System and method for multiple virtual private network authentication schemes
View Patent ↗A system and method for providing multiple virtual private networks from a computer system. The computer system communicates with a remote computer system in order to allow encrypted data traffic to flow between the respective systems. Two phases are used to authenticate the computer systems to one another. During the first phase, digital certificates or pre-shared keys are used to authenticate the computer systems. A phase 1 ID rules list contains authentication rules for local-remote computer pairs. During the second phase, a hash value is used to authenticate the computer systems and a security association payload is created. The remote system's IP address is used for connecting. The phase 1 ID rules list corresponds to one or more phase 2 ID rules lists. If the remote ID is not found in the phase 2 ID rules list, a default rule is used based upon the phase 1 ID rules list.
1. A method of establishing a secure communication path between a computer system and a remote computer system comprising:
exchanging identification data with the remote computer system using a communication path;
determining, based on the identification data, whether a predefined security policy exists corresponding to the remote computer system, wherein the predefined security policy defines at least one constraint on security associations (SAs) created in accordance with the predefined security policy; and
establishing a secure communication path using a default security policy in response to determining that the predefined security policy does not exist, wherein the default security policy defines at least one constraint on security associations (SAs) created in accordance with the default security policy.
2. The method as described in claim 1 wherein the identification data is selected from the group consisting of a gateway address, a host name, a user identifier, an IP address, and a distinguished name.
3. The method as described in claim 1 wherein establishing the secure communication path further includes:
determining whether a digital certificate or a pre-shared key is used for encrypting data.
4. The method as described in claim 1 further comprising:
searching a group table for a group identifier corresponding to the remote computer system;
wherein the predefined security policy corresponds to the group identifier in response to a successful group identifier search.
5. The method as described in claim 1 further comprising:
selecting a proposal and transforms corresponding to the default security policy;
creating a security association payload using the selected proposal and transforms; and
sending the security association from one computer system to the remote computer system.
6. The method as described in claim 5 further comprising:
receiving a response from the remote computer system;
determining whether the proposal was accepted by the other computer system; and
verifying identification information in response to the proposal being accepted.
7. The method as described in claim 1 further comprising:
verifying a remote identifier and a digital signature corresponding to the remote computer system; and
creating the secure communication path to the remote computer system in response to the verification.
8. An information handling system comprising:
one or more processors;
a memory accessible by the processors;
a nonvolatile storage accessible by the processors;
a network interface connecting the information handling system to a computer network; and
a network tool for creating a secure communication path to a remote computer system, the network tool including:
means for exchanging identification data with the remote computer system using a communication path;
means for determining, based on the identification data, whether a predefined security policy exists corresponding to the remote computer system, wherein the predefined security policy defines at least one constraint on security associations (SAs) created in accordance with the predefined security policy; and
means for establishing a secure communication path using a default security policy in response to determining that the predefined security policy does not exist, wherein the default security policy defines at least one constraint on security associations (SAs) created in accordance with the default security policy.
9. The information handling system as described in claim 8 wherein the identification data is selected from the group consisting of a gateway address, a host name, a user identifier, an IP address, and a distinguished name.
10. The information handling system as described in claim 8 wherein the means for establishing the secure communication path further includes:
means for determining whether a digital certificate or a pre-shared key is used for encrypting data.
11. The information handling system as described in claim 8 further comprising:
means for searching a group table for a group identifier corresponding to the remote computer system;
wherein the predefined security policy corresponds to the group identifier in response to a successful group identifier search.
12. The information handling system as described in claim 8 further comprising:
means for selecting a proposal and transforms corresponding to the default security policy;
means for creating a security association payload using the selected proposal and transforms; and
means for sending the security association from one computer system to the remote computer system.
13. The information handling system as described in claim 12 further comprising:
means for receiving a response from the remote computer system;
means for determining whether the proposal was accepted by the other computer system; and
means for verifying identification information in response to the proposal being accepted.
14. A computer program product stored on a computer operable medium for establishing a secure communication path between a computer system and a remote computer system comprising:
means for exchanging identification data with the remote computer system using a communication path;
means for determining, based on the identification data, whether a predefined security policy exists corresponding to the remote computer system, wherein the predefined security policy defines at least one constraint on security associations (SAs) created in accordance with the predefined security policy; and
means for establishing a secure communication path using a default security policy in response to determining that the predefined security policy does not exist, wherein the default security policy defines at least one constraint on security associations (SAs) created in accordance with the default security policy.
15. The computer program product as described in claim 14 wherein the identification data is selected from the group consisting of a gateway address, a host name, a user identifier, an IP address, and a distinguished name.
16. The computer program product as described in claim 14 wherein the means for establishing the secure communication path further includes:
means for determining whether a digital certificate or a pre-shared key is used for encrypting data.
17. The computer program product as described in claim 14 further comprising:
means for searching a group table for a group identifier corresponding to the remote computer system;
wherein the predefined security policy corresponds to the group identifier in response to a successful group identifier search.
18. The computer program product as described in claim 14 further comprising:
means for selecting a proposal and transforms corresponding to the default security policy;
means for creating a security association payload using the selected proposal and transforms; and
means for sending the security association from one computer system to the remote computer system.
19. The computer program product as described in claim 18 further comprising:
means for receiving a response from the remote computer system;
means for determining whether the proposal was accepted by the other computer system; and
means for verifying identification information in response to the proposal being accepted.
20. The computer program product as described in claim 14 further comprising:
means for verifying a remote identifier and a digital signature corresponding to the remote computer system; and
means for creating the secure communication path to the remote computer system in response to the verification.