# US 2008/0313461 A1 · Security association verification and recovery > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2008/0313461 A1 - Document ID: US20080313461A1 - Status: Published application - Kind: A1 - Application number: 11/762,321 - Filed: 2007-06-13 - Published: 2008-12-18 - Earliest claimed: 2007-06-13 - Assignees: Cisco Technology, Inc. - Inventors: Frederic R. P. Detienne - Web page: https://patentgrep.com/patent/US20080313461A1 ## CPC - H04L 63/123: {received data contents, e.g. message integrity} - H04L 63/164: {at the network layer} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Example embodiments herein include a verification process that provides a safe and efficient mechanism for recovering security associations between network devices. More specifically, the verification process transmits a secured message from a first network device to a second network device across a network. Furthermore, the security association includes a parent process and a corresponding child process. The verification process detects, at the first network device, an incompatibility in the security association between the first network device and the second network device. Next, the verification process transmits a status query from the first network device to the second network device in order to determine the status of the security association between the first network device and the second network device. In response, the verification process receives a verifiable reply message that is indicative of the status of the security association between the first network device and the second network device. ## Claims ### Claim 1 A method comprising: transmitting, from a first network device, a secured message to a second network device across a network, the first network device and the second network device having a previous security association including a parent process and a corresponding child process; detecting, at the first network device, an incompatibility in the security association between the first network device and the second network device; transmitting, from the first network device, a status query to the second network device in order to determine the status of the security association between the first network device and the second network device; and in response to transmitting the status query, receiving a verifiable reply message that is indicative of the status of the security association between the first network device and the second network device. ### Claim 2 (depends on 1) The method of claim 1 wherein detecting, at the first network device, an incompatibility in the security association between the first network device and the second network device comprises: receiving an unsecured message indicating that the second network device does not have the child process of the security association. ### Claim 3 (depends on 2) The method of claim 2 wherein transmitting, from the first network device, a status query to the second network device comprises: in response to receiving the unsecured message, transmitting, from the first network device, a secured status message to the second network device in order to verify the child process of the security association, the secured message being transmitted in accordance with the previous security association between the first network device and the second network device. ### Claim 4 (depends on 3) The method of claim 3 further comprising: receiving an unsecured message indicating that the second network device does not have the parent process of the security association; and in response, transmitting, from the first network device, an unsecured status query to the second network device in order to verify the parent process of the security association, wherein the unsecured status query includes a verification code for determining the authenticity of any message received by the first network device in response to the unsecured status query transmitted to the second network device. ### Claim 5 (depends on 1) The method of claim 1 wherein receiving a verifiable reply message that is indicative of the status of the security association between the first network device and the second network device comprises: receiving a reply message with a verification code, the reply message indicating that the second network device has the parent process of the security association; and processing the verification code in order to determine the authenticity of the reply message. ### Claim 6 (depends on 1) The method of claim 1 wherein receiving a verifiable reply message that is indicative of the status of the security association between the first network device and the second network device comprises: receiving a reply message with a verification code, the reply message indicating that the second network device does not have the parent process of the security association; and processing the verification code in order to determine the authenticity of the reply message. ### Claim 7 (depends on 6) The method of claim 6 further comprising: when the processing of the verification code determines that the authenticity of the reply message is valid, then initiating, from the first network device, renegotiation of a security association between the second network device and the first network device. ### Claim 8 (depends on 1) The method of claim 1 wherein detecting, at the first network device, an incompatibility in the security association between the first network device and the second network device comprises: receiving an unsecured message indicating that the second network device does not have the parent process of the security association. ### Claim 9 (depends on 8) The method of claim 8 wherein transmitting, from the first network device, a status query to the second network device comprises: in response to receiving the unsecured message, transmitting, from the first network device, an unsecured status query to the second network device in order to verify the child process of the security association, wherein the unsecured status query includes a verification code for determining the authenticity of any message received by the first network device in response to the unsecured status query transmitted to the second network device. ### Claim 10 (depends on 1) The method of claim 1 wherein receiving a reply message that is indicative of the status of the security association between the first network device and the second network device comprises: receiving a reply message with a verification code, the reply message indicating that the second network device has the child process of the security association; and processing the verification code in order to determine the authenticity of the reply message. ### Claim 11 (depends on 1) The method of claim 1 wherein receiving a reply message that is indicative of the status of the security association between the first network device and the second network device comprises: receiving a reply message with a verification code, the reply message indicating that the second network device does