Authenticated group context in transitive IP network domains

Patent metadata

Field	Value
Publication number	US-10104050-B2
Application number	US-201615146695-A
Country	US
Kind code	B2
Filing date	May 4, 2016
Priority date	May 4, 2016
Publication date	Oct 16, 2018
Grant date	Oct 16, 2018

Abstract

A method is provided in one example embodiment and includes receiving at a node of a transitive IP network a data packet including a Network Services Header (“NSH”); accessing by the transitive IP network node context contained in the NSH, wherein the context may be used by the transitive IP network node to perform an enhanced network service in connection with the received data packet; performing by the transitive IP network node the enhanced network service in connection with the received data packet using the accessed context; and, subsequent to the performing, forwarding the received packet to a next node.

First claim

What is claimed is:

1. A method comprising:
at a node of a transitive Internet Protocol (IP) network, the node being associated with a first security group of multiple security groups:
receiving a data packet that includes a Network Services Header (“NSH”) appended thereto after the data packet is encrypted and/or encapsulated in a tunnel header, wherein a subset of multiple context fields of the NSH is associated with the first security group;
accessing context contained in the NSH by performing one or more of decrypting and authenticating the subset of context fields associated with the first security group;
performing a network service in connection with the received data packet using the accessed context; and
forwarding the received packet to a next node subsequent to the performing.

2. The method of claim 1 , wherein the accessing further comprises:
obtaining key material from an Authentication and Authorization (“AA”) server; and
decrypting the subset of context fields using the key material.

3. The method of claim 1 , further comprising reencrypting the subset of context fields prior to the forwarding.

4. The method of claim 2 , wherein the accessing further comprises authenticating the subset of context fields using the key material obtained from the AA server.

5. The method of claim 1 , wherein the network service comprises at least one of,
Virtual Private Network (“VPN”) segmentation,
Quality of Service (“QoS”) prioritization,
whitelisting,
blacklisting, caching,
video compression, and
security threat analysis.

6. The method of claim 1 further comprising, prior to the accessing, determining whether the transitive IP network node is a member of a security group authorized to access the context.

7. One or more non-transitory computer readable media encoded with a computer program that includes instructions to cause a processor of a node of a transitive Internet Protocol (IP) network that is associated with a first security group of multiple security groups, to:
receive a data packet that includes a Network Services Header (“NSH”) appended thereto after the data packet is encrypted and/or encapsulated in a tunnel header, wherein a subset of multiple context fields of the NSH is associated with the first security group;
access context contained in the NSH by performing one or more of decrypting and authenticating the subset of context fields associated with the first security group;
perform a network service in connection with the received data packet using the accessed context; and
forward the received packet to a next node subsequent to performance of the network service.

8. The media of claim 7 , further including instructions to cause the processor to:
obtain key material from an Authentication and Authorization (“AA”) server, and
decrypt the field of the NSH using the key material.

9. The media of claim 7 , further including instructions to cause the processor to:
reencrypt the context prior to forwarding the received data packet to the next node.

10. The media of claim 8 , further including instructions to cause the processor to:
authenticate the subset of context fields using the key material obtained from the AA server.

11. The media of claim 7 , wherein the network service comprises at least one of,
Virtual Private Network (“VPN”) segmentation,
Quality of Service (“QoS”) prioritization,
whitelisting,
blacklisting,
caching,
video compression, and
security threat analysis.

12. The media of claim 7 , further including instructions to cause the processor to;
determine whether the transitive IP network node is a member of a security group authorized to access the context.

13. An apparatus configured to operate as a node in a transitive Internet Protocol (IP) network, the node associated with a first security group of multiple security groups, the apparatus comprising:
a memory element configured to store data;
a processor operable to execute instructions associated with the data; and
a context decryption module configured to:
receive a data packet that includes a Network Services Header (“NSH”) appended thereto after the data packet is encrypted and/or encapsulated in a tunnel header, wherein a subset of multiple context fields of the NSH is associated with the first security group;
access context contained in the NSH by performing one or more of decrypting and authenticating the subset of context fields associated with the first security group;
perform a network service in connection with the received data packet using the accessed context; and
forward the received packet to a next node subsequent to performance of the network service.

14. The apparatus of claim 13 , wherein the context decryption module is further configured to:
obtain key material from an Authentication and Authorization (“AA”) server; and
decrypt the subset of context fields using the key material.

15. The apparatus of claim 14 , wherein the context decryption module is further configured to:
authenticate the subset of context fields using the key material obtained from the AA server.

16. The apparatus of claim 13 , wherein the network service comprises at least one of,
Virtual Private Network (“VPN”) segmentation,
Quality of Service (“QoS”) prioritization,
whitelisting,
blacklisting,
caching,
video compression, and
security threat analysis.

17. The apparatus of claim 13 , wherein the context decryption module is further configured to:
determine whether the node is a member of a security group authorized to access the context.

18. The apparatus of claim 13 , wherein the context decryption module is further configured to:
reencrypt the context prior to forwarding the received data packet to the next node.

19. The method of claim 1 , further comprising the node implementing a first Virtual Private Networking (VPN) method and the next node implementing a second VPN method, and wherein the first VPN method is different from the second VPN method.

20. The media of claim 7 , wherein the node is configured to implement a first Virtual Private Networking (VPN) method and the next node is configured to implement a second VPN method, and wherein the first VPN method is different from the second VPN method.

Assignees

• Cisco Tech Inc

Inventors

• Wainner Warren Scott
• Weis Brian E
• Quinn Paul
• Fluhrer Scott Roy

Classifications

• H04L63/10

  for controlling access to devices or network resources · CPC title

• H04L63/0471 Primary

  applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding · CPC title

• H04L63/029

  Firewall traversal, e.g. tunnelling or, creating pinholes · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L67/42

  Electricity · mapped topic