Method and system for including network security information in a frame

US 7,721,323 B2
Filed: 11/23/2004
Issued: 05/18/2010
Est. Priority Date: 11/23/2004
Status: Active Grant

First Claim

Patent Images

1. A method comprising:

determining network security information, whereinthe network security information is configured to facilitate network security of a network by virtue of the network security information comprising authorization information for a frame in the network;

including the network security information in a first portion of the frame, whereinthe first portion is within a secure portion of an overhead portion of the frame, andthe frame is configured to be communicated over the network;

determining frame security information using a processor, whereinthe frame security information is configured to facilitate security of the secure portion of the overhead portion of the frame by preventing access to the secure portion of the overhead portion of the frame; and

including the frame security information in a second portion of the frame, whereinthe first portion and the second portion of the frame are exclusive of one another.

View all claims

1 Assignment

Timeline View

Assignment View

0 Petitions

Accused Products

Abstract

A method and apparatus for including network security information in a frame is disclosed. Network security information is included in a secure portion of overhead of a frame. The network security information is configured to facilitate network security. A network device configured to process a frame is also disclosed. The frame includes frame security information and network security information. The frame security information is configured to facilitate securing a portion of overhead of the frame, and the network security information is located in the secure portion of the overhead of the frame and is configured to facilitate network security.

59 Citations

View as Search Results

64 Claims

1. A method comprising:
- determining network security information, whereinthe network security information is configured to facilitate network security of a network by virtue of the network security information comprising authorization information for a frame in the network;
  
  including the network security information in a first portion of the frame, whereinthe first portion is within a secure portion of an overhead portion of the frame, andthe frame is configured to be communicated over the network;
  
  determining frame security information using a processor, whereinthe frame security information is configured to facilitate security of the secure portion of the overhead portion of the frame by preventing access to the secure portion of the overhead portion of the frame; and
  
  including the frame security information in a second portion of the frame, whereinthe first portion and the second portion of the frame are exclusive of one another.
- View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14)
- - 2. The method of claim 1, whereinthe overhead portion of the frame includes the frame security information.
  - 3. The method of claim 2, whereinthe frame security information comprises at least one of:
    - integrity check information, andencryption information.
  - 4. The method of claim 3, whereinthe network security information comprises a user group identifier.
  - 5. The method of claim 3, whereinthe network security information comprises a security association field, andthe security association field is associated with a user group identifier.
  - 6. The method of claim 1, further comprising:
    - including the frame security information in a header of the frame.
  - 7. The method of claim 6, further comprising:
    - including a frame type field in the header of the frame, whereinthe frame type field indicates the frame includes the network security information.
  - 8. The method of claim 6, further comprising:
    - including the network security information at an end of the header of the frame.
  - 9. The method of claim 6, further comprising:
    - including the network security information in the header of the frame; and
      
      including a header length field in the header of the frame, whereina value of the header length field indicates a length of the header of the frame.
  - 10. The method of claim 6, whereinthe header of the frame is a media access control security (MACSec) header.
  - 11. The method of claim 10, whereinthe overhead of the frame comprises a multi-protocol label switching (MPLS) label, andthe MPLS label comprises the network security information.
  - 12. The method of claim 10, whereinthe overhead of the frame comprises an 802.1q tag,the 802.1q tag comprises a virtual local area network (VLAN) identifier, andthe VLAN identifier comprises the network security information.
  - 13. The method of claim 10, whereinthe overhead of the frame comprises a security header,the security header comprises a security label, andthe security label comprises the network security information.
  - 14. The method of claim 13, whereinthe security header is an 802.10 header.

15. An apparatus comprising:
- means for determining network security information, whereinthe network security information is configured to facilitate network security of a network by virtue of the network security information comprising authorization information for a frame in the network;
  
  means for including the network security information in a first portion of the frame, whereinthe first portion is within a secure portion of an overhead portion of the frame, andthe frame is configured to be communicated over the network;
  
  means for determining frame security information, whereinthe frame security information is configured to facilitate security of the secure portion of the overhead portion of the frame by preventing access to the secure portion of the overhead portion of the frame; and
  
  means for including the frame security information in a second portion of the frame, whereinthe first portion and the second portion of the frame are exclusive of one another.
- View Dependent Claims (16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28)
- - 16. The apparatus of claim 15, wherein the overhead portion of the frame includes the frame security information.
  - 17. The apparatus of claim 16, whereinthe frame security information comprises at least one of:
    - integrity check information, andencryption information.
  - 18. The apparatus of claim 17, whereinthe network security information comprises a user group identifier.
  - 19. The apparatus of claim 17, whereinthe network security information comprises a security association field, andthe security association field is associated with a user group identifier.
  - 20. The apparatus of claim 16, further comprising:
    - means for including the frame security information in a header of the frame.
  - 21. The apparatus of claim 20, further comprising:
    - means for including a frame type field in the header of the frame, whereinthe frame type field indicates the frame includes the network security information.
  - 22. The apparatus of claim 20, further comprising:
    - means for including the network security information at an end of the header of the frame.
  - 23. The apparatus of claim 20, further comprising:
    - means for including the network security information in the header of the frame; and
      
