Encryption key management of client devices and endpoints within a protected network

Patent metadata

Field	Value
Publication number	US-10785196-B2
Application number	US-201815913942-A
Country	US
Kind code	B2
Filing date	Mar 7, 2018
Priority date	Jan 22, 2018
Publication date	Sep 22, 2020
Grant date	Sep 22, 2020

Abstract

Disclosed are various examples for establishing encrypted channels or tunnels within a TCP or other communication session between a tunnel endpoint and tunnel client on a client device. A tunnel endpoint on the client device can determine an encryption key based upon whether a client device is in compliance with encryption policies of the enterprise.

First claim

What is claimed is:

1. A non-transitory computer-readable medium embodying at least one program executable in a tunnel endpoint, the tunnel endpoint providing a gateway to a software defined network, the at least one program, when executed by the tunnel endpoint, being configured to cause the tunnel endpoint to at least:
cause an encryption key to be deployed to a client device, wherein the client device is external to the software defined network and configured with a virtual private network (VPN) configuration from a management service with which the client device is enrolled as a managed device, the VPN configuration identifying the encryption key and an address of the tunnel endpoint;
cause the encryption key to be deployed to at least one endpoint internal to the software defined network, wherein the at least one endpoint uses the encryption key to encrypt communications within the software defined network and with the client device;
obtain a packet from the client device that is encrypted using the encryption key, the packet associated with an endpoint within the software defined network;
determine, based upon the packet encrypted using the encryption key, that the client device is non-compliant with at least one compliance rule based upon a packet header associated with the packet; and
cause revocation of the encryption key deployed to the client device by issuing a new encryption key to the at least one endpoint internal to the software defined network, wherein the at least one endpoint uses the new encryption key for communications within the software defined network and external to the software defined network.

2. The non-transitory computer-readable medium of claim 1 , wherein the at least one program further causes the tunnel endpoint to at least:
subsequently determine that the client device is compliant with the at least one compliance rule; and
issue the new encryption key to the client device.

3. The non-transitory computer-readable medium of claim 1 , wherein the at least one program determines that the client device is non-compliant based upon a geolocation of the client device, a network type associated with the client device, or a device posture determined from data embedded within the packet header.

4. The non-transitory computer-readable medium of claim 1 , wherein the tunnel endpoint causes revocation of the encryption key by issuing a third encryption key to the client device, wherein an encryption level associated with the third encryption key is stronger than the encryption key that is revoked.

5. The non-transitory computer-readable medium of claim 4 , wherein the tunnel endpoint causes revocation of the encryption key by causing the management service to issue a third encryption key to the client device, wherein the encryption level associated with the third encryption key is stronger than the encryption key that is revoked.

6. The non-transitory computer-readable medium of claim 1 , wherein the tunnel endpoint causes revocation of the encryption key by discarding subsequent packets received from the client device that are encrypted using the encryption key.

7. A system, comprising:
at least one computing device; and
an application executable by the at least one computing device, the application configured to cause the at least one computing device to at least:
cause an encryption key to be deployed to a client device, wherein the client device is external to a protected network and configured with a virtual private network (VPN) configuration from a management service with which the client device is enrolled as a managed device, the VPN configuration identifying the encryption key and an address of the tunnel endpoint;
cause the encryption key to be deployed to at least one endpoint internal to the protected network, wherein the at least one endpoint uses the encryption key to encrypt communications within the protected network and with the client device;
obtain a packet from the client device that is encrypted using the encryption key, the packet associated with an endpoint within the protected network;
determine, based upon the packet encrypted using the encryption key, that the client device is non-compliant with at least one compliance rule based upon a packet header associated with the packet; and
cause revocation of the encryption key deployed to the client device by issuing a new encryption key to the at least one endpoint internal to the protected network, wherein the at least one endpoint uses the new encryption key for communications within the protected network and external to the protected network.

8. The system of claim 7 , wherein the application causes the at least one computing device to at least:
subsequently determine that the client device is compliant with the at least one compliance rule; and
issue the new encryption key to the client device.

9. The system of claim 7 , wherein determining that the client device is non-compliant is based upon a geolocation of the client device, a network type associated with the client device, or a device posture determined from data embedded within the packet header.

10. The system of claim 7 , wherein the at least one computing device causes revocation of the encryption key by causing the management service to issue a third encryption key to the client device, and an encryption level associated with the third encryption key is stronger than the encryption key that is revoked.

11. The system of claim 7 , wherein the at least one computing device causes revocation of the encryption key by causing the management service to issue a third encryption key to the client device, and an encryption level associated with the third encryption key is stronger than the encryption key that is revoked.

12. The system of claim 7 , wherein the at least one computing device causes revocation of the encryption key by discarding subsequent packets received from the client device that are encrypted using the encryption key.

13. A method implemented in a at least one computing device comprising:
causing an encryption key to be deployed to a client device, wherein the client device is external to a protected network and configured with a virtual private network (VPN) configuration from a management service with which the client device is enrolled as a managed device, the VPN configuration identifying the encryption key and an address of the tunnel endpoint;
causing the encryption key to be deployed to at least one endpoint internal to the protected network, wherein the at least one endpoint uses the encryption key to encrypt communications within the protected network and with the client device;
obtaining a packet from the client device that is encrypted using the encryption key, the packet associated with an endpoint within the protected network;
determining, based upon the packet encrypted using the encryption key, that the client device is non-compliant with at least one compliance rule based upon a packet header associated with the packet; and
causing revocation of the encryption key deployed to the client device by issuing a new encryption key to the at least one endpoint internal to the protected network, wherein the at least one endpoint uses the new encryption key for communications within the protected network and external to the protected network.

14. The method of claim 13 , further comprising
subsequently determining that the client device is compliant with the at least one compliance rule; and
issuing the new encryption key to the client device.

15. The method of claim 13 , wherein determining that the client device is non-c

Assignees

• Vmware Inc

Inventors

• Panchapakesan Ramani
• Aluvala Suman
• Paramashivaiah Niranjan
• Kavatage Mahesh
• Rangain Pavan Rajkumar
• Newell Craig Farley

Classifications

• H04L63/108

  when the policy decisions are valid for a limited amount of time · CPC title

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• H04L63/06

  for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08) · CPC title

• H04L63/0272 Primary

  Virtual private networks · CPC title

• H04L63/107

  wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals · CPC title