Multipoint server for providing secure, scaleable connections between a plurality of network devices
View Patent ↗A method and system for implementing secure communications between a plurality of devices are provided. The method and system generally include the provision of at least one common encryption parameter to each of the plurality of devices, as well as an identification of the plurality of devices to one another. This information can be maintained and shared by interaction of the plurality of devices with a designated server device. In this way, a secure, point-to-point connection between at least two of the plurality of devices can be established.
1. A method comprising:
at a multi-point server not comprised in a plurality of devices, said plurality of devices comprising a first device, a second device and a third device:
responsive to a detected mismatch in a packet sequence number of a communication between said first device and said second device, via a phase two restart message, restarting a first secure point-to-point connection between said first device and said second device, said phase two restart message adapted to cause a definition of IPSec protocol parameters without a new Diffie-Heilman keying material exchange, said first secure point-to-point connection established between said first device and said second device via at least one common encryption parameter, said at least one common encryption parameter provided to each of said plurality of devices, said at least one common encryption parameter provided responsive to a request from said third device for a second secure point-to-point connection between said third device and said second device, said plurality of devices identified to one another.
2. The method of claim 1 , further comprising:
receiving said request from said third device for said second secure point-to-point connection.
3. The method of claim 1 , further comprising:
providing said at least one common encryption parameter to each of said plurality of devices.
4. The method of claim 1 , further comprising:
identifying said plurality of devices to one another.
5. The method of claim 1 , further comprising:
establishing said first secure, point-to-point connection between said first device and said second device via said at least one common encryption parameter.
6. The method of claim 1 , further comprising:
establishing secure, point-to-point connections between each of said plurality of devices.
7. The method of claim 1 , further comprising:
establishing secure, point-to-point connections between each of said plurality of devices, wherein said at least one common encryption parameter is provided to each of said plurality of devices via a negotiated security association with each of said plurality of devices.
8. The method of claim 1 , wherein each of said plurality of devices is identified to one another via a provided IP address and a provided authentication key of each device to each other device comprised in said plurality of devices.
9. The method of claim 1 , wherein said first secure, point-to-point connection between said first device and said second device is established via an IPsec session based on said at least one common encryption parameter.
10. The method of claim 1 , further comprising:
based on an authentication public key of each device and a pre-stored list of device devices, authenticating each device as a device of a pre-defined virtual private network responsive to a negotiation of a security association between said multi-point server and each device, each device adapted to join said virtual private network as a result of a single security association formed with said multi-point server without forming any other security association with another device in the virtual private network.
11. The method of claim 1 , further comprising:
obtaining certificate information from a certification authority relating to each of said plurality of devices and a pre-defined virtual private network made up of said plurality of devices;
authenticating each device as a device of said virtual private network based on said certificate information; and
conducting an IPsec session based on said certificate information.
12. The method of claim 1 , further comprising:
obtaining certificate information from a certification authority relating to each of said plurality of devices and a pre-defined virtual private network made up of said plurality of devices;
authenticating each device as a device of said virtual private network based on said certificate information;
conducting an IPsec session based on said certificate information; and
restarting said IPsec session upon detection of a transmission error by one of said plurality of devices participating in said IPsec session.
13. The method of claim 1 , further comprising:
providing a periodic update to said plurality of devices identifying a current status relative to each point-to-point connection as active, inactive, or connecting.
14. The method of claim 1 , wherein said multi-point server is adapted to negotiate a security association with each member of a Virtual Private Network, said at least one common encryption parameter shared with each of a plurality of members of said Virtual Private Network, said multi-point server not a member of said Virtual Private Network, said plurality of members of said Virtual Private Network comprising said first device, said second device and said third device.
15. The method of claim 1 , wherein said multi-point server is adapted to negotiate a security association with each member of a Virtual Private Network, said at least one common encryption parameter shared with each of a plurality of members of said Virtual Private Network, said multi-point server not a member of said Virtual Private Network, said multi-point server adapted to authenticate each of said plurality of members of said Virtual Private Network via a public key of each of said plurality of members of said Virtual Private Network and a list of potential members of said Virtual Private Network, said plurality of members of said Virtual Private Network comprising said first device, said second device and said third device.
16. The method of claim 1 , wherein said first device, said second device and said third device communicate via Multi-Protocol Label Switching.
17. The method of claim 1 , wherein said multi-point server is adapted to negotiate a security association with each member of a Virtual Private Network, said at least one common encryption parameter shared with each of a plurality of members of said Virtual Private Network, said multi-point server not a member of said Virtual Private Network, each of said plurality of members adapted to join said Virtual Private Network via a formation of only a single security association with said multi-point server, said plurality of members of said Virtual Private Network comprising said first device, said second device and said third device.
18. The method of claim 1 , further comprising:
from said multi-point server, communicating a status of each member of a Virtual Private Network comprising said first device, said second device, and said third device to each of said first device, said second device, and said third device, said status selected from a Not Connected status, a Pending status, an inactive status, and an active status.
19. The method of claim 1 , wherein said phase two restart message restarts a Virtual Private Network IPsec session using a current secret key without impacting remaining VPN traffic.
20. The method of claim 1 , wherein said multi-point server anticipates an expiration of a security association with at least one of said first device, said second device, and said third device, said multi-point server adapted to provide a new encryption secret key to each of said first device, said second device, and said third device in a pre-arranged way.
21. The method of claim 1 , wherein said multi-point server is adapted to provide a certificate to each of said first device, said second device, and said third device, said certificate comprising a field that lists Virtual Private Networks managed by said multi-point server.
22. The method of claim 1 , further comprising adding a new device to said plurality of devices.
23. A method comprising:
responsive to a first security association between a server and a first device of a plurality of devices, establishing an IPsec session between said first device and a second device based on an encryption secret key, said IPsec session based upon a determined encryption secret key associated with said first device as part of said first security association, said IPsec session based upon a negotiated second security association between said server and said second device, said encryption secret key communicated to said second device as part of said second security association, said server adapted to, responsive to a detected mismatch in a packet sequence number between said fast device and said second device, via a phase two restart message, restart said IPSec session between said first device and said second device, said phase two restart message adapted to cause a definition of IPSec protocol parameters without a new Diffie-Hellman keying material exchange.