      means for including a header length field in the header of the frame, whereina value of the header length field indicates a length of the header of the frame.
  - 24. The apparatus of claim 20, whereinthe header of the frame is a media access control security (MACSec) header.
  - 25. The apparatus of claim 24, whereinthe overhead of the frame comprises a multi-protocol label switching (MPLS) label, andthe MPLS label comprises the network security information.
  - 26. The apparatus of claim 24, whereinthe overhead of the frame comprises an 802.1q tag,the 802.1q tag comprises a virtual local area network (VLAN) identifier, andthe VLAN identifier comprises the network security information.
  - 27. The apparatus of claim 24, whereinthe overhead of the frame comprises a security header,the security header comprises a security label, andthe security label comprises the network security information.
  - 28. The apparatus of claim 27, whereinthe security header is an 802.10 header.

29. A computer program product, comprising:
- a first set of instructions, executable on a computer system, configured to determine network security information, whereinthe network security information is configured to facilitate network security of a network by virtue of the network security information comprising authorization information for a frame in the network;
  
  a second set of instructions, executable on the computer system, configured to include the network security information in a first portion of the frame, whereinthe first portion is within a secure portion of an overhead portion of the frame, andthe frame is configured to be communicated over the network;
  
  a third set of instructions, executable on the computer system, configured to determine frame security information, whereinthe frame security information is configured to facilitate security of the secure portion of the overhead portion of the frame by preventing access to the secure portion of the overhead portion of the frame;
  
  a fourth set of instructions, executable on the computer system, configured to include the frame security information in a second portion of the frame, whereinthe first portion and the second portion of the frame are exclusive of one another; and
  
  computer readable storage media, wherein the computer program product is encoded in the computer readable storage media.
- View Dependent Claims (30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42)
- - 30. The computer program product of claim 29, whereinthe overhead portion of the frame includes the frame security information.
  - 31. The computer program product of claim 30, whereinthe frame security information comprises at least one of:
    - integrity check information, andencryption information.
  - 32. The computer program product of claim 31, whereinthe network security information comprises a user group identifier.
  - 33. The computer program product of claim 31, whereinthe network security information comprises a security association field, andthe security association field is associated with a user group identifier.
  - 34. The computer program product of claim 30, further comprising:
    - a fifth set of instructions, executable on the computer system, configured to include the frame security information in a header of the frame.
  - 35. The computer program product of claim 34, further comprising:
    - a sixth set of instructions, executable on the computer system, configured toinclude a frame type field in the header of the frame, whereinthe frame type field indicates the frame includes the network security information.
  - 36. The computer program product of claim 34, further comprising:
    - a sixth set of instructions, executable on the computer system, configured toinclude the network security information at an end of the header of the frame.
  - 37. The computer program product of claim 34, further comprising:
    - a sixth set of instructions, executable on the computer system, configured to include the network security information in the header of the frame; and
      
      a seventh set of instructions, executable on the computer system, configured to include a header length field in the header of the frame, whereina value of the header length field indicates a length of the header of the frame.
  - 38. The computer program product of claim 34, whereinthe header of the frame is a media access control security (MACSec) header
  - 39. The computer program product of claim 38, whereinthe overhead of the frame comprises a multi-protocol label switching (MPLS) label, andthe MPLS label comprises the network security information.
  - 40. The computer program product of claim 38, whereinthe overhead of the frame comprises an 802.1q tag,the 802.1q tag comprises a virtual local area network (VLAN) identifier, andthe VLAN identifier comprises the network security information.
  - 41. The computer program product of claim 38, whereinthe overhead of the frame comprises a security header,the security header comprises a security label, andthe security label comprises the network security information.
  - 42. The computer program product of claim 41, whereinthe security header is an 802.10 header.

43. An apparatus comprising:
- a network device configured to process a frame, whereinthe frame comprises;
  
  frame security information, whereinthe frame security information is included in a first portion of the frame, andthe frame security information is configured to facilitate security of a secure portion of an overhead portion of the frame by preventing access to the secure portion of the overhead portion of the frame, andnetwork security information, whereinthe network security information is included in a second portion of the frame, wherein
  
  the frame is configured to be communicated over a network,
  
  the network security information is configured to facilitate network security of the network by virtue of the network security information comprising authorization information for the frame in the network,
  
  the second portion is within the secure portion of the overhead portion of the frame, and
  
