Control plane encryption in IP/MPLS networks
View Patent ↗A method for providing control plane encryption in layer 3 networks is disclosed. The method for providing control plane encryption in layer 3 networks includes for a network having a subset of network elements forming a secured domain; the steps of at a network element which is in the secured domain, encrypting all unencrypted Layer 3 packets as they egress an encryption enable egress interface; unencrypting all encrypted Layer 3 packets as they egress an egress interface is not enabled for encryption; and leaving encrypted all encrypted Layer 3 packets as they egress an encryption enable egress interface. A system and machine readable storage media are also disclosed.
1. A method of encrypting data for a network having a plurality of network elements, each of said plurality of network elements having a connection between a respective ingress interface to a respective egress interface of another network element of said plurality of network elements, and a subset of said plurality of network elements comprising a secured domain, the method comprising:
at a first network element, which is a member of said subset of network elements and inside the secured domain, encrypting all unencrypted Layer 3 packets as they egress the respective egress interface, wherein said egress interface is enabled for encryption;
at said first network element, unencrypting all encrypted Layer 3 packets as they egress the respective egress interface, wherein said egress interface is not enabled for encryption and is outside the secured domain; and
at said first network element, leaving encrypted all encrypted Layer 3 packets as they egress the respective egress interface, wherein said egress interface is enabled for encryption.
2. The method as claimed in claim 1 , wherein said encrypting is associated with an encryption protocol that is one of a group of DES, 3DES, Blowfish, Twofish, Serpent, SNOW 3G, Kasumi-F8, AES-128, AES-192, and AES-256.
3. A system for providing a secured domain, comprising:
a plurality of network elements, each of said plurality of network elements having a connection between a respective ingress interface to a respective egress interface of another network element of said plurality of network elements;
a subset of said plurality of network elements comprising said secured domain;
a first network element which is a member of said subset of network elements and inside the secured domain, which encrypts all unencrypted Layer 3 packets as they egress the respective egress interface, wherein said egress interface is enabled for encryption;
said first network element further unencrypting all encrypted Layer 3 packets as they egress the respective egress interface, wherein said egress interface is not enabled for encryption and is outside the secured domain; and
said first network element leaving encrypted all encrypted Layer 3 packets as they egress the respective egress interface, wherein said egress interface is enabled for encryption.
4. The system as claimed in claim 3 , wherein said encrypting is associated with an encryption protocol that is one of a group of DES, 3DES, Blowfish, Twofish, Serpent, SNOW 3G, Kasumi-F8, AES-128, AES-192, and AES-256.
5. A non-transitory machine readable storage medium encoded with instructions for execution by a processor at a first network element for a network having a plurality of network elements, each of said plurality of network elements having a connection between a respective ingress interface to a respective egress interface of another network element of said plurality of network elements, and a subset of said plurality of network elements comprising a secured domain, and said first network element a member of said subset and inside the secured domain, the medium comprising:
instructions for encrypting all unencrypted Layer 3 packets as they egress the respective egress interface of said first network element when said egress interface is enabled for encryption;
instructions for unencrypting all encrypted Layer 3 packets as they egress the respective egress interface of said first network element when said egress interface is not enabled for encryption and is outside the secured domain; and
instructions for leaving encrypted all encrypted Layer 3 packets as they egress the respective egress interface of said first network element when said egress interface is enabled for encryption.
6. The non-transitory machine readable storage medium as claimed in claim 3 , wherein said encrypting is associated with an encryption protocol that is one of a group of DES, 3DES, Blowfish, Twofish, Serpent, SNOW 3G, Kasumi-F8, AES-128, AES-192, and AES-256.