# US 2009/0158040 A1 · Method and system for secure exchange of data in a network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2009/0158040 A1 - Document ID: US20090158040A1 - Status: Published application - Kind: A1 - Application number: 11/955,832 - Filed: 2007-12-13 - Published: 2009-06-18 - Earliest claimed: 2007-12-13 - Assignees: Motorola, Inc. - Inventors: RENU CHAUDHARY; CYNTHIA M. JUNG; JOSEPH T. SUN; PAWAN BHATIA; CHRISTOPHER G. CORMIER - Web page: https://patentgrep.com/patent/US20090158040A1 ## CPC - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A first network device implements a method for the secure exchange of data in a network. The network also includes a second network device and a remote device. The method includes establishing an indirect path to the remote device and pre-negotiating first security parameters with the remote device over the indirect path using a network layer protocol, when the second network device has an active first data link. The method further includes establishing an active second data link with the remote device and exchanging first data with the remote device over the active second data link using the first security parameters, when the first data link becomes inactive. ## Claims ### Claim 1 A method for secure exchange of data in a network comprising a first network device, a second network device, and a remote device, the method comprising: at the first network device: when the second network device has an active first data link with the remote device, establishing an indirect path to the remote device and pre-negotiating first security parameters with the remote device over the indirect path using a network layer protocol; when the first data link becomes inactive, establishing an active second data link with the remote device and exchanging first data with the remote device over the active second data link using the first security parameters. ### Claim 2 (depends on 1) The method as recited in claim 1, wherein the indirect path comprises a Private Virtual Circuit (PVC) of the second network device and a data link between the first network device and the second network device. ### Claim 3 (depends on 2) The method as recited in claim 2, wherein the second network device and the remote device exchange second data over the active first data link using second security parameters that were negotiated between the second network device and the remote device over the PVC of the second network device using the network layer protocol. ### Claim 4 (depends on 3) The method as recited in claim 3 further comprising sending a header comprising a System Internet Protocol (SysIP) address that is used by the remote device to identify that the header was sent from the second network device. ### Claim 5 (depends on 4) The method as recited in claim 4, wherein the SysIP address is further used by the remote device to determine that the active second data link is with the first network device instead of the second network device. ### Claim 6 (depends on 4) The method as recited in claim 4, wherein the header further comprises a Security Parameter Index (SPI) that is used by the remote device to identify security parameters to use for exchanging the first data over the active second data link. ### Claim 7 (depends on 1) The method as recited in claim 1, wherein exchanging the first data using the first security parameters comprises encrypting and decrypting the first data using the first security parameters. ### Claim 8 (depends on 1) The method as recited in claim 1, wherein the first data is exchanged using a data link protocol. ### Claim 9 (depends on 8) The method as recited in claim 8, wherein the data link protocol is a Frame Relay Fragmentation (FRF.17) protocol. ### Claim 10 (depends on 1) The method as recited in claim 1, wherein the network layer protocol is an Internet Key Exchange (IKE) protocol. ### Claim 11 (depends on 10) The method as recited in claim 10, wherein the IKE protocol uses a Digital Certificate or a Pre-Shared Key (PSK) for pre-negotiating the first security parameters. ### Claim 12 (depends on 1) The method as recited in claim 1, wherein pre-negotiating the first security parameters comprises: establishing a secure tunnel by performing initial authentication with the remote device; pre-negotiating the first security parameters with the remote device over the indirect path using the secure tunnel. ### Claim 13 A first network device in a network further comprising a second network device and a remote device, the first network device comprising: a processing device pre-negotiating first security parameters with a remote device by establishing an indirect path to the remote device when the second network device has an active first data link with the remote device, wherein the first security parameters are pre-negotiated using a network layer protocol; an interface for exchanging first data with the remote device over an active second data link using the pre-negotiated first security parameters, wherein the active second data link is established with the remote device when the first data link becomes inactive. ### Claim 14 (depends on 13) The first network device of claim 13, wherein the first network device is a core router in a Wide Area Network. ### Claim 15 (depends on 13) The first network device of claim 13, wherein the interface is coupled to a relay switch that establishes the active second data link with the remote device when the first data link becomes inactive. ### Claim 16 (depends on 13) The first network device of claim 13, wherein the processing device pre-negotiates the first security parameters through Internet Key Exchange (IKE) protocol using a Digital Certificate or a Pre-Shared Key (PSK). ### Claim 17 (depends on 13) The first network device of claim 13, wherein the processing device uses the pre-negotiated first security parameters to encrypt and decrypt the first data while exchanging the first data with the remote device.