not have the child process of the security association; and processing the verification code in order to determine the authenticity of the reply message. ### Claim 12 (depends on 11) The method of claim 11 further comprising: when the processing of the verification code determines that the authenticity of the reply message is valid, then initiating, from the first network device, renegotiation of a security association between the second network device and the first network device. ### Claim 13 (depends on 1) The method of claim 1 wherein transmitting, from the first network device, a status message to the second network device comprises: generating a verification code to be included with the status query, the verification code enabling authentication of any message received by the first network device in response to the status query, the verification code further comprising a time dependent key that is used in calculating a checksum of at least one of the verification code and the message that is received in response to the status query. ### Claim 14 (depends on 1) The method of claim 1 further comprising: providing a dampening mechanism in order to mitigate the effect of a denial of service attack, the dampening mechanism causing the first network device to ignore messages transmitted from other network devices in the network for a predetermined dampening time, wherein providing a dampening mechanism is in response to at least one of: receiving an error message involving a security association that was logged by a suspect network device, the dampening mechanism causing the first network device to ignore messages transmitted by the suspect network device for the predetermined dampening time; and receiving the verifiable reply message from the suspect network device that is indicative of the status of the security association between the first network device and the suspect network device, the dampening mechanism causing the first network device to ignore messages transmitted by the suspect network device for the predetermined dampening time. ### Claim 15 (depends on 1) The method of claim 1 further comprising: providing a throttling mechanism in order to mitigate the effect of a denial of service attack, the throttling mechanism limiting the rate at which network devices can transmit status messages to other network devices in the network. ### Claim 16 A system comprising: a first network device comprising: a memory; a processor; a communications interface; an interconnection mechanism coupling the memory, the processor and the communications interface; and wherein the memory is encoded with a security verification application that when executed on the processor provides a security verification process causing the first network device to be capable of performing the operations of: transmitting, from the first network device, a secured message to a second network device across a network, the first network device and the second network device having a previous security association including a parent process and a corresponding child process; detecting, at the first network device, an incompatibility in the security association between the first network device and the second network device; transmitting, from the first network device, a status query to the second network device in order to determine the status of the security association between the first network device and the second network device; and in response to transmitting the status query, receiving a verifiable reply message that is indicative of the status of the security association between the first network device and the second network device. ### Claim 17 (depends on 16) The system of claim 16 wherein transmitting, from the first network device, a status query to the second network device comprises: in response to receiving the unsecured message, transmitting, from the first network device, a secured status message to the second network device in order to verify the child process of the security association, the secured message being transmitted in accordance with the previous security association between the first network device and the second network device; receiving an unsecured message indicating that the second network device does not have the parent process of the security association; and in response, transmitting, from the first network device, an unsecured status query to the second network device in order to verify the parent process of the security association, wherein the unsecured status query includes a verification code for determining the authenticity of any message received by the first network device in response to the unsecured status query transmitted to the second network device. ### Claim 18 (depends on 16) The system of claim 16 wherein receiving a verifiable reply message that is indicative of the status of the security association between the first network device and the second network device comprises: receiving a reply message with a verification code, the reply message indicating that the second network device does not have the parent process of the security association; processing the verification code in order to determine the authenticity of the reply message; and when the processing of the verification code determines that the authenticity of the reply message is valid, then initiating, from the first network device, renegotiation of a security association between the second network device and the first network device. ### Claim 19 (depends on 16) The system of claim 16 wherein transmitting, from the first network device, a status message to the second network device comprises: generating a verification code to be included with the status query, the verification code enabling authentication of any message received by the first network device in response to the status query, the verification code further comprising a time dependent key that is used in calculating a checksum of at least one of the verification code and the message that is received in response to the status query. ### Claim 20 A system comprising: a first network device comprising: a memory; a processor; a communications interface; an interconnection mechanism coupling the memory, the processor and the communications interface; and wherein the memory is encoded with a security verification application that when executed on the processor provides a security verification process causing the first network device to be capable of performing the operations of: receiving, at the first network device, a status query from a second network device, the status query operable to ascertain the status of the security association between the first network device and the second network device; determining, at the first network device, the status of the security association between the first network device and the second network device; and in response, transmitting a verifiable reply message to the second network device, the verifiable message including the status of the security association as determined by the first network device.