Cisco Technology, Inc.

Symantec Corporation

Jan Vilhuber

Brian Eliot Weis

Michael Lee Sullenberger

David A McGrew

Max Pritikin

Louis F Menditto

Robert Michael Batz

Tzu-Ming Tsang

Barron Cornelius Housel, Iii

Pranav Tiwari

Gaurang Shah

Geoffrey Huang

Scott W Brim

Mauro Zallocco

Anurag Bhargava

Mark John Baugher

Yogesh Kalley

Ramesh Kalimuthu

Eric Albin Voit

Joseph Salowey

Pratima Pramod Sethi

James R Sanders

Frederic R P Detienne

Todd Wakerley

Beau Ufen

Frederic Rp Detienne

Frederic RP Detienne

A method for signing a wrapped computer application is described. In some embodiments, methods may include receiving a wrapped computer application via a first secure communication connection from a first remote server, authenticating the first secure communication connection, modifying the wrapped computer application based at least in part on the authenticating, and transmitting the wrapped computer application via a second secure communication connection to a second remote server based at least in part on the modifying.

Remote signing wrapped applications

According to one aspect, a method for certifying the identity of a network device. The method includes an initial step of coupling the network device to a provisioning device via a physically secure communications link. The provisioning device then certifies the identity of the network device including generating a cryptographic private key for the network device and sending the generated private key to the network device over the physically secure communications link.

Certifying the identity of a network device

Systems, methods and other embodiments associated with network device provisioning are described. One example method includes storing a set of device specific identification data in a network device. The example method may also include storing an association between the network device and a set of device specific provisioning data. The example method may also include providing the set of device specific provisioning data to the network device. The set of device specific provisioning data may be provided in response to receiving a provisioning data request from the network device.

Networking device provisioning

Techniques for passing security configuration information between a security policy server and a client includes the client forming a request for security configuration information that configures the client for secure communications. The client is separated by an untrusted network from a trusted network that includes the security policy sever. A tag is generated that indicates a generic security configuration attribute. An Internet Security Association and Key Management Protocol (ISAKMP) configuration mode request message is sent to a security gateway on an edge of the trusted network connected to the untrusted network. The message includes the request in association with the tag. The gateway sends the request associated with the tag to the security policy server on the trusted network and does not interpret the request. The techniques allow client configuration extensions to be added by modifying the policy server or security client, or both, without modifying the gateway.

Method and apparatus for passing security configuration information between a client and a security policy server

A packet forwarding process, on a data communications device, forwards a packet to a plurality of destinations within a network from that data communications device using an 'encrypt, then replicate' method. The packet forwarding process receives a packet that is to be transmitted to the plurality of destinations, and applies a security association to the packet using security information shared between the data communications device, and the plurality of destinations, to create a secured packet. The secured packet contains a header that has a source address and a destination address. The source address is inserted into the header, and then the packet forwarding process replicates the secured packet, once for each of the plurality of destinations. After replication, the destination address is inserted into the header, and the packet forwarding process transmits each replicated secured packet to each of the plurality of destinations authorized to maintain the security association.

Method and apparatus for distributing group data in a tunneled encrypted virtual private network

According to one aspect, a provisioning server comprises a configuration module that configures a network device and an identification certification module that certifies the identity of the network device. With use of the provisioning server, the network device does not require configuration with network connectivity in order to obtain its certified identity. In one embodiment, configuration module configures the device for operation at the device's point of deployment in a network. In one embodiment, the identity certification module is configured to generate a digital certificate for the network device and the configuration module is configured to automatically configure the network device based on its digital certificate. The provisioning server is coupled to the network device with a secure communication link. As a result, a more trusted network device is ultimately deployed into its network of operation.

Method and apparatus for integrated provisioning of a network device with configuration information and identity certification

Techniques for validating a first device are provided. A second device receives a first device public key and first device identification information from the first device. Validation of the first device identification information is required for a security process using a security protocol. The second device sends the first device public key and the first device identification information to an AAA server for validation. The AAA server is separate from the second device. The second device receives a response from the AAA server, the response including an indication whether the received first device identification information is validated with stored first device identification information for the first device public key. If the first device identification information is validated, an action for the security process is performed using the security protocol.

