Techniques to classify virtual private network traffic based on identity

Patent metadata

Field	Value
Publication number	US-9306936-B2
Application number	US-201414532131-A
Country	US
Kind code	B2
Filing date	Nov 4, 2014
Priority date	Oct 5, 2011
Publication date	Apr 5, 2016
Grant date	Apr 5, 2016

Abstract

Techniques are provided for obtaining first and second digital certificates from a certificate authority database for establishing a secure exchange between network devices. The first digital certificate contains identity information of a first network device, and the second digital certificate contains classification information of the first network device. In one embodiment, a secure key exchange is initiated with the second network device, and the first and second digital certificates are transmitted as a part of the secure key exchange to the second network device. In another embodiment, the first and second digital certificates are received by an intermediate network device. The first digital certificate is encrypted and is not evaluated by the intermediate network device. The second digital certificate is evaluated for classification information of the first network device. Source information associated with the first network device is stored, and encrypted traffic is processed between the network devices.

First claim

What is claimed is:

1. One or more non-transitory computer readable storage media storing instructions that, when executed by a processor at a first network device, cause the processor to perform operations comprising:
querying a certificate authority database to obtain a first digital certificate and a second digital certificate in order to establish a secure exchange between the first network device and a second network device, wherein the first digital certificate contains encrypted identity information associated with the first network device and the second digital certificate does not contain the encrypted identity information but contains unencrypted policy information including unencrypted classification information associated with the first network device to indicate that the first network device is an endpoint network device;
initiating a secure key exchange with the second network device; and
transmitting the first digital certificate and the second digital certificate as a part of the secure key exchange to the second network device such that the unencrypted policy information in the second digital certificate, but not the encrypted identity information in the first digital certificate, is available to an intermediate device.

2. The non-transitory computer readable storage media of claim 1 , wherein the secure key exchange is a part of an Internet Key Exchange (IKE) protocol.

3. The non-transitory computer readable storage media of claim 1 , the second digital certificate contains the unencrypted classification information indicating that the first network device belongs to one of a plurality of predefined user groups.

4. The non-transitory computer readable storage media of claim 1 , wherein the second digital certificate is transmitted so that encrypted identity information of the first network device contained within the first digital certificate is not exposed by the unencrypted classification information contained in the second digital certificate.

5. The non-transitory computer readable storage media of claim 1 , wherein the first digital certificate and the second digital certificate are transmitted to allow the second network device to process encrypted traffic between the first network device and the second network device in accordance with a secure key exchange protocol.

6. The non-transitory computer readable storage media of claim 1 , wherein the first network device and second network device each performs a sign operation to sign a defined number used once (nonce) with a private key associated with the first digital certificate and second digital certificate, respectively.

7. The non-transitory computer readable storage media of claim 6 , wherein during a message exchange between the first network device and the second network device, the nonce is sent along with the first digital certificate and second digital certificate, respectively, according to the public key cryptographic standard (PKCS) 7 within a vendor identifier payload.

8. One or more non-transitory computer readable storage media storing instructions that, when executed by a processor at an intermediate network device, cause the processor to perform operations comprising:
receiving a first digital certificate and a second digital certificate from a first network device, wherein the first digital certificate contains encrypted identity information associated with the first network device and is encrypted such that the intermediate network device cannot evaluate the first digital certificate and wherein the second digital certificate does not contain the encrypted identity information but contains unencrypted policy information including unencrypted classification information associated with the first network device;
validating the second digital certificate as a part of a secure key exchange between the first network device and a second network device;
evaluating the second digital certificate to obtain the unencrypted classification information associated with the first network device without obtaining the encrypted identity information associated with the first network device;
classifying the first network device based on the unencrypted classification information obtained from evaluating the second digital certificate;
storing source information associated with the first network device based on the unencrypted classification information; and
processing encrypted traffic flow between the first network device and the second network device based on the stored source information.

9. The non-transitory computer readable storage media of claim 8 , wherein the first network device is classified based on user group information indicated by the unencrypted classification information contained within the second digital certificate associated with the first network device.

10. The non-transitory computer readable storage media of claim 8 , wherein the operations operable for classifying are performed once security associations associated with the Internet Protocol Security (IPSec) protocol are established.

11. The non-transitory computer readable storage media of claim 8 , wherein the encrypted traffic flow is processed in accordance with the Internet Protocol Security (IPSec) protocol based on the stored source information.

12. The non-transitory computer readable storage media of claim 8 , wherein the first network device is classified as an endpoint network device.

13. The non-transitory computer readable storage media of claim 8 , wherein the source information comprises Internet Protocol (IP) address information and port information associated with the first network device.

14. The non-transitory computer readable storage media of claim 8 , wherein the second digital certificate is validated in accordance with an Internet Key Exchange (IKE) protocol.

15. The non-transitory computer readable storage media of claim 14 , wherein the unencrypted classification information is exchanged between the first network device and second network device as part of message 1 and message 2 in an IKE version 1/version 2 exchange.

16. The non-transitory computer readable storage media of claim 8 , wherein the instructions operable for processing are based on different levels of Quality of Service (QoS) according to policy information associated with the first network device and second network device.

17. The non-transitory computer readable storage media of claim 8 , wherein the first network device and second network device each performs a sign operation to sign a defined number used once (nonce) with a private key associated with the first digital certificate and second digital certificate, respectively.

18. The non-transitory computer readable storage media of claim 17 , wherein during a message exchange between the first network device and the second network device, the nonce is sent along with the first digital certificate and second digital certificate, respectively, according to the public key cryptographic standard (PKCS) 7 within a vendor identifier payload.

19. A system comprising:
a first network device;
a second network device; and
an intermediate network device;
wherein the first network device, the second network device and the intermediate network device are part of a virtual private network;
wherein the intermediate network device:
receives a first digital certificate and a second digital certificate from a first network device, wherein the first digital certificate contains encrypted identity information associated with the first network device and is encr

Assignees

• Cisco Tech Inc

Inventors

• Patel Kunal
• Sun Yixin
• Gupta Puneet
• Arjun Vinod
• Mcgrew David

Classifications

• H04L63/0435

  wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06) · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L63/061

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title

• H04L63/0823 Primary

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L9/3263 Primary

  involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823) · CPC title