Patent Application
20050083926
The following description relates to telecommunications in general and to the Internet Protocol Security Protocol in particular.
The Internet Protocol (IP) Security Protocol (IPSEC) is a set of protocols developed by the Internet Engineering Task Force (IETF) IP Security Protocol Working Group to support secure exchange of packets between two nodes at the IP network layer. IPSEC provides many options for performing network encryption and authentication. In order for two nodes to exchange secured packets, the two nodes must agree on how they are going to identify themselves and process packets. This agreement is known as a security association (SA). A security association specifies information such as what authentication, encryption and/or compression algorithms are to be used, the shared session keys, the key lifetimes, the lifetime of the security association itself.
There are two types of security associations, the Internet Security Association Key Management Protocol (ISAKMP) security associations (also referred to here as “IKE security associations”) and IPSEC security associations. An IKE security association is bidirectional and provides a secure communication channel between the two parties that can be used to negotiate further communications in accordance with the IKE protocol. An IPSEC security association is unidirectional and is used for the actual communication between devices. For a two-way IPSEC connection between two nodes, there must be at least two IPSEC security associations, one in each direction. Hereinafter, references to a “security association” or “security associations” refer to IPSEC security security associations.
One feature typically included in an IPSEC and IKE implementations is known as “on-demand” negotiation. In such implementations, when a packet at a first node is to be transmitted to a second node, access control lists (or similar mechanisms) are checked to determine if the packet matches an IPSEC security policy set on the first node. If the packet matches an IPSEC security policy, the packet is transformed and transmitted to the second node in accordance with the IPSEC protocol.
Before the packet is transformed and transmitted in accordance with the IPSEC protocol, a check is made to determine if the necessary security associations are available for the IPSEC connection over which the packet is to be transmitted. If the necessary security associations are available, then the packet is transformed and transmitted to the second node in accordance with the IPSEC protocol over the IPSEC connection. If the necessary security associations are not available, the first node negotiates with the second node in accordance with the IKE protocol to set up the necessary security associations and the IPSEC connection. The necessary security associations will not be available, for example, if the IPSEC connections have not been set up in the first place or if previously set-up security associations have expired.
During the window of time when the security associations are not available and the IPSEC connection is not setup, the initial packet and any subsequent packets intended to be transmitted over that IPSEC connection are dropped until the security associations and the IPSEC connection are set up. Once the necessary security associations and the IPSEC connection have been set up, subsequent packets that are to be transmitted over the IPSEC connection are transformed and transmitted to the second node in accordance with the IPSEC protocol over the IPSEC connection.
In some applications, however, it is desirable to avoid dropping such packets when necessary security associations and the IPSEC connection are not available.
In one embodiment, a method includes, when a packet is to be sent over a secured connection, determining if the secured connection is set up. The method also includes, when the secured connection is not set up, storing the packet and, after storing the packet, when the secure connection is set up, retrieving the packet and transmitting the packet over the secured connection.
In another embodiment, a system includes a networking subsystem, a security subsystem, a negotiation subsystem, and a packet store. When the networking subsystem generates a packet that is to be transmitted over a secure connection, the networking subsystem determines if the secure connection is set up. When the secure connection is set up, the networking subsystem signals the negotiation subsystem to set up the secure connection and stores the packet in the packet store. After storing the packet, the security subsystem periodically determines whether the secure connection is set up. When the security subsystem determines that the secure connection is set up, the packet is retrieved from the packet store and the security subsystem transforms the packet and transmits the packet over the secure connection.
In another embodiment, a system includes a networking subsystem, an internet protocol security protocol subsystem, an internet key exchange subsystem, and a packet store. When the networking subsystem generates a packet that is to be transmitted over an internet protocol security protocol connection, the networking subsystem determines if a security association associated with the internet protocol security protocol connection exists. When the security association does not exist, the networking subsystem signals the internet key exchange subsystem to negotiate the security association and stores the packet in the packet store. After storing the packet, the internet protocol security protocol subsystem periodically determines whether the security association exists for the internet protocol security protocol connection. When the internet protocol security protocol subsystem determines that the security association exists for the internet protocol security protocol connection, the packet is retrieved from the packet store and the internet protocol security protocol subsystem transforms the packet and transmits the packet over the internet protocol security protocol connection in accordance with the internet protocol security protocol.
