Providing internet protocol (IP) security
View Patent ↗A method of providing Internet Protocol (IP) security at a network layer, that includes using two or more independent databases to process secure information, with a first database specifying a set of rules for the IP security and a level of security, and with a second database maintaining security information for at least two systems.
1. A method of providing Internet Protocol (IP) security at a network layer, the method comprising:
using two or more independent databases to process secure information, with a first database specifying rules for the IP security and a level of security, and with a second database maintaining security information for at least two systems, by;
determining if a selector matches an entry in the first database for processing an outbound IP packet; and
assembling an index into the second database and using the index to perform a lookup in the second database for processing an inbound IP packet.
2. The method of claim 1 , wherein the first database includes security policy entries.
3. The method of claim 2 , wherein the security policy entries include a source IP address, a destination IP address, an IP protocol, a source port, and/or a destination port.
4. The method of claim 2 , wherein the first database uses a Practical Algorithm to Retrieve Information coded in Alphanumeric (PATRICIA) tree to look-up security policy entries.
5. The method of claim 1 , wherein the first database is cached.
6. The method of claim 1 , wherein the second database includes security association entries.
7. The method of claim 6 , wherein each security association defines one or more parameters required for the IP security.
8. The method of claim 6 , wherein a hash table is used to look-up security association entries.
9. The method of claim 7 , wherein the one or more parameters include an IP destination, an IP security protocol, and a security parameter index.
10. The method of claim 9 , wherein the IP security protocol is in an authentication header format.
11. An apparatus for transmitting data packets, comprising:
a processor that executes the instructions; and
a memory that stores executable instructions for causing the processor to:
use two or more independent databases to process secure information; a first database specifying rules for the IP security and a level of security; and a second database maintaining security information for at least two systems, by;
determining if a selector matches an entry in the first database for processing an outbound IP packet; and
assembling an index into the second database and using the index to perform a lookup in the second database for processing an inbound IP packet.
12. The apparatus of claim 11 , wherein the first database includes security policy entries.
13. The apparatus of claim 12 , wherein the security policy entries include a source IP address, a destination IP address, an IP protocol, a source port, and/or a destination port.
14. The apparatus of claim 12 , wherein the first database uses a Practical Algorithm to Retrieve Information coded in Alphanumeric (PATRICIA) tree to look-up security policy entries.
15. The method of claim 11 , wherein the first database is cached.
16. The apparatus of claim 11 , wherein the second database includes security association entries.
17. The apparatus of claim 16 , wherein each security association defines one or more parameters required for the IP security.
18. The apparatus of claim 17 , wherein the one or more parameters include an IP destination, an IP security protocol, and a security parameter index.
19. The apparatus of claim 16 , wherein a hash table is used to look-up security association entries.
20. The apparatus of claim 18 , wherein the IP security protocol is in an authentication header format.
21. The apparatus of claim 18 , further comprising executable instructions to use the IP destination, the IP security protocol and the security parameter index as a hash key in a hash table lookup for a security association.
22. The apparatus of claim 21 , further comprising executable instructions to select a prime number.
23. The apparatus of claim 22 , wherein to select comprises to select ‘389’.
24. The apparatus of claim 14 , wherein the PATRICIA tree includes nodes and each node comprises a rule for the IP security and an index into the second database.
25. The method of claim 8 , further comprising using the IP destination, the IP security protocol and the security parameter index as a hash key in a hash table lookup for a security association.
26. The method of claim 25 , further comprising selecting a prime number.
27. The method of claim 26 , wherein selecting comprises selecting ‘389’.
28. The method of claim 4 , wherein the PATRICIA tree includes nodes and each node comprises a rule for the IP security and an index into the second database.