  the first portion and the second portion of the frame are exclusive of one another.
- View Dependent Claims (44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54)
- - 44. The apparatus of claim 43, whereinthe frame security information comprises at least one of:
    - integrity check information, andencryption information.
  - 45. The apparatus of claim 44, whereinthe network security information comprises a user group identifier.
  - 46. The apparatus of claim 44, whereinthe network security information comprises a security association field, andthe security association field is associated with a user group identifier.
  - 47. The apparatus of claim 43, whereina header of the frame comprises the frame security information.
  - 48. The apparatus of claim 47, whereinthe header of the frame comprises a frame type field, andthe frame type field indicates the frame includes the network security information.
  - 49. The apparatus of claim 47, whereinan end of the header of the frame comprises the network security information.
  - 50. The apparatus of claim 47, whereinthe header of the frame comprises:
    - the network security information, anda header length field in the header of the frame, whereina value of the header length field indicates a length of the header of the frame.
  - 51. The apparatus of claim 47, whereinthe header of the frame is a media access control security (MACSec) header.
  - 52. The apparatus of claim 51, whereinthe overhead of the frame comprises a multi-protocol label switching (MPLS) label, andthe MPLS label comprises the network security information.
  - 53. The apparatus of claim 51, whereinthe overhead of the frame comprises an 802.1q tag,the 802.1q tag comprises a virtual local area network (VLAN) identifier, andthe VLAN identifier comprises the network security information.
  - 54. The apparatus of claim 51, whereinthe overhead of the frame comprises an 802.10 header,the 802.10 header comprises a security label, andthe security label comprises the network security information.

55. A method comprising:
- obtaining a user group identifier, whereinthe user group identifier is configured to facilitate network security of a network by virtue of the user group identifier comprising authorization information for a frame in the network;
  
  including the user group identifier in a first portion of the frame, whereinthe user group identifier is further configured to facilitate network security by identifying a security group of a source of the frame,the first portion is within a secure portion of an overhead portion of the frame, andthe frame is configured to be communicated over the network;
  
  determining frame security information using a processor, whereinthe frame security information is configured to facilitate security of the secure portion of the overhead portion of the frame by preventing access to the secure portion of the overhead portion of the frame; and
  
  including the frame security information in a second portion of the frame, whereinthe first portion and the second portion of the frame are exclusive of one another.
- View Dependent Claims (56, 57, 58, 59)
- - 56. The method of claim 55, whereinthe user group identifier is included at an end of a header of the frame.
  - 57. The method of claim 55, whereinthe overhead portion of the frame comprises:
    - a source address,a destination address, andat least one of;
      
      integrity check information, andencryption information.
  - 58. The method of claim 57, further comprising:
    - including a frame type field in the overhead portion of the frame, whereinthe frame type field indicates the frame includes the user group identifier.
  - 59. The method of claim 57, further comprising:
    - including the user group identifier in a header of the frame; and
      
      including a header length field in the header of the frame, whereina value of the header length field indicates a length of the header of the frame.

60. An apparatus comprising:
- a network device configured to process a frame comprising frame overhead, whereinthe frame overhead comprisesframe security information in a first portion of the frame overhead,a source address,a destination address, anda user group identifier in a second portion of the frame overhead, whereinthe user group identifier is configured to facilitate network security of a network by virtue of the user group identifier comprising authorization information for the frame in the network,the user group identifier is further configured to facilitate network security by identifying a security group of a source of the frame,the second portion is within a secure portion of the frame overhead,the first portion and the second portion of the frame are exclusive of each other,the frame is configured to be communicated over the network, andthe frame security information is configured to facilitate security of a secure portion of the frame overhead by preventing access to the secure portion of the frame overhead.
- View Dependent Claims (61, 62, 63, 64)
- - 61. The apparatus of claim 60, whereinthe frame overhead further comprises a frame header, andthe user group identifier is included at an end of the frame header.
  - 62. The apparatus of claim 60, whereinthe frame overhead further comprises at least one of:
    - integrity check information, andencryption information.
  - 63. The apparatus of claim 62, whereinthe frame overhead further comprises a frame type field, whereinthe frame type field indicates the frame includes the user group identifier.
  - 64. The apparatus of claim 60, further comprising:
    - including the user group identifier in a header of the frame; and
      
      including a header length field in the header of the frame, whereina value of the header length field indicates a length of the header of the frame.

Specification

Resources

Litigation Campaign Assessment

Current Assignee
Cisco Technology, Inc. (Cisco Systems, Inc.)
Original Assignee
Cisco Technology, Inc. (Cisco Systems, Inc.)
Inventors
Smith, Michael R., Finn, Norman W.
Primary Examiner(s)
Zand; Kambiz
Assistant Examiner(s)
TABOR, AMARE F

Application Number

US10/996,101
Publication Number

US 20060112431A1
Time in Patent Office

2,002 Days
Field of Search

726/3, 726/22
US Class Current

726/3
CPC Class Codes

H04L 63/08 for authentication of entit...

H04L 63/104 Grouping of entities

Method and system for including network security information in a frame

First Claim

1 Assignment

0 Petitions

Accused Products

Abstract

59 Citations

64 Claims

Specification

Solutions

Use Cases

Quick Links

Method and system for including network security information in a frame

First Claim

1 Assignment

Subscription Required

Subscription Required

0 Petitions

Subscription Required

Accused Products

Subscription Required

Abstract

59 Citations

64 Claims

Specification

Subscription Required

Solutions

Use Cases

Quick Links