US 7,849,495 B1 · Method and apparatus for passing security configuration information between a client and a security policy server

Abstract

Techniques for passing security configuration information between a security policy server and a client includes the client forming a request for security configuration information that configures the client for secure communications. The client is separated by an untrusted network from a trusted network that includes the security policy sever. A tag is generated that indicates a generic security configuration attribute. An Internet Security Association and Key Management Protocol (ISAKMP) configuration mode request message is sent to a security gateway on an edge of the trusted network connected to the untrusted network. The message includes the request in association with the tag. The gateway sends the request associated with the tag to the security policy server on the trusted network and does not interpret the request. The techniques allow client configuration extensions to be added by modifying the policy server or security client, or both, without modifying the gateway.

Claims36

Dependent claims

A method for passing security configuration information between a security policy server and a client, the method comprising the computer-implemented steps of:

forming a first request, at the client separated by an untrusted network from a trusted network that includes the security policy server, for security configuration information that configures the client for secure communications;
generating a tag that specifies a particular Internet Security Association and Key Management Protocol (ISAKMP) attribute type;
and
sending an Internet Security Association and Key Management Protocol (ISAKMP) configuration mode request message to a security gateway on an edge of the trusted network connected to the untrusted network, the message including the first request in association with the tag,
wherein the gateway sends the first request to the security policy server on the trusted network,
wherein:
when the tag is identified by the security gateway as specifying the particular ISAKMP attribute type, the gateway treats the first request as opaque data and does not interpret the first request, and
when the tag is identified by the security gateway as not specifying the particular ISAKMP attribute type, the gateway interprets the first request.

5 more elements

A method for passing security configuration information between a security policy server and a client, the method comprising the computer-implemented steps of:

receiving, at a security gateway on an edge of a trusted network connected to an untrusted network, the trusted network including the security policy server, an Internet Security Association and Key Management Protocol (ISAKMP) configuration mode request message from the client on the untrusted network, the message including a tag that specifies a particular Internet Security Association and Key Management Protocol (ISAKMP) attribute type and a first request for configuration information, wherein the first request is associated with the tag in the message;
and
in response to receiving the message:
when the tag is identified by the security gateway as specifying the particular ISAKMP attribute type, treating the first request as opaque data and sending the first request to the security policy server without interpreting the first request, and
when the tag is identified by the security gateway as not specifying the particular ISAKMP attribute type, sending the first request to the security policy server after interpreting the first request.

2 more elements

A non-transitory computer-readable medium storing one or more sequences of instructions for passing security configuration information between a security policy server and a client, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of:

receiving an Internet Security Association and Key Management Protocol (ISAKMP) configuration mode request message from a client on an untrusted network, the message including a tag that indicates a particular ISAKMP attribute type and a first request for configuration information, wherein the first request is associated with the tag in the message;
and
in response to receiving the message:
when the tag is identified by the security gateway as specifying the particular ISAKMP attribute type, treating the first request as opaque data and sending the first request to the security policy server without interpreting the first request, and
when the tag is identified by the security gateway as not specifying the particular ISAKMP attribute type, sending the first request to the security policy server after interpreting the first request.

2 more elements

An apparatus for passing security configuration information between a security policy server and a client, comprising:

a network interface capable of coupling to a data network for passing one or more packet flows thereon;
a processor;
and
means for receiving an Internet Security Association and Key Management Protocol (ISAKMP) configuration mode request message from a client on an untrusted network, the message including a tag that indicates a particular ISAKMP attribute type and a first request for configuration information, wherein the first request is associated with the tag in the message;
and
means for sending the first request to the security policy server without interpreting the first request in response to receiving the message;
wherein:
when the tag specifies the particular ISAKMP attribute type, the sending means treats the first request as opaque data and sends the first request to the security policy server without interpreting the first request;
and
when the tag does not specify the particular ISAKMP attribute type, the sending means sends the first request to the security policy server after interpreting the first request.

