Cisco Technology, Inc.

Sheela Dixit Rowles

Kavitha Kamarthy

Brian Eliot Weis

Warren Scott Wainner

Scott Roy Fluhrer

Mohamed Khalid

David A McGrew

Pratima Pramod Sethi

Haseeb Sarwar Niazi

Rajiv Asati

Jie Chu

Dinesh Ranjit

Scott Thomas Fanning

Tanya Roosta

Hong Xu

Shashi Sastry

Lingyan Huang

Haseeb Naizi

Various techniques that allow group members to detect the use of stale encryption policy by other group members are disclosed. One method involves receiving a message from a first group member via a network. The message is received by a second group member. The method then detects that the first group member is not using a most recent policy update supplied by a key server, in response to information in the message. In response, a notification message can be sent from the second group member. The notification message indicates that at least one group member is not using the most recently policy update. The notification message can be sent to the key server or towards the first group member.

Detection of stale encryption policy by group members

First and second nested virtual private networks share a common rekey service. A first key server generates first cryptographic keys and policies for use by gateways of the VPN to encrypt and decrypt data packets. The key server establishes a connection with a second key server to generate second cryptographic keys and policies independently of the first key server for use by encryption units of a second VPN that is nested with and operates independently of the first VPN. The first key server refreshes the first cryptographic keys in the first VPN gateways using a common rekey service, and cooperates with the second key server to refresh the second cryptographic keys in the second VPN encryption units using the common rekey service.

Nested independent virtual private networks with shared rekey and consistency services

A system and method for facilitating anti-replay protection with multi-sender traffic is disclosed. The system employs time-based anti-replay protection wherein a sender transmits a data packet with a pseudo-timestamp encapsulated in a metadata payload. At the receiving end, the receiver compares the pseudo-timestamp information received with its own pseudo-time, determines if a packet is valid, and rejects a replay packet. The pseudo-time information is transmitted through the metadata payload and new fields need not be added to the IPSec (IP Security) Protocol, thus the existing hardware can be employed without any changes or modifications.

Use of metadata for time based anti-replay

Techniques are provided for determining freshness of control messages in a network. At a first device that is to enter into a secure communication session with a second device, timestamp information and time window size information are sent to the second device in a control message during a first exchange between a first device and a second device. At the first device, timestamp information and time window size information are obtained from a control message received from the second device by the first device during the first exchange. At the first device, the freshness of a control message is tested based on the timestamp information of the control message during a second exchange and the time window size information received from the second device during the first exchange.

Protection of control plane traffic against replayed and delayed packet attack

A system and method directed to carrying out dynamic secured group communication is provided. The method includes: obtaining a first packet that includes a first header; forming a frame that includes the first header in encrypted form; combining the first header and the frame to form a second packet and forming a second header; encapsulating the second packet with the second header to form a third packet, and communicating the third packet into the second network from the second source node for termination to the second-destination node. The first header includes a first source address of a first source node of a first network, and a first destination address of a first destination node of the first network. The second header includes a second source address of a second source node of a second network, and a second destination address of a second destination node of the second network.

Method and system for dynamic secured group communication

In one embodiment, group member devices may be divided into at least one cluster, wherein each cluster includes a primary key server designated to synchronize with a master key server. Each cluster further includes at least one registration server configured to communicate with member devices in the group within the cluster and to synchronize with the primary key server.

Active-active hierarchical key servers

Techniques for distributing a new communication key within a group virtual private network (VPN) are provided. A key distribution service determines that a new communication key for a VPN is to be distributed to members of the VPN. The new communication key is sent individually in a unique and separate message to each of the members. The key distribution service also maintains records to determine which of the members have and have not successfully received the new communication key.

Techniques for distributing a new communication key within a virtual private network

A system and method directed to carrying out dynamic secured group communication is provided. The method includes obtaining a first packet that includes a first header. The first header includes a first source address of a first source node of a first network, and a first destination address of a first destination node of the first network. The method also includes forming a frame that includes the first header in encrypted form, combining the first header and the frame to form a second packet, and forming a second header. This second header includes a second source address of a second source node of a second network, and a second destination address of a second destination node of the second network. The method further includes encapsulating the second packet with the second header to form a third packet, and communicating the third packet into the second network from the second source node for termination to the second-destination node.

Growing community of inventors

Cupertino, CA, United States of America

Sheela Dixit Rowles