Detecting if a secure link is alive
View Patent ↗A communication system includes a data network that is coupled to various nodes, including routers. In one example arrangement, a first router is part of a first local network and a second router is part of a second local network. Each router includes a security gateway module and a keep-alive module. The security gateway module is capable of establishing a secure link, such as one according to an Internet Protocol Security (IPsec) protocol, over the data network. The keep-alive module sends one or more ping messages over the secure link to the remote router (or a node coupled to the router), which responds with appropriate ping replies to indicate that a link is alive.
1. A method of determining if a link is alive, comprising:
establishing a secure link between a first node and a second node according to a security protocol;
sending at least one ping message targeting the second node over the secure link, the at least one ping message defined outside the security protocol; and
monitoring for at least one ping reply to determine if a security association of the secure link is valid,
wherein sending the at least one ping message comprises sending at least one Internet Control Message Protocol message.
2. A system for communicating between a network element and a remote node, comprising:
a security module adapted to establish a secure link with the remote node, the secure link having a security mechanism according to a security protocol; and
a keep-alive module adapted to send at least one ping message over the secure link to the remote node, the at least one ping message defined outside the security protocol,
wherein the at least one ping message comprises an Internet Control Message Protocol message;
wherein the keep-alive module is adapted to further monitor for at least one ping reply responsive to the at least one ping message to determine if a security association of the secure link is valid.
3. A system for communicating between a network element and a remote node, comprising:
a security module adapted to establish a secure link with the remote node, the secure link having a security mechanism according to a security protocol; and
a keep-alive module adapted to send at least one ping message over the secure link to the remote node, the at least one ping message defined outside the security protocol,
wherein the at least one ping message is protected according to the security protocol,
wherein the keep-alive module is adapted to further monitor for at least one ping reply responsive to the at least one ping message to determine if a security association of the secure link is valid, the system further comprising a module adapted to establish a link over a secondary communication network if security association of the secure link is not valid.
4. The system of claim 3 , further comprising:
an interface to a packet-based network, the secure link established over the packet-based network; and
a layer to control communications over the packet-based network.
5. The system of claim 4 , wherein the layer comprises an Internet Protocol layer.
6. The system of claim 3 , wherein the security module is adapted to tear down the security association of the secure link if the secure link is not alive.
7. The system of claim 6 , wherein the security association comprises an Internet Protocol Security protocol security association.
8. The system of claim 3 , wherein the security protocol comprises an Internet Protocol Security protocol (IPsec), and wherein the at least one ping message is encrypted according to an IPsec security association.
9. A method comprising:
establishing a secure link between a first node and a second node according to an Internet Protocol Security (IPsec) protocol;
sending at least one ping message targeting the second node over the secure link, the at least one ping message defined outside the IPsec protocol; and
monitoring for at least one ping reply to determine if an IPsec security association of the secure link is valid,
wherein sending the at least one ping message comprises sending the at least one ping message protected according to the IPsec protocol.
10. The method of claim 9 , wherein establishing the secure link comprises establishing a virtual private network session.
11. The method of claim 9 , wherein sending the at least one ping message comprises sending at least one Internet Control Message Protocol message.
12. The method of claim 9 , wherein establishing the secure link comprises establishing the secure link between first and second nodes each comprising a security gateway.
13. The method of claim 12 , further comprising sending at least one ping message targeting another node connected to a network behind the second node.
14. The method of claim 13 , further comprising monitoring for at least one ping reply from the other node.
15. The method of claim 9 , further comprising tearing down the secure link if the IPsec security association is determined not to be valid.
16. The method of claim 15 , wherein tearing down the secure link comprises tearing down the IPsec security association.
17. A method of communicating with a remote node, comprising:
establishing a secure link between a first security gateway and a second security gateway, the remote node in communication with the second security gateway over a network separate from the secure link;
sending at least one ping message to the remote node over the secure link, through the second security gateway, and over the network; and
monitoring for at least one ping reply from the remote node to determine if a security association of the secure link is valid,
wherein establishing the secure link comprises establishing a secure link protected according to a security protocol,
wherein sending the at least one ping message comprises sending at least one ping message defined outside the security protocol,
wherein sending the at least one ping message comprises sending the at least one ping message protected according to the security protocol.
18. The method of claim 17 , wherein establishing the secure link comprises establishing a secure link protected according to an Internet Protocol Security protocol.
19. The method of claim 17 , wherein establishing the secure link comprises establishing a virtual private network session.
20. The method of claim 17 , wherein sending the at least one ping message comprises sending an Internet Control Message Protocol message.
21. The method of claim 20 , wherein establishing the secure link comprises establishing a secure link protected according to an Internet Protocol Security protocol.
22. The method of claim 17 , wherein the security protocol comprises an Internet Protocol Security protocol (IPsec), and wherein sending the at least one ping message comprises sending the at least one ping message encrypted according to an IPsec security association.
23. An article comprising at least one storage medium containing instructions for controlling communications, the instructions when executed causing a controller to:
establish a secure link between a first node and a second node according to a security protocol;
send at least one ping message targeting the second node over the secure link, the at least one ping message defined outside the security protocol; and
monitor for at least one ping reply to determine if a security association of the secure link is valid,
wherein sending the at least one ping message comprises sending the at least one ping message protected according to the security protocol.
24. The article of claim 23 , wherein the instructions when executed cause the controller to further establish an Internet Protocol security association for the secure link.
25. The article of claim 24 , wherein the instructions when executed cause the controller to tear down the security association if the controller does not receive the at least one ping reply.
26. The article of claim 23 , wherein the controller is part of the first node.
27. The article of claim 23 , wherein the security protocol comprises an Internet Protocol Security protocol (IPsec), wherein the security association of the secure link comprises an IPsec security association, and wherein sending the at least one ping message comprises sending the at least one ping message encrypted according to the IPsec security association.