Method an apparatus for providing a scalable and secure network without point to point associations
View Patent ↗Method and apparatus that enable secure transmission of data in a scalable private network are described. Each station that is to be part of a private network registers with a key table. A group security association associated with the private network is forwarded to each trusted ingress and egress point that communicates with each member of the private network. When a member of the private network seeks to communicate with another member, it simply forwards the communication to the trusted ingress point. The trusted ingress point uses the security association associated with the private network to transform the communication and forwards the transformed communication through other intermediate stations in the network until it reaches a trusted egress point. The trusted egress point uses the stored security association to decode the transformed communication and forwards the communication to the appropriate destination. The ingress and egress points may be any points in the network, including customer edge devices, provider edge devices, or some combination thereof.
1. A method of securing packet data transferred between non-overlapping pairs of stations of a group of more than two stations on a backbone, the backbone comprising an ingress point and egress point, the method comprising the steps of:
receiving a first packet at the ingress point of the backbone from a sending first station of the group of stations, the packet including an original header with a source IP address of the sending station and a destination IP address of a receiving second station of the group of stations;
receiving a second packet at the ingress point of the backbone from a sending third station of the group of stations the packet including an original header with a source IP address of the sending station and a destination IP address of a receiving fourth station of the group of stations;
wherein the first packet is associated with a first point-to-point communication, the second packet is associated with a second point-to-point communication, and the first communication is unrelated to the second communication except that the first, second, third and fourth stations belong to the group of stations;
transforming, at the ingress point of the backbone, the first packet by adding a group header including a group identifier corresponding to the group of stations and a destination address for the first packet;
transforming, at the ingress point of the backbone, the second packet by adding a group header including the group identifier corresponding to the group of stations and a destination address for the second packet;
transforming, at the ingress point of the backbone, both the first packet and the second packet according to the group security association associated with the group identifier, wherein the ingress point is a provider edge device;
forwarding the transformed first and second packets over the backbone to the egress point using the group identifier as a backbone address;
receiving, at the egress point in the backbone, the transformed first and second packets;
restoring, at the egress point in the backbone, both the first transformed packet and the second transformed packet according to the group security association associated with the group identifier;
transforming, at the egress point in the backbone, the first and second restored packets by removing the respective group headers;
forwarding the first restored transformed packet to the receiving second station,
and
forwarding the second restored transformed packet to the receiving fourth station,
whereby the same security association is used for unrelated communications between non-overlapping pairs of stations of the group of stations.
2. The method according to claim 1 , wherein the step of transforming at the ingress point of the backbone includes the step of retaining fields of the packet needed to transfer the packet to the destination address of the receiving station from the egress point.
3. A network architecture for providing secure point-to-point communication between non-overlapping pairs of members of a private network including more than two members over a communication link, the network architecture comprising:
first and third sending stations which are members of the private network;
an ingress point to the communication link;
an egress point from the communication link;
second and fourth receiving stations, coupled to the egress point;
the ingress point functioning to:
receive a first packet from the first station, the first packet including an original header with a source IP address of the first station and a destination IP address of the second station;
receive a second packet from the third station, the second packet including an original header with a source IP address of the third station and a destination IP address of the fourth station;
transform the first and second packets by adding a group header including a group identifier corresponding to the group of stations and a common destination address for both the first and second packets;
transform both the first and second packets according to the group security association associated with the group identifier; and
forward the transformed first and second packets over the backbone to the egress point using the group identifier as a backbone address;
the egress point functioning to:
receive the transformed first and second packets;
restore the transformed first and second packets according to the group security association associated with the group identifier;
transform the restored first and second packets by removing the respective group headers;
forward the restored transformed first packet to the receiving second station,
and
forward the restored transformed second packet to the receiving fourth station, wherein the first packet is associated with a first point-to-point communication, the second packet is associated with a second point-to-point communication, and the first communication is unrelated to the second communication except that the first, second, third and fourth stations belong to the group of stations,
whereby the same security association is used for distinct communications between non-overlapping pairs of stations of the group of stations.
4. The network architecture of claim 3 , wherein the communication link comprises a plurality of provider devices, and wherein the egress point is one of the plurality of provider devices.
5. The network architecture of claim 3 , wherein the group comprises at least three stations.
6. The network architecture according to claim 3 wherein the means for securing data includes transform logic for encrypting only a portion of data transferred between the ingress point and egress point of the communication link.