Techniques for validating public keys using AAA services

A method comprises receiving a request for secure network traffic from a device having a private network address at a source node, obtaining the private network address of a requested destination device at a destination node from a route server based on signaling information associated with the request, obtaining the public network address of the destination node associated with the private network address, creating in response to the request a virtual circuit between the source node and the destination node based on the public network address of the destination node, and encrypting network traffic for transporting at least from the source node to the destination node through the virtual circuit. The process is dynamic in that the virtual circuit is created in response to the request. Hence, the process operates as if a fully meshed network exists but requires less provisioning and maintenance than a fully meshed network architecture. Furthermore, the process is readily scalable as if a hub and spoke network exists but is more suitable for delay-sensitive traffic, such as voice and video, than a hub and spoke network architecture.

Method and apparatus for dynamically securing voice and other delay-sensitive network traffic

A packet forwarding process, on a data communications device, forwards a packet to a plurality of destinations within a network from that data communications device using an 'encrypt then replicate' method. The packet forwarding process receives a packet that is to be transmitted to the plurality of destinations, and applies a security association to the packet using security information shared between the data communications device, and the plurality of destinations, to create a secured packet. The secured packet contains a header that has a source address and a destination address. The source address is inserted into the header, and then the packet forwarding process replicates the secured packet, once for each of the plurality of destinations. After replication, the destination address is inserted into the header, and the packet forwarding process transmits each replicated secured packet to each of the plurality of destinations authorized to maintain the security association.

A method for providing user notification signals in digital phone such as IP phones or cell phones that use encryption. In one embodiment, a digital phone receives an encrypted data packet. The phone determines that the encrypted data packet satisfies a criterion. The phone generates a user notification signal that is perceivable by a user of the phone in response to determining that the encrypted data packet does not satisfy the criterion. The user notification signal may comprise a tone, synthesized speech, or other signal that is audible in a handset or speaker of the phone. Alternatively, the user notification signal is visually displayed in an electronic display of the phone. The criterion may comprise a failure to authenticate one or more encrypted data packets that are provided to the phone in a secure protocol. The process may be performed at a voice gateway or cellular base station.

Providing user notification signals in phones that use encryption

An information service provider network includes a content gateway to process requests for information from a client terminal. The content gateway includes a router for receiving a request for information from the client terminal. The request includes a domain name and additional content. The router forwards the request according to the domain name to a selected one of a plurality of processors to further process the request. The selected one of the plurality of processors identifies an information source to satisfy the request in response to the additional content of the request.

System and method for processing a request for information in a network

A process is disclosed in which a security policy is associated with a virtual private network (VPN) interface at a first device, for example, a router. Input is received specifying an association of a VPN endpoint address to a corresponding routable network address of a second device. A message is issued to a security module at the first device, the message including the routable network address of the second device and the security policy. Encryption state information is generated for network traffic from the first device to the second device, based on the message. The process is applicable to a hub-and-spoke network architecture that utilizes a point-to-multipoint GRE tunnel and the IPsec protocol for security. The process is dynamic in that the encryption state is generated for traffic over a VPN link, in response to notification of a virtual address-to-real address mapping, i.e., the association. In an embodiment, the association is an NHRP mapping.

Method and apparatus for establishing a dynamic multipoint encrypted virtual private network

A compact secure data communication method is disclosed. In one embodiment, a compact security protocol provides cryptographic services on IP, UDP, and TCP packets with minimal bandwidth degradation due to encapsulation overhead. The disclosed protocol may be used, for example, in converged networks that carry both voice-over-IP and data traffic in and wireless networks, in which it is imperative to minimize per-packet overhead. The disclosed protocol provides as much security as possible, by authenticating the uncompressed headers rather than the compressed headers.

Growing community of inventors

San Luis Obispo, CA, United States of America

Jan Vilhuber