Apparatus and method for using certificate data to route data

Patent metadata

Field	Value
Publication number	US-9736184-B2
Application number	US-201514660500-A
Country	US
Kind code	B2
Filing date	Mar 17, 2015
Priority date	Mar 17, 2015
Publication date	Aug 15, 2017
Grant date	Aug 15, 2017

Abstract

A method of routing data across a network receives a session request from a client node to access at least one node in a local network having a plurality of nodes. The method also receives a client certificate (e.g., a digital certificate at least partially specified by known standards, such as the “X509 Standard”) from the client node. The client certificate has client information specifying at least one node to receive packets from the client node. Next, the method uses the client certificate to execute an authentication process. If the authentication process authenticates the client node, then the method routes data packets from the client node to at least one node in the local network as specified by the client information in the client certificate.

First claim

What is claimed is:

1. A method of routing data across a network, the method comprising:
receiving, at a receiving node within a local network having a plurality of nodes, a session request from a client node to access, during a session, at least one node in the local network;
receiving a client certificate from the client node, the client certificate having client information comprising a public key of the client node and specifying at least one node to receive packets from the client node;
receiving from the client node a signature encrypted according to a private key of the client node;
executing an authentication process using the client certificate, wherein the authentication process includes using the public key to verify the signature;
retrieving the client information from the client certificate; and
if the authentication process authenticates the client node, routing data packets received from the client node to at least one node in the local network as specified by the client information in the client certificate, routing comprising maintaining a static connection between the receiving node and the at least one node in the local network, and routing data packets from the client node along the static connection, wherein handshake processes are not performed between the client node and the at least one node in the local network during the session.

2. The method as defined by claim 1 further comprising rejecting the client node if the authentication process does not authenticate the client node.

3. The method as defined by claim 2 wherein rejecting comprises blocking packets of the client node from access to other nodes in the local network.

4. The method as defined by claim 1 wherein the client information comprises identifying information identifying the client node.

5. The method as defined by claim 1 wherein routing data packets comprises:
using the client information to determine the identity of the at least one node in the local network to receive the data packets from the client node; and
routing data packets from the client node to the identified at least one node.

6. The method as defined by claim 5 wherein routing permits access to the at least one node by the client node if authenticated, the client information including policy information for enabling a set of privileges for the client node when accessing the at least one node in the local network.

7. The method as defined by claim 1 wherein the client information includes a) identifying information identifying the client node, b) policy information for enabling a set of privileges for the client node when accessing the at least one node in the local network, or c) both (a) and (b).

8. The method as defined by claim 7 wherein routing data packets comprises routing data packets as specified by one or both identifying information and the policy information.

9. The method as defined by claim 1 wherein the local network includes an edge router, the edge router executing at least one of receiving a session request, receiving a client certificate, retrieving, and routing.

10. The method as defined by claim 1 wherein the at least one node comprises an application server and the local network includes a local area network.

11. The method as defined by claim 1 further comprising:
permitting initial handshake processes between the client node and the at least one node before receiving the certificate; and
permitting completion of final handshake processes between the client node and at least one node if the authentication process authenticates the client node.

12. The method as defined by claim 1 wherein executing an authentication process comprises receiving a login ID and password for a guest user, and confirming the login ID and password are valid for access in the local network.

13. The method as defined by claim 12 further comprising determining a client device identifier that identifies the client node device, and using the client device identifier and the client certificate to execute the authentication process.

14. The method as defined by claim 13 wherein the client device identifier comprises a MAC address.

15. A network routing device for routing data received across a network, the network device comprising:
a hardware interface for receiving a) a session request from a client node to access at least one node in a local network having a plurality of nodes, b) a client certificate from the client node, the client certificate having client information comprising a public key of the client node and specifying at least one node to receive packets from the client node and c) from the client node a signature encrypted according to a private key of the client node;
an authenticator operatively coupled with the interface, the authenticator being configured to retrieve the client certificate and execute an authentication process using the client certificate, wherein the authentication process includes using the public key to verify the signature; and
a router operatively coupled with the authenticator, the router being configured to determine, from the authenticator, if the authentication process authenticated the client node, the router further being configured to:
maintain a static connection between the network routing device and the at least one node in the local network; and
route data packets received from the client node to at least one node in the local network as specified by the client information in the client certificate if the client node is authenticated,
wherein handshake processes are not performed between the client node and the at least one node in the local network during the session.

16. The network routing device as defined by claim 15 wherein the client information comprises identifying information identifying the client node.

17. The network routing device as defined by claim 15 wherein the router is configured to use the client information to determine the identity of the at least one node in the local network to receive the data packets from the client node, the router further being configured to route client data packets from the client node to the identified at least one node.

18. The network routing device as defined by claim 17 wherein the router is configured to permit access to the at least one node by the client node if authenticated, the client information including policy information for enabling a set of privileges for the client node when accessing the at least one node in the local network.

19. The network routing device as defined by claim 15 wherein the client information includes a) identifying information identifying the client node, b) policy information for enabling a set of privileges for the client node when accessing the at least one node in the local network, or c) both (a) and (b).

20. The network routing device as defined by claim 19 wherein the router is configured to route data packets as specified by one or both identifying information and the policy information.

21. The networking device as defined by claim 15 wherein the router is configured as an edge router for the local network.

22. A computer program product for use on a computer system for routing data across a network, the computer program product comprising a tangible, non-transient computer usable medium having computer readable program code thereon, the computer readable program code comprising:
program code for receiving, at a receiving node within a local network having a pl

Assignees

• 128 Tech Inc

Inventors

• Kumar Prashant
• Timmons Patrick
• Melampy Patrick

Classifications

• H04L63/166

  at the transport layer · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L45/74

  Address processing for routing · CPC title

• H04L63/02

  for separating internal from external traffic, e.g. firewalls · CPC title