# US 2008/0189428 A1 · Computer Program Products for Security Processing Inbound Communications in a Cluster Computing Environment

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2008/0189428 A1
- Document ID: US20080189428A1
- Status: Published application
- Kind: A1
- Application number: 12/062,571
- Filed: 2008-04-04
- Published: 2008-08-07
- Earliest claimed: 2001-01-17
- Assignees: International Business Machines Corporation
- Inventors: James Russell Godwin; Linwood H. Overby
- Web page: https://patentgrep.com/patent/US20080189428A1

## CPC

- H04L 63/0272: {Virtual private networks}
- H04L 61/00: Network arrangements, protocols or services for addressing or naming
- H04L 61/35: {involving non-standard use of addresses for implementing network functionalities, e.g. coding subscription information within the address or functional addressing, i.e. assigning an address to a function}
- H04L 61/45: Network directories; Name-to-address mapping
- H04L 61/59: using proxies for addressing
- H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)}
- H04L 63/10: {for controlling access to devices or network resources}
- H04L 63/164: {at the network layer}
- H04L 69/16: Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
- H04L 69/161: {Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Methods, systems and computer program products provide Internet Protocol Security (IPSec) to a plurality of target hosts in a cluster of data processing systems which communicate with a network through a routing communication protocol stack utilizing a dynamically routable Virtual Internet Protocol Address (DVIPA) by negotiating security associations (SAs) associated with the DVIPA utilizing an Internet Key Exchange (IKE) component associated with the routing communication protocol stack and distributing information about the negotiated SAs to the target hosts so as to allow the target hosts to perform IPSec processing of communications from the network utilizing the negotiated SAs.

## Claims

### Claim 1

A system for providing Internet Protocol Security (IPSec) to a plurality of target hosts in a cluster of data processing systems, comprising:
a shadow SA cache at each of the target hosts which is configured to store security association (SA) information associated with a dynamically routable Virtual Internet Protocol Address (DVIPA); and
a communication protocol stack at each of the target hosts configured to IPSec process datagrams associated with the DVIPA utilizing the SA information in the shadow SA cache.

### Claim 2 (depends on 1)

A system according to claim 1, further comprising:
a routing communication protocol stack configured to route communications to the plurality of target hosts from a network utilizing the distributed Virtual Internet Protocol Address (DVIPA);
an Internet Key Exchange module (IKE) associated with the routing communication protocol stack; and
wherein the routing communication protocol stack is further configured to distribute security association (SA) information for IPSec SAs negotiated by the IKE and associated with the DVIPA to the communication protocol stacks at each of the target hosts; and
wherein the communication protocol stacks at each of the target hosts are configured to store the IPSec SA information in the shadow SA cache.

### Claim 3 (depends on 2)

A system according to claim 2, wherein the routing communication protocol stack is further configured to decrypt the Transmission Control Protocol (TCP) header of received IPSec encapsulated datagrams to determine if the received datagram is associated with a DVIPA.

### Claim 4 (depends on 2)

A system according to claim 2, wherein the routing communication protocol stack is further configured to store an IPSec sequence number in a coupling facility.

### Claim 5 (depends on 2)

A system according to claim 2, wherein the communication protocol stacks at each of the target hosts are further configured to update a life-size count of the IKE associated with IPSec processed datagrams.