Another embodiment is a programmable-processor readable medium on which program instructions are stored. The program instructions are operable to cause a programmable processor to, when a packet is to be sent over a secured connection, determine if the secured connection is set up. The program instructions are further operable to cause the programmable processor to, when the secured connection is not set up, store the packet and, after storing the packet, when the secure connection is set up, retrieve the packet and transmitting the packet over the secured connection.
In another embodiment, a cable modem termination system includes a radio frequency interface that, when the cable modem termination system is coupled to a hybrid-fiber coaxial cable network, communicates with the hybrid-fiber coaxial cable network. The cable modem termination system further includes an second interface that, when the cable modem termination system is coupled to an upstream network, communicates with the upstream network. The cable modem termination system further includes a programmable processor coupled to the radio frequency interface and the second interface and memory coupled to the programmable processor. Program instructions are stored in the memory that, when executed on the programmable processor, cause the cable modem termination system to, when a packet is to be sent over an internet protocol security protocol connection, determine if a security association associated with the internet protocol security protocol connection exists. The program instructions, when executed on the programmable processor, cause the cable modem termination system to, when the security association does not exist, store the packet in a packet store and, after the packet is stored, periodically determine whether the security association exists for the internet protocol security protocol connection. The program instructions, when executed on the programmable processor, cause the cable modem termination system to, when the security association exists for the internet protocol security protocol connection, retrieve the packet from the packet store and transmit the packet over the internet protocol security protocol connection.
In another embodiment, a network interface module includes an external network interface that, when the network interface module is coupled to an external network, couples the network interface module to the external network. The network interface module further includes a backplane interface that, when the network interface module is coupled to a backplane, communicates with the backplane. The network interface module further includes a programmable processor coupled to the external network interface and the backplane interface, and memory coupled to the programmable processor. Program instructions are stored in the memory that, when executed on the programmable processor, cause the network interface module to, when a packet is to be sent over an internet protocol security protocol connection, determine if a security association associated with the internet protocol security protocol connection exists. The program instructions, when executed on the programmable processor, cause the network interface module to, when the security association does not exist, store the packet in a packet store, and, after the packet is stored, periodically determine whether the security association exists for the internet protocol security protocol connection. The program instructions, when executed on the programmable processor, cause the network interface module to, when the security association exists for the internet protocol security protocol connection, retrieve the packet from the packet store and transmit the packet over the internet protocol security protocol connection.
The details of one or more embodiments of the claimed invention are set forth in the accompanying drawings and the description below. Other features and advantages will become apparent from the description, the drawings, and the claims.
Like reference numbers and designations in the various drawings indicate like elements.
In one implementation of such an embodiment, security associations are established using the IKE protocol. The process of negotiating the various parameters of one or more security association using the IKE protocol is referred to here as “setting up” the IPSEC connection and/or the security associations. While the IPSEC connection and the related security associations are being set up, packets cannot be transmitted over that IPSEC connection.
When a packet is to be sent over a secure connection (checked in block 102 shown in
If the secure connection has been set up, the packet is transformed and transmitted over the secure connection (block 106). In the embodiment shown in
Instead of dropping the packet while the secure connection is being setup, the packet is stored. In the embodiment of method 100 shown in
In the particular embodiment shown in
As shown in
With embodiments of method 100, the number of packets that are dropped while an IPSEC connection is being set up is reduced. This reduces the likelihood that a higher-level application or protocol will be adversely affected. For example where the higher-level application provides a voice-over-IP connection, embodiments of method 100 will reduce the likelihood that a call will be dropped due to the dropping of packets.
The system 200 includes a networking subsystem 202 that handles the core transport control protocol/internet protocol (TCP/IP) stack processing, an IPSEC subsystem 204 that implements the IPSEC protocols in order to provide security functionality (authentication, encryption, etc.), and an IKE subsystem 206 that implements the IKE protocol in order to negotiate security associations used by the IPSEC subsystem 204. In one implementation, the networking subsystem 202, the IPSEC subsystem 204, and the IKE subsystem 206 are each implemented using one or more separate tasks that are executed on one or more programmable processors. In such an implementation, the various tasks communicate with one another using some form of inter process communication (IPC).
In the embodiment of system 200 shown in
Also, the system 200 includes a retry packet queue 210. While an IPSEC connection and the associated security associations are being set up by the IKE subsystem 206, packets cannot be transmitted over that IPSEC connection. In the embodiment shown in
In one implementation, the retry packet queue 210 is implemented as a dynamic, doubly linked list in which each packet stored in the queue 210 is stored in an element of the doubly linked list. In such an implementation, each element of the doubly linked list includes a pointer or other reference to the next element (if any) in the queue 210 and a pointer or other reference to the previous element (if any) in the queue 210. Using such a doubly linked list to implement the queue 210 makes it easier to implement functions that check all the packets stored in the queue 110 at a given point in time. An example of one such function is a function that checks each packet stored in the queue 110 to see if that packet has been stored in the queue 110 for an amount of time that is longer than a specified maximum storage time. Such a function can easily determine the next element in the queue 210 (which contains the next packet stored in the queue 110) using the pointer to the next element in the queue 110.
In the embodiment shown in
One embodiment of method 100 shown in
If the packet does not match an IPSEC security policy set for the transmitting node, the packet is transmitted to the destination node by the networking subsystem 202 without using the IPSEC protocol (block 306). If the packet does match a security policy set for the transmitting node, the networking subsystem 202 of the transmitting node checks if the IPSEC connection over which the packet is to be transmitted to the destination node has been set up. Specifically, the networking subsystem 102 checks if the security associations for that IPSEC connection exist (block 308). If the security associations exist for the IPSEC connection, the packet is passed to the IPSEC subsystem 204 for transformation and transmission in accordance with the IPSEC protocol (block 310).
If the security associations do not exist for the IPSEC connection, the networking subsystem 202 signals the IKE subsystem 206 to negotiate with the destination node to attempt to establish the necessary security associations for the IPSEC connection (block 312). As noted above, while the IKE subsystem 206 negotiates security associations for the IPSEC connection, the packet cannot be transmitted over that connection. Instead of being dropped, the packet is stored in queue 210.
In the embodiment shown in
Also, the networking subsystem 202 checks if a memory constraint established for the queue 210 will still be satisfied by storing the packet in the queue 210 (block 316 as shown in
Next, the callback function 400 determines if the security associations have been established yet for the IPSEC connection over which the first packet is to be transmitted (checked in block 406). The callback function 400 communicates with the IKE subsystem 206 to make this determination. If the security associations for the first packet have been set up, then the first packet is transformed and transmitted over the IPSEC connection by the IPSEC subsystem 204 in accordance with IPSEC protocol (block 408) and the resources used to store the first packet in the queue 210 are freed up (block 410).
If the security associations for the first packet have not been set up, the IPSEC subsystem 204 determines if the most recent attempt by the IKE subsystem 206 to establish the security associations for the first packet has failed (block 412 shown in
If there is a another packet in the queue 210 (checked in block 416), then the call back function 400 identifies the next packet in the queue 210 (block 418). Then the call back function 400 is repeated for that next packet. Otherwise, the call back function 400 terminates when all the packets store in queue 210 have been checked. As shown in
Otherwise, the time constraint information for the packet is updated (block 512). For example, in one implementation, the time constraint information includes a counter that counts the number of constraint check intervals that have elapsed while the packet has been stored in the queue 210. The time constraint information is updated by incrementing the counter each time the constraint check interval elapses. In such an implementation, the maximum storage time is expressed as a number of constraint check intervals and when the counter equals (or exceeds) that number, the packet has been stored in the queue 210 longer than the maximum storage time and will be removed from the queue 210 the packet is checked.
If there is a next packet in the queue 210 (checked in block 514), then the next packet in the queue 210 is identified (block 516). Then the method 500 is repeated for that next packet. Otherwise, method 500 terminates when all the packets stored in queue 210 are checked. As shown in
Each of the cable modem termination systems 612 is coupled to a separate group 614 of cable modems 608 over the hybrid fiber coax infrastructure 606 of the cable system 600. An RF switch 616 interfaces each of the cable modem termination systems 612 to the group 614 of cable modems 608 serviced by that CMTS 612. In one implementation of such an embodiment, the RF switch 616 is a part of the access switch 610.
The access switch 610 also includes one or more power supplies 618 that provide power to the various components of the access switch 610. The access switch 610 includes one or more network interface modules 620 that couple the access switch 610 to a network external to the access switch 610. In the embodiment shown in
The access switch 610 also includes a management module 626 that, in one embodiment, runs software that monitors and controls the operation of the access switch 610. The management module 626 communicates with the other modules housed in the access switch 610 over a management bus 632. In one implementation of such an embodiment, two redundant management modules 626 are housed in access switch 610, each of which communicates with the modules of access switch 610 over one of two redundant management buses 632.
The RF interface 650 couples the CMTS 612 to the cable modems 608 over a single downstream channel. For example, in a DOCSIS-based CMTS 612, the downstream channel is a 6 megahertz channel located in the frequency range of 50 megahertz to as high as 850 megahertz. The RF interface 650 converts downstream digital packets into modulated analog frames using quadrature amplitude modulation (for example, 64 QAM or 256 QAM), forward error correcting (FEC) code, and packet interleaving. The RF interface 650 upconverts the modulated analog frames into the downstream RF frequency range. The upconverted signal is then output to the RF switch 616 (not shown in
The RF interface 650 also couples the CMTS to the cable modems 608 over multiple upstream channels. In exemplary implementations, four, six, or eight upstream channels are used. In one such implementation, the upstream channels are up to 6 megahertz wide (in the case of DOCSIS 2.0) and are located in the frequency range of 5 megahertz to 42 megahertz.
The RF interface 650 in the embodiment shown in
The CMTS 612 includes a backplane interface 652. The backplane interface 652 couples the CMTS 612 to the backplane 630 of the access switch 610. The backplane interface 652 sends packets to and receives packets from other modules housed with the access switch 610 via the backplane 630. For example, the backplane interface 652 provides an interface that couples the CMTS 612 to an upstream network (for example, the WAN 622) over the backplane 630 and the network interface module 620.
The CMTS 612 also includes a management bus interface 654 that is used couple CMTS 612 to the management bus 632. In embodiments of access switch 610 where two redundant management modules 626 and management buses 632 are provided, the CMTS 612 includes two management bus interfaces 654 for coupling the CMTS 612 to the two management buses 632.
The CMTS 612 also includes at least one processor 656 and at least one memory 658 coupled to the processor 656. Program instructions that are executed by the processor 656 are stored in memory 658. The program instructions, when executed by processor 656, cause the CMTS 612 to carry out all or a part of the functionality described herein in connection with
The network interface module 620 includes a backplane interface 662. The backplane interface 662 couples the network interface module 620 to the backplane 630 of the access switch 610. The backplane interface 662 sends packets to and receives packets from other modules housed with the access switch 610 via the backplane 630.
The network interface module 620 also includes a management bus interface 664 that is used couple network interface module 620 to the management bus 632. In embodiments of access switch 610 where two redundant management modules 626 and management buses 632 are provided, the network interface module 620 includes two management bus interfaces 664 for coupling the network interface module 620 to the two management buses 632.
The network interface module 620 also includes at least one processor 666 and at least one memory 668 coupled to the processor 666. Program instructions that are executed by the processor 666 are stored in memory 668. The program instructions, when executed by processor 666, cause the network interface module 620 to carry out all or a part of the functionality described herein in connection with
The methods and techniques described here may be implemented in digital electronic circuitry, or with a programmable processor (for example, a special-purpose processor or a general-purpose processor such as a computer) firmware, software, or in combinations of them. Apparatus embodying these techniques may include appropriate input and output devices, a programmable processor, and a storage medium tangibly embodying program instructions for execution by the programmable processor. A process embodying these techniques may be performed by a programmable processor executing a program of instructions to perform desired functions by operating on input data and generating appropriate output. The techniques may advantageously be implemented in one or more programs that are executable on a programmable system including at least one programmable processor coupled to receive data and instructions from, and to transmit data and instructions to, a data storage system, at least one input device, and at least one output device. Generally, a processor will receive instructions and data from a read-only memory and/or a random access memory. Storage devices suitable for tangibly embodying computer program instructions and data include all forms of non-volatile memory, including by way of example semiconductor memory devices, such as EPROM, EEPROM, and flash memory devices; magnetic disks such as internal hard disks and removable disks; magneto-optical disks; and DVD disks. Any of the foregoing may be supplemented by, or incorporated in, specially designed application-specific integrated circuits (ASICs).
A number of embodiments of the invention defined by the following claims have been described. Nevertheless, it will be understood that various modifications to the described embodiments may be made without departing from the spirit and scope of the claimed invention. Accordingly, other embodiments are within the scope of the following claims.
