Systems and methods for secure network communication

Patent metadata

Field	Value
Publication number	US-10476910-B2
Application number	US-201715629396-A
Country	US
Kind code	B2
Filing date	Jun 21, 2017
Priority date	Jun 21, 2017
Publication date	Nov 12, 2019
Grant date	Nov 12, 2019

Abstract

A system for secure network communications is provided. The system includes an enforcement switch in communication with a third-party device and an external device and a plurality of core devices in communication with the third-party device and a plurality of access devices. The enforcement switch is configured to receive a secure frame from the external device. The secure frame includes one or more security features. The secure frame is destined for one or more of the plurality of access devices. The enforcement switch is also configured to generate a regular frame based on the secure frame by removing the one or more security features and transmit the regular frame to the third-party device for routing to the one or more of the plurality of access devices through at least one of the plurality of core devices.

First claim

What is claimed is:

1. A system for secure and efficient network communications within a wide area network (WAN) comprising:
an enforcement switch in communication with a third-party device and a WAN router, the WAN router in communication with an external device, wherein the external device is located remotely from the enforcement switch and is external to the WAN and wherein the third-party device is a WAN optimizer and is unable to process secure frames; and
a plurality of core devices in communication with the third-party device and a plurality of access devices, wherein each access device of the plurality of access devices is configured to receive the secure frames and deliver the secure frames to end users using the plurality of access devices,
wherein the enforcement switch is configured to:
receive a secure frame from the external device via the WAN router, wherein the secure frame includes one or more security features and wherein the secure frame is destined for one or more of the plurality of access devices;
generate a regular frame based on the secure frame in response to determining that the secure frame complies with a security policy, wherein the regular frame is generated by removing the one or more security features; and
transmit the regular frame to the third-party device, wherein the third-party device is configured to: (i) determine optimal routing of the regular frame to the one or more of the plurality of access devices by identifying one or more core devices of the at least one of the plurality of core devices and (ii) transmit the regular frame to the identified one or more core devices of the at least one of the plurality of core devices.

2. A system in accordance with claim 1 , wherein each core device of the plurality of core devices is configured to:
receive the regular frame from the third-party device;
generate a re-secured frame based on the regular frame, wherein the re-secured frame is generated by adding the one or more security features; and
transmit the re-secured frame to the one or more of the plurality of access devices.

3. A system in accordance with claim 2 , wherein each core device stores a security policy, and wherein the core device is configured to:
determine the one or more security features for the re-secured frame based on the security policy; and
generate the re-secured frame based on the regular frame and the one or more security features.

4. A system in accordance with claim 2 , wherein the core device is further configured to route the re-secured frame to the one or more of the plurality of access devices through one or more distribution devices.

5. A system in accordance with claim 1 , wherein the enforcement switch stores the security policy, and wherein the enforcement switch is programmed to:
if the determination is that the secure frame complies with the security policy, decode and transmit the secure frame; and
if the determination is that the secure frame does not comply with the security policy, drop the secure frame and prevent further transmission of the secure frame.

6. A system in accordance with claim 1 , wherein the plurality of core devices and the plurality of access devices form a wide area network (WAN) network.

7. An enforcement switch in communication with a third-party device and a wide area network (WAN) router for assuring secure and efficient network communications within a wide area network, wherein the WAN router in communication with an external device that is located in a remote location from the enforcement switch and is external to the WAN and wherein the third-party device is a WAN optimizer and is unable to process secure frames, and wherein the enforcement switch is configured to:
receive a secure frame from the external device via the WAN router, wherein the secure frame includes one or more security features and wherein the secure frame is destined for one or more of a plurality of access devices;
determine whether the secure frame complies with a security policy;
if the determination is that the secure frame complies, decode and transmit the secure frame; and
if the determination is that the secure frame does not comply, drop the secure frame and prevent further transmission of the secure frame;
if the determination is that the secure frame complies, enforcement switch is configured to:
generate a regular frame based on the secure frame, wherein the regular frame is generated by removing the one or more security features; and
transmit the regular frame to the third-party device, wherein the third-party device is configured to determine optimal routing of the regular frame to the one or more of the plurality of access devices by identifying one or more core devices and transmitting the regular frame to the identified one or more core devices.

8. A computer implemented method for secure and efficient network communications within a wide area network (WAN), said method implemented on an enforcement switch in communication with a third-party device and a WAN router, the WAN router in communication with an external device, wherein the external device is located remotely from the enforcement switch and is external to the WAN and wherein the third-party device is a WAN optimizer and is unable to process secure frames, said method comprising:
receiving a secure frame from the external device via the WAN router, wherein the secure frame includes one or more security features and wherein the secure frame is destined for one or more of a plurality of access devices, wherein each access device of the plurality of access devices is configured to receive the secure frames and deliver the secure frames to end users of the plurality of access devices;
generating, by the enforcement switch, a regular frame based on the secure frame in response to determining that the secure frame complies with a security policy, wherein the regular frame is generated by removing the one or more security features; and
transmitting, by the enforcement switch, the regular frame to the third-party device, wherein the third- party device is configured to: (i) determine optimal routing of the regular frame to the one or more of the plurality of access devices by identifying one or more core devices of at least one of a plurality of core devices and (ii) transmit the regular frame to the identified one or more core devices of the at least one of a plurality of core devices.

9. A method in accordance with claim 8 further comprising:
receiving the regular frame from the third-party device;
generating a re-secured frame based on the regular frame, wherein the re-secured frame is generated by adding the one or more security features; and
transmitting the re-secured frame to the one or more of the plurality of access devices.

10. A method in accordance with claim 9 further comprising:
determining the one or more security features for the re-secured frame based on a security policy; and
generating the re-secured frame based on the regular frame and the one or more security features.

11. A method in accordance with claim 8 , wherein the enforcement switch stores the security policy, and wherein determining that the secure frame complies with the security policy further comprises:
if the determination is that the secure frame complies with the security policy, decoding and transmitting the secure frame; and
if the determination is that the secure frame does not comply with the security policy, dropping the secure frame and prevent further transmission of the secure frame, and the method further comprising routing the secure frame to the one or more of the plurality of access devices through the one or more core devices of

Assignees

• Mastercard International Inc

Inventors

• Spillman Gregory T

Classifications

• H04L12/4633

  Interconnection of networks using encapsulation techniques, e.g. tunneling · CPC title

• H04L63/12

  Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32) · CPC title

• H04L63/104

  Grouping of entities · CPC title

• H04L63/02

  for separating internal from external traffic, e.g. firewalls · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title