Unified encryption configuration management and setup system
The present technology relates to the field of configuration and setup of encrypted computer network transmission systems. In particular, the present technology relates to setting up and configuring network encryption systems, including MACsec, Internet Protocol Security (IPsec), and TLS protocols, in heterogeneous networks over Wireless Area Networks (WAN), Wireless Local Area Network (WLAN) or cellular links. In some embodiments, the present technology includes a method for setting up, configuring, and monitoring of encryption equipment providing encrypted links over WAN connections (typically IPsec VPN gateways and clients or TLS applications). The method includes communicating with encryption and PKI equipment necessary to automate the generation of encryption keys, digital certificates, and digital certificate signing requests. The method further includes communicating with the encryption equipment on one or both sides of an encrypted link to create security associations, and link encryption parameters, necessary for the encryptors to negotiate and establish encrypted links.
1. A method performed by a management system to establish encrypted communications, the method comprising:
maintaining a dataset of default encryption values for implementing a selected one of a plurality of encryption policies associated with one or more organizations;
querying, via a graphical user interface (GUI) of the management system, a user to input values for configuring an encryption device;
sending, via in-band or out-of-band communications methods, the input values, and at least a portion of the default encryption values to the encryption device, for configuring the encryption device based on the selected one of the plurality of encryption policies;
based on the input values and the at least a portion of the default encryption values, sending, via the management system, first instructions to the encryption device to generate a private key and a certificate signing request or performing the generation of the private key and the certificate signing request on behalf of the encryption device;
transmitting the certificate signing request to a certificate authority for signature;
sending, via the management system, second instructions to the certificate authority to sign the certificate signing request;
transmitting the signed certificate to the encryption device, wherein the transmitting the signed certificate to the encryption device causes the encryption device to load the signed certificate for use in establishing and maintaining encrypted communication in accordance with the selected one of the plurality of encryption policies; and
in response to receiving a selection of a revoke option via the GUI of the management system to revoke the signed certificate, immediately sending, via the management system, both revocation instructions to the certificate authority and termination instructions to the encryption device to provide an integrated process of revocation and termination, wherein upon receiving the termination instructions, the encryption device immediately terminates all active encryption sessions associated with the signed certificate without manual intervention.
2. The method of claim 1 , wherein the encryption device is a first encryption device, wherein the input values are first input values, wherein the private key is a first private key, wherein the certificