IP security certificate exchange based on certificate attributes

Patent metadata

Field	Value
Publication number	US-9912654-B2
Application number	US-61678909-A
Country	US
Kind code	B2
Filing date	Nov 12, 2009
Priority date	Nov 12, 2009
Publication date	Mar 6, 2018
Grant date	Mar 6, 2018

Abstract

Architecture that provides Internet Protocol security (IPsec) certificate exchange based on certificate attributes. An IPsec endpoint can validate the security context of another IPsec endpoint certificate by referencing certificate attributes. By facilitating IPsec certificate exchange using certificate attributes rather than solely certificate roots, it is now possible to build multiple isolated network zones using a single certificate authority rather than requiring one certificate authority per zone. Moreover, the ability to use certificate attributes during the IPsec certificate exchange can be leveraged for more focused communications such as QoS (quality of service). Certificate attributes can be utilized to identify the security context of the endpoint. The IPsec certificate use can be locked down to a single IP or group of IPs.

First claim

What is claimed is:

1. A computer-implemented security system, comprising:
a communications component of a local endpoint configured to receive a digital certificate from a remote endpoint, the digital certificate issued by a single certificate authority which administers multiple zones, and the digital certificate having certificate attributes that define a security context of the digital certificate, wherein the certificate attributes are weighted according to a weighting system and ranked according to predetermined criteria;
a security component of the local endpoint configured to validate the local endpoint based on processing of one or more of the weighted and ranked certificate attributes to enable Internet Protocol security (IPsec) communications with the remote endpoint based on validation of the security context, wherein the IPsec communications occur at a reduced level when less than all of the certificate attributes match; and
a hardware processor configured to execute computer-executable instructions in a memory device, the instructions executed to enable the communications component and the security component.

2. The system of claim 1 , wherein the security component also validates the communications using a root certificate.

3. The system of claim 1 , wherein the certificate attributes comprise at least one of quality of service (QoS) data, unique ID of the security context, IP address or addresses of at least one endpoint with which IPsec sessions can be obtained, or IP address of a proxy system.

4. The system of claim 1 , wherein the digital certificate is locked to a specific certificate attribute.

5. The system of claim 1 , wherein the digital certificate is locked to a specific address or group of addresses.

6. The system of claim 1 , wherein the certificate authority issues the digital certificate and other digital certificates for IPsec communications over multiple zones.

7. The system of claim 1 , wherein the one or more certificate attributes include an IP address of a proxy system and a zone.

8. A computer-implemented security system, comprising:
a communications component of a local endpoint configured to receive a digital certificate from a remote endpoint, the digital certificate issued by a single certificate authority which administers multiple zones, the digital certificate having certificate attributes that define a security context, wherein the certificate attributes are weighted according to a weighting system and ranked according to predetermined criteria;
a security component of the local endpoint configured to validate one or more of the weighted and ranked certificate attributes and a root certificate to enable Internet Protocol security (IPsec) communications with the remote endpoint, wherein the IPsec communications occur at a reduced level when less than all of the certificate attributes match; and
a hardware processor configured to execute computer-executable instructions in a memory device, the instructions executed to enable the communications component and the security component.

9. The system of claim 8 , wherein the certificate attributes comprise QoS (quality of service) fields that give higher priority to one endpoint over another endpoint.

10. The system of claim 8 , wherein the digital certificate is locked to a specific certificate attribute.

11. The system of claim 8 , wherein the single certificate authority for multiple zones that issues the digital certificate and other digital certificates for IPsec communications over the multiple zones.

12. A computer-implemented, security method, comprising:
receiving at an endpoint a digital certificate from a peer endpoint, the certificate issued by a single certificate authority which administers multiple zones, the certificate having one or more certificate attributes that describe a security context of the certificate, wherein the certificate attributes are weighted according to a weighting system and ranked according to predetermined criteria;
validating at the endpoint the security context of the peer endpoint by referencing the one or more weighted and ranked certificate attributes;
establishing an Internet Protocol security (IPsec) session between the endpoint and the peer endpoint based on validation of the security context, wherein the IPsec session occurs at a reduced level when less than all of the certificate attributes match; and
utilizing a hardware processor that executes instructions stored in memory, the instructions executed to enable the receiving, validating, and establishing.

13. The method of claim 12 , further comprising issuing digital certificates to the endpoint and the peer endpoint from a certificate authority that administers multiple zones.

14. The method of claim 12 , further comprising locking down the certificate to a specific attribute.

15. The method of claim 12 , further comprising defining an attribute as an IP address of a specific endpoint.

16. The method of claim 12 , further comprising defining an attribute as a range of IP addresses of a group.

17. The method of claim 12 , further comprising identifying the security context of the endpoint based on one or more of the attributes.

18. The method of claim 12 , further comprising comparing an attribute of the digital certificate to security data of the endpoint to validate the peer endpoint to the endpoint.

Assignees

• Panasyuk Anatoliy
• Rangegowda Dharshan
• Shukla Abhishek
• Microsoft Technology Licensing Llc

Inventors

• Panasyuk Anatoliy
• Rangegowda Dharshan
• Shukla Abhishek

Classifications

• G06F2221/2149

  Restricted operating environment · CPC title

• H04L63/0823 Primary

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• G06F2221/2105

  Dual mode as a secondary aspect · CPC title

• H04L63/164

  at the network layer · CPC title

• H04L2209/80

  Wireless · CPC title