.

11. An apparatus for transmitting data packets, comprising:

a processor that executes the instructions; and

a memory that stores executable instructions for causing the processor to;

use two or more independent databases to process secure information;

a first database specifying rules for the IP security and a level of security; and

a second database maintaining security information for at least two systems, by;

determining if a selector matches an entry in the first database for processing an outbound IP packet; and

assembling an index into the second database and using the index to perform a lookup in the second database for processing an inbound IP packet.

12. The apparatus of claim 11, wherein the first database includes security policy entries.

13. The apparatus of claim 12, wherein the security policy entries include a source IP address, a destination IP address, an IP protocol, a source port, and/or a destination port.

14. The apparatus of claim 12, wherein the first database uses a Practical Algorithm to Retrieve Information coded in Alphanumeric (PATRICIA) tree to look-up security policy entries.

15. The method of claim 11, wherein the first database is cached.

16. The apparatus of claim 11, wherein the second database includes security association entries.

17. The apparatus of claim 16, wherein each security association defines one or more parameters required for the IP security.

18. The apparatus of claim 17, wherein the one or more parameters include an IP destination, an IP security protocol, and a security parameter index.

19. The apparatus of claim 16, wherein a hash table is used to look-up security association entries.

20. The apparatus of claim 18, wherein the IP security protocol is in an authentication header format.

21. The apparatus of claim 18, further comprising executable instructions to use the IP destination, the IP security protocol and the security parameter index as a hash key in a hash table lookup for a security association.

22. The apparatus of claim 21, further comprising executable instructions to select a prime number.

23. The apparatus of claim 22, wherein to select comprises to select ‘

389’

.

24. The apparatus of claim 14, wherein the PATRICIA tree includes nodes and each node comprises a rule for the IP security and an index into the second database.