# US 10,454,890 B2 · Negotiation of security protocols and protocol attributes in secure communications environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,454,890 B2 - Document ID: US10454890B2 - Status: Granted - Kind: B2 - Application number: 14/042,239 - Filed: 2013-09-30 - Published: 2014-10-23 - Granted: 2019-10-22 - Earliest claimed: 2005-01-31 - Assignees: Unisys Corporation - Applicants: Robert A Johnson; Kathleen Wild; Sarah K Inforzato; Ted Hinaman - Inventors: Robert A Johnson; Kathleen Wild; Sarah K Inforzato; Ted Hinaman - Web page: https://patentgrep.com/patent/US10454890B2 ## CPC - H04L 63/02: {for separating internal from external traffic, e.g. firewalls} - G06F 21/00: Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - H04L 9/0838: {Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these (network architectures or network communication protocols for key exchange in a packet data network H04L63/061)} - H04L 9/0841: {involving Diffie-Hellman or related key agreement protocols} - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/0485: {Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up} - H04L 69/18: Multiprotocol handlers, e.g. single devices capable of handling multiple protocols - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/061: {for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838)} - H04L 63/164: {at the network layer} - H04L 63/166: {at the transport layer} - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Methods of communicatively connecting first and second endpoints are disclosed. One method includes transmitting from a first endpoint to a second endpoint a connection request, the connection request including an IP address of the second endpoint. The method further includes, based at least in part on the IP address of the second endpoint, selecting IPsec from among a plurality of available security protocols to first attempt to use in forming a tunnel between the first and second endpoints, and forming the tunnel between the first and second endpoints based on the connection request. ## Claims ### Claim 1 A method of communicatively connecting first and second computing system endpoints, the method comprising: transmitting, from a first computing system endpoint, to a second computing system endpoint a connection request that includes an IP address of the second computing system endpoint, the connection request including an encryption key, in which the second computing system endpoint is a member of a community of interest, each member of the community of interest is a client of the first computing system endpoint; receiving, at the first computing system endpoint, from the second computing system endpoint a responding request that includes a validation key, wherein the validation key matches with the encryption key authenticating the second computing system endpoint, the validation key being common among the members of the community of interest; based at least in part on the IP address of the second computing system endpoint, selecting by the first computing system endpoint, an IPsec security protocol from among a plurality of security protocols concurrently available at the first computing system endpoint to first attempt to use in forming a tunnel between the first and second computing system endpoints; and forming the tunnel between the first and second computing system endpoints based on the connection request. ### Claim 2 (depends on 1) The method of claim 1, wherein forming the tunnel comprises forming the tunnel using the IPsec protocol. ### Claim 3 (depends on 2) The method of claim 2, wherein the first computing system endpoint comprises a computing system having an operating system supporting a native IPsec implementation. ### Claim 4 (depends on 3) The method of claim 3, wherein the second computing system endpoint comprises a computing system having an operating system supporting a native IPsec implementation. ### Claim 5 (depends on 2) The method of claim 2, wherein the tunnel is formed based on one or more attributes set at a user-level protocol service, the one or more attributes comprising IPsec attributes selected from a group of IPsec attributes consisting of: encryption type; authentication mechanism; Elliptic Curve cryptography; and IKE version. ### Claim 6 (depends on 1) The method of claim 1, wherein the second computing system endpoint has an IPv6 address. ### Claim 7 (depends on 1) The method of claim 1, wherein the second computing system endpoint has an IPv4 address. ### Claim 8 (depends on 7) The method of claim 7, wherein, upon determining that the first computing system endpoint does not support IPsec, forming the tunnel using a second security protocol from among the plurality of available security protocols. ### Claim 9 (depends on 8) The method of claim 8, wherein the second security protocol comprises the SecureParser proprietary security protocol. ### Claim 10 A method of communicatively connecting computing system endpoints in a network, the method comprising: selecting an IPsec security protocol from among a plurality of security protocols available at the first computing system endpoint, wherein selecting the IPsec security protocol is based at least in part on an IP address of a second computing system endpoint; transmitting from a first computing system endpoint to the second computing system endpoint a connection request that includes an identification of the IPsec security protocol selected based on an IP address of the second computing system endpoint, the connection request including an encryption key, in which the second computing system endpoint is a member of a community of interest, each member of the community of interest is a client of the first computing system endpoint; receiving, at the first computing system endpoint, from the second computing system endpoint a responding request that includes a validation key, wherein the validation key matches with the encryption key authenticating the second computing system endpoint, the validation key being common among the members of the community of interest; forming an IPsec-based tunnel between the first and second computing system endpoints; selecting, by the first computing endpoint, an IPsec security protocol from among a plurality of security protocols concurrently available at the first computing system endpoint, wherein selecting the IPsec security protocol is based at least in part on an IP address of a third computing system endpoint; receiving an indication from the third computing system endpoint that the third computing system endpoint does not natively support the IPsec security protocol; forming a second tunnel between the first and third computing system endpoints, wherein the second tunnel uses a second security protocol other than the IPsec security protocol. ### Claim 11 (depends on 10) The method of claim 10, wherein the IP address of the second computing system endpoint is an IPv6 address. ### Claim 12 (depends on 10) The method of claim 10, wherein the IP address of the third computing system endpoint is an IPv4 address. ### Claim 13 (depends on 12) The method of claim 12, wherein the second security protocol comprises the SecureParser proprietary security protocol. ### Claim 14 (depends on 10) The method of claim 10, further comprising opening a tunnel between the first computing system endpoint and a security appliance, the tunnel between the first computing system endpoint and the security appliance uses the second security protocol. ### Claim 15 (depends on 10) The method of claim 10, wherein the IPsec-based tunnel is formed based on one or more attributes set at a user-level protocol service, the one or more attributes comprising IPsec attributes selected from a group of IPsec attributes consisting of: encryption type; authentication mechanism; elliptic Curve cryptography; and IKE version. ### Claim 16 (depends on 10) The method of claim 10, wherein the second computing system endpoint comprises a computing system having a first operating system that natively supports the IPsec security protocol and the third computing system endpoint comprises a computing system having a second operating system different from the first operating system and that lacks native IPsec support. ### Claim 17 (depends on 16) The method of claim 16, wherein the first operating system and the second operating system are provided by different operating system developers. ### Claim 18 (depends on 16) The method of claim 16, wherein the first operating system and the second operating system are different operating system versions provided by the same operating system developer. ### Claim 19 A non-transitory computer-readable storage device comprising computer-executable instructions stored thereon which, when executed, cause a computing system to perform a method of communicatively connecting to a remote computing system endpoint, the method comprising: transmitting to a remote computing system endpoint a connection request that includes an IP address of the remote computing system endpoint, the connection request including an encryption key, in which the remote computing system endpoint is a member of a community of interest, each member of the community of interest is a client of the computing system; receiving from the remote computing system endpoint a responding request that includes a validation key, wherein the validation key matches with the encryption key authenticating the remote computing system endpoint, the validation key being common among the members of the community of interest; based at least in part on the IP address of the remote computing system endpoint, selecting by the first computing system endpoint, an IPsec security protocol from among a plurality of security protocols concurrently available at the first endpoint to first attempt to use in forming a tunnel between the computing system and the remote computing system endpoint; and forming the tunnel between the computing system and the remote computing system endpoint based on the connection request. ### Claim 20 (depends on 19) The computer-readable storage device of claim 19, further comprising: transmitting to a second remote computing system endpoint a connection request, the connection request including an IP address of the second remote computing system endpoint; based at least in part on the IP address of the remote computing system endpoint, selecting by the first computing system endpoint, an IPsec security protocol from among a plurality of security protocols concurrently available at the first endpoint to first attempt to use in forming a tunnel between the computing system and the second remote computing system endpoint; receiving an indication from the second remote computing system endpoint that the second remote computing system endpoint does not natively support the IPsec security protocol; and forming the tunnel between the computing system and the remote computing system endpoint based on the connection request using a second security protocol of the plurality of available security protocols concurrently available at the first endpoint, the second security protocol being a security protocol other than the IPsec security protocol.