Negotiation of security protocols and protocol attributes in secure communications environment

Patent metadata

Field	Value
Publication number	US-10454890-B2
Application number	US-201314042239-A
Country	US
Kind code	B2
Filing date	Sep 30, 2013
Priority date	Jan 31, 2005
Publication date	Oct 22, 2019
Grant date	Oct 22, 2019

Abstract

Methods of communicatively connecting first and second endpoints are disclosed. One method includes transmitting from a first endpoint to a second endpoint a connection request, the connection request including an IP address of the second endpoint. The method further includes, based at least in part on the IP address of the second endpoint, selecting IPsec from among a plurality of available security protocols to first attempt to use in forming a tunnel between the first and second endpoints, and forming the tunnel between the first and second endpoints based on the connection request.

First claim

The invention claimed is:

1. A method of communicatively connecting first and second computing system endpoints, the method comprising:
transmitting, from a first computing system endpoint, to a second computing system endpoint a connection request that includes an IP address of the second computing system endpoint, the connection request including an encryption key, in which the second computing system endpoint is a member of a community of interest, each member of the community of interest is a client of the first computing system endpoint;
receiving, at the first computing system endpoint, from the second computing system endpoint a responding request that includes a validation key, wherein the validation key matches with the encryption key authenticating the second computing system endpoint, the validation key being common among the members of the community of interest;
based at least in part on the IP address of the second computing system endpoint, selecting by the first computing system endpoint, an IPsec security protocol from among a plurality of security protocols concurrently available at the first computing system endpoint to first attempt to use in forming a tunnel between the first and second computing system endpoints; and
forming the tunnel between the first and second computing system endpoints based on the connection request.

2. The method of claim 1 , wherein forming the tunnel comprises forming the tunnel using the IPsec protocol.

3. The method of claim 2 , wherein the first computing system endpoint comprises a computing system having an operating system supporting a native IPsec implementation.

4. The method of claim 3 , wherein the second computing system endpoint comprises a computing system having an operating system supporting a native IPsec implementation.

5. The method of claim 2 , wherein the tunnel is formed based on one or more attributes set at a user-level protocol service, the one or more attributes comprising IPsec attributes selected from a group of IPsec attributes consisting of:
encryption type;
authentication mechanism;
Elliptic Curve cryptography; and
IKE version.

6. The method of claim 1 , wherein the second computing system endpoint has an IPv6 address.

7. The method of claim 1 , wherein the second computing system endpoint has an IPv4 address.

8. The method of claim 7 , wherein, upon determining that the first computing system endpoint does not support IPsec, forming the tunnel using a second security protocol from among the plurality of available security protocols.

9. The method of claim 8 , wherein the second security protocol comprises the SecureParser proprietary security protocol.

10. A method of communicatively connecting computing system endpoints in a network, the method comprising:
selecting an IPsec security protocol from among a plurality of security protocols available at the first computing system endpoint, wherein selecting the IPsec security protocol is based at least in part on an IP address of a second computing system endpoint;
transmitting from a first computing system endpoint to the second computing system endpoint a connection request that includes an identification of the IPsec security protocol selected based on an IP address of the second computing system endpoint, the connection request including an encryption key, in which the second computing system endpoint is a member of a community of interest, each member of the community of interest is a client of the first computing system endpoint;
receiving, at the first computing system endpoint, from the second computing system endpoint a responding request that includes a validation key, wherein the validation key matches with the encryption key authenticating the second computing system endpoint, the validation key being common among the members of the community of interest;
forming an IPsec-based tunnel between the first and second computing system endpoints;
selecting, by the first computing endpoint, an IPsec security protocol from among a plurality of security protocols concurrently available at the first computing system endpoint, wherein selecting the IPsec security protocol is based at least in part on an IP address of a third computing system endpoint;
receiving an indication from the third computing system endpoint that the third computing system endpoint does not natively support the IPsec security protocol;
forming a second tunnel between the first and third computing system endpoints, wherein the second tunnel uses a second security protocol other than the IPsec security protocol.

11. The method of claim 10 , wherein the IP address of the second computing system endpoint is an IPv6 address.

12. The method of claim 10 , wherein the IP address of the third computing system endpoint is an IPv4 address.

13. The method of claim 12 , wherein the second security protocol comprises the SecureParser proprietary security protocol.

14. The method of claim 10 , further comprising opening a tunnel between the first computing system endpoint and a security appliance, the tunnel between the first computing system endpoint and the security appliance uses the second security protocol.

15. The method of claim 10 , wherein the IPsec-based tunnel is formed based on one or more attributes set at a user-level protocol service, the one or more attributes comprising IPsec attributes selected from a group of IPsec attributes consisting of:
encryption type;
authentication mechanism;
elliptic Curve cryptography; and
IKE version.

16. The method of claim 10 , wherein the second computing system endpoint comprises a computing system having a first operating system that natively supports the IPsec security protocol and the third computing system endpoint comprises a computing system having a second operating system different from the first operating system and that lacks native IPsec support.

17. The method of claim 16 , wherein the first operating system and the second operating system are provided by different operating system developers.

18. The method of claim 16 , wherein the first operating system and the second operating system are different operating system versions provided by the same operating system developer.

19. A non-transitory computer-readable storage device comprising computer-executable instructions stored thereon which, when executed, cause a computing system to perform a method of communicatively connecting to a remote computing system endpoint, the method comprising:
transmitting to a remote computing system endpoint a connection request that includes an IP address of the remote computing system endpoint, the connection request including an encryption key, in which the remote computing system endpoint is a member of a community of interest, each member of the community of interest is a client of the computing system;
receiving from the remote computing system endpoint a responding request that includes a validation key, wherein the validation key matches with the encryption key authenticating the remote computing system endpoint, the validation key being common among the members of the community of interest;
based at least in part on the IP address of the remote computing system endpoint, selecting by the first computing system endpoint, an IPsec security protocol from among a plurality of security protocols concurrently available at the first endpoint to first attempt to use in forming a tunnel between the computing system and the remote computing system endpoint; and
forming the tunnel between the

Assignees

• Johnson Robert A
• Wild Kathleen
• Inforzato Sarah K
• Hinaman Ted
• Unisys Corp

Inventors

• Johnson Robert A
• Wild Kathleen
• Inforzato Sarah K
• Hinaman Ted

Classifications

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• G06F21/00

  Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity · CPC title

• H04L63/0485

  Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up · CPC title

• H04L63/0236

  Filtering by address, protocol, port number or service, e.g. IP-address or URL · CPC title

• H04L63/164

  at the network layer · CPC title