Method of negotiating security parameters and authenticating users interconnected to a network

A computer storage medium not consisting of a propagated signal for executing computer-readable instructions for executing a security policy at a first network device wherein the first network device is communicatively coupled to a second network device over a computer network, comprising:

• initiating a first main mode negotiation at the first network device by sending a first main mode message with a first set of proposed security parameters;
• determining, at the first network device, that the first main mode negotiation is unsuccessful, wherein the determination is based at least in part on a first response message received from the second network device;
• in response to receiving the first response message, initiating a second main mode negotiation at the first network device by sending a second main mode message with a second set of proposed security parameters;
• and
• receiving a second response message comprising at least part of the second main mode negotiation and at least part of a quick mode negotiation, wherein the second response message comprises a main mode pseudo random number and a separate quick mode pseudo random number.

A system for executing a security policy at a first network device wherein the first network device is communicatively coupled to a second network device over a computer network, the system comprising:

• one or more processing units;
• a memory coupled with and readable by the one or more processing units, the memory containing a series of instructions that, when executed by the one or more processing units, cause the one or more processing units to perform a method of executing a security policy comprising the steps of:
• receiving a packet;
• determining if the packet must be sent securely;
• if the packet must be sent securely, initiating a security policy, wherein initiating a security policy comprises:
• initiating a first main mode negotiation at a first network device by sending a first main mode message with a first set of proposed security parameters;
• determining, at the first network device, that the first main mode negotiation is unsuccessful, wherein the determination is based at least in part on a response message received from the second network device;
• in response to receiving the first response message, initiating a second main mode negotiation at the first network device by sending a second main mode message with a second set of proposed security parameters;
• receiving a second response message in response to the second main mode message, wherein the second response message comprises at least part of a quick mode negotiation for deriving a set of keys.