7 more elements

An apparatus for passing security configuration information between a security policy server and a client, comprising:

a network interface that is coupled to an untrusted data network for passing one or more packet flows thereon;
a processor;
and
a computer readable medium storing one or more sequences of instructions which, when executed by the processor, cause the processor to perform the steps of:
receiving an Internet Security Association and Key Management Protocol (ISAKMP) configuration mode request message from a client on the untrusted network, the message including a tag that specifies a particular ISAKMP attribute type and a first request for configuration information, wherein the first request is associated with the tag in the message;
and
in response to receiving the message:
when the tag is identified by the security gateway as specifying the particular ISAKMP attribute type, treating the first request as opaque data and sending the first request to the security policy server without interpreting the first request, and
when the tag is identified by the security gateway as not specifying particular ISAKMP attribute type, sending the first request to the security policy server after interpreting the first request.

6 more elements

forming a first request, at the client separated by an untrusted network from a trusted network that includes the security policy server, for security configuration information that configures the client for secure communications;
generating a tag that specifies a particular Internet Security Association and Key Management Protocol (ISAKMP) attribute type;
and
sending an Internet Security Association and Key Management Protocol (ISAKMP) configuration mode request message to a security gateway on an edge of the trusted network connected to the untrusted network, the message including the first request in association with the tag,
wherein the gateway sends the first request to the security policy server on the trusted network,
wherein:
when the tag is identified by the security gateway as specifying the particular ISAKMP attribute type, the gateway treats the first request as opaque data and does not interpret the first request, and
when the tag is identified by the security gateway as not specifying the particular ISAKMP attribute type, the gateway interprets the first request.

5 more elements

An apparatus for passing security configuration information between a security policy server and a client, comprising:

a network interface capable of coupling to a data network for passing one or more packet flows thereon;
a processor;
and
means for forming a first request, at the client separated by an untrusted network from a trusted network that includes the security policy server, for security configuration information that configures the client for secure communications;
means for generating a tag that specifies a particular Internet Security Association and Key Management Protocol (ISAKMP) attribute type;
and
means for sending an Internet Security Association and Key Management Protocol (ISAKMP) configuration mode request message to a security gateway on an edge of the trusted network connected to the untrusted network, the message including the first request in association with the tag,
wherein the gateway sends the first request to the security policy server on the trusted network,
wherein:
when the tag is identified by the security gateway as specifying the particular ISAKMP attribute type, the gateway treats the first request as opaque data and does not interpret the first request, and
when the tag is identified by the security gateway as not specifying the particular ISAKMP attribute type, the gateway interprets the first request.

8 more elements

An apparatus for passing security configuration information between a security policy server and a client, comprising:

a network interface that is coupled to an untrusted data network for passing one or more packet flows thereon;
a processor;
and
a computer readable medium storing one or more sequences of instructions which, when executed by the processor, cause the processor to perform the steps of:
forming a first request, at the client separated by an untrusted network from a trusted network that includes the security policy server, for security configuration information that configures the client for secure communications;
generating a tag that specifies a particular Internet Security Association and Key Management Protocol (ISAKMP) attribute type;
and
sending an Internet Security Association and Key Management Protocol (ISAKMP) configuration mode request message to a security gateway on an edge of the trusted network connected to the untrusted network, the message including the first request in association with the tag,
wherein the gateway sends the first request to the security policy server on the trusted network,
wherein:
when the tag is identified by the security gateway as specifying the particular ISAKMP attribute type, the gateway treats the first request as opaque data and does not interpret the first request, and
when the tag is identified by the security gateway as not specifying the particular ISAKMP attribute type, the gateway interprets the first request.

9 more elements

Dependencies are inferred from the claim text.

Method and apparatus for passing security configuration information between a client and a security policy server

Life of this patent

Method and apparatus for passing security configuration information between a client and a security policy server

Life of this patent

Abstract

Claims36