Selective transport layer security encryption
AssigneeJuniper Networks, Inc.
InventorsGoutham Kondapavuluru, Sharanagoud B. Devaraddi, Rajesh S
Life of this patent
Estimating the term…
Abstract
A device may transmit a packet for communicating via a tunnel. The packet may be associated with a protocol. The device may determine that the packet has been dropped by a security device. The device may selectively encrypt, after determining that the packet has been dropped, the packet using a null encryption for transport layer security (TLS) or a combination of encryption associated with the protocol and TLS encryption to generate an encrypted packet. The device may transmit the encrypted packet for communicating via the tunnel.
Claims20
A method, comprising:
- transmitting, by a device, an Internet key exchange (IKE) packet as part of an IKE procedure for establishing or communicating on a virtual private network (VPN),
- the packet being associated with a protocol;
- determining, by the device, that the IKE packet has been dropped by a security device;
- encapsulating, by the device and when the IKE packet has been dropped, the IKE packet with transmission control protocol (TCP) encapsulation to generate a TCP encapsulated IKE packet;
- transmitting, by the device, the TCP encapsulated packet for establishing or communicating on the VPN;
- determining, by the device, that the TCP encapsulated packet has been dropped by the security device;
- selectively encrypting, by the device and when the TCP encapsulated packet has been dropped, the IKE packet using a null encryption for transport layer security (TLS) or a combination of encryption associated with the protocol and TLS encryption to generate an encrypted packet;
- and
- transmitting, by the device, the encrypted packet on the VPN for establishing or communicating on the VPN.
A device, comprising:
- one or more memories;
- and
- one or more processors to:
- transmit an Internet key exchange (IKE) packet as part of an IKE procedure for communicating with a remote device,
- the packet being associated with a protocol;
- determine that the IKE packet has been dropped by a security device;
- encrypt, after determining that the IKE packet has been dropped, the IKE packet using a null encryption for transport layer security (TLS) to generate a first encrypted packet;
- transmit the first encrypted packet for communicating with the remote device;
- determine that the first encrypted packet has been dropped by the security device;
- encrypt, after determining that the first encrypted packet has been dropped, the IKE packet using a combination of encryption associated with the protocol and TLS encryption to generate a second encrypted packet;
- and
- transmit the second encrypted packet for communicating with the remote device.
A non-transitory computer-readable medium storing instructions, the instructions comprising:
- one or more instructions that, when executed by one or more processors, cause the one or more processors to:
- transmit an Internet key exchange (IKE) packet as part of an IKE procedure for communicating via a tunnel,
- the IKE packet being associated with a protocol;
- determine that the IKE packet has been dropped by a security device;
- selectively encrypt, after determining that the IKE packet has been dropped, the IKE packet using a null encryption for transport layer security (TLS) or a combination of encryption associated with the protocol and TLS encryption to generate an encrypted IKE packet;
- and
- transmit the encrypted IKE packet for communicating via the tunnel.
Dependencies are inferred from the claim text.