Secure communication protocol processing

Patent metadata

Field	Value
Publication number	US-2019190891-A1
Application number	US-201715841297-A
Country	US
Kind code	A1
Filing date	Dec 14, 2017
Priority date	Dec 14, 2017
Publication date	Jun 20, 2019
Grant date	—

Abstract

Example methods are provided for secure communication protocol processing in a network environment. The method may comprise, in response to detecting a first transport protocol packet that is addressed from a first endpoint to a second endpoint and includes unencrypted payload data and a first sequence number, generating and sending a first secure communication protocol packet that includes encrypted payload data and a second sequence number. The method may also comprise, in response detecting a second transport protocol packet that includes the first sequence number, determining that the second transport protocol packet is a retransmission of the first transport protocol packet. The method may further comprise generating and sending a second secure communication protocol packet that includes the second sequence number associated with the first sequence number.

First claim

We claim:

1 . A method for a security agent to perform secure communication protocol processing in a network environment that includes the security agent, a first endpoint and a second endpoint, wherein the method comprises:
in response to detecting a first transport protocol packet that is addressed from the first endpoint to the second endpoint, and includes unencrypted payload data and a first sequence number,
based on the first transport protocol packet, generating and sending a first secure communication protocol packet that includes encrypted payload data and a second sequence number;
storing mapping data that associates the first sequence number with the second sequence number; and
in response detecting a second transport protocol packet that includes the first sequence number,
based on the mapping data, determining that the second transport protocol packet is a retransmission of the first transport protocol packet; and
based on the second transport protocol packet, generating and sending a second secure communication protocol packet that includes the second sequence number associated with the first sequence number.

2 . The method of claim 1 , wherein generating and sending the first secure communication protocol packet comprises:
mapping the first sequence number to the second sequence number based on an offset value associated with one or more of the following: size of a secure communication protocol header in the first secure communication protocol packet, size of an authentication tag in the first secure communication protocol packet and data padding in the first secure communication protocol packet.

3 . The method of claim 1 , wherein generating and sending the first secure communication protocol packet comprises:
encrypting the unencrypted payload data in the first transport protocol packet using a first encryption initialization vector to generate the encrypted payload data in the first secure communication protocol packet.

4 . The method of claim 3 , wherein generating and sending the second secure communication protocol packet comprises:
encrypting the unencrypted payload data in the second transport protocol packet to generated the encrypted payload data in the second secure communication protocol packet using a second encryption initialization vector that is different from the first encryption initialization vector.

5 . The method of claim 1 , wherein the method further comprises:
in response to detecting an acknowledgement packet for the second secure communication protocol packet from the second endpoint, generating and sending an acknowledgement packet for the second transport protocol packet based on the mapping data.

6 . The method of claim 1 , wherein generating the first secure communication protocol packet and the second secure communication protocol packet comprises one of the following:
generating the first secure communication protocol packet and the second secure communication protocol packet by the security agent that is implemented by a hypervisor of a physical host supporting the first endpoint; generating the first secure communication protocol packet and the second secure communication protocol packet by the security agent that is implemented by a physical network interface controller (NIC) of a physical host supporting the first endpoint; and generating the first secure communication protocol packet and the second secure communication protocol packet by the security agent that is implemented by an operating system (OS) of a virtualized computing instance acting as the first endpoint.

7 . The method of claim 1 , wherein generating the first secure communication protocol packet and the second secure communication protocol packet comprises:
generating the first secure communication protocol packet and the second secure communication protocol packet by the security agent that is implemented by a network device connecting a physical host supporting the first endpoint with the second endpoint.

8 . A non-transitory computer-readable storage medium that includes a set of instructions which, in response to execution by a processor of a computer system, cause the computer system to perform a method of secure communication protocol processing in a network environment that includes the computer system, a first endpoint and a second endpoint, and the method comprises:
in response to detecting a first transport protocol packet that is addressed from the first endpoint to the second endpoint, and includes unencrypted payload data and a first sequence number,
based on the first transport protocol packet, generating and sending a first secure communication protocol packet that includes encrypted payload data and a second sequence number;
storing mapping data that associates the first sequence number with the second sequence number; and
in response detecting a second transport protocol packet that includes the first sequence number,
based on the mapping data, determining that the second transport protocol packet is a retransmission of the first transport protocol packet; and
based on the second transport protocol packet, generating and sending a second secure communication protocol packet that includes the second sequence number associated with the first sequence number.

9 . The non-transitory computer-readable storage medium of claim 8 , wherein generating and sending the first secure communication protocol packet comprises:
mapping the first sequence number to the second sequence number based on an offset value associated with one or more of the following: size of a secure communication protocol header in the first secure communication protocol packet, size of an authentication tag in the first secure communication protocol packet and data padding in the first secure communication protocol packet.

10 . The non-transitory computer-readable storage medium of claim 8 , wherein generating and sending the first secure communication protocol packet comprises:
encrypting the unencrypted payload data in the first transport protocol packet using a first encryption initialization vector to generate the encrypted payload data in the first secure communication protocol packet.

11 . The non-transitory computer-readable storage medium of claim 10 , wherein generating and sending the second secure communication protocol packet comprises:
encrypting the unencrypted payload data in the second transport protocol packet to generated the encrypted payload data in the second secure communication protocol packet using a second encryption initialization vector that is different from the first encryption initialization vector.

12 . The non-transitory computer-readable storage medium of claim 8 , wherein the method further comprises:
in response to detecting an acknowledgement packet for the second secure communication protocol packet from the second endpoint, generating and sending an acknowledgement packet for the second transport protocol packet based on the mapping data.

13 . The non-transitory computer-readable storage medium of claim 8 , wherein generating the first secure communication protocol packet and the second secure communication protocol packet comprises one of the following:
generating the first secure communication protocol packet and the second secure communication protocol packet by a security agent that is implemented by a hypervisor of a physical host supporting the first endpoint; generating the first secure communication protocol packet and the second secure communication protocol packet by a security agent that is implemented by a physical network interface controller (NIC) of a

Assignees

• Nicira Inc

Inventors

• Pillai Sanal
• Wing Daniel

Classifications

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L9/30

  Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy · CPC title

• H04L9/14

  using a plurality of keys or algorithms · CPC title

• H04L9/3226

  using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083) · CPC title

• H04L63/0428 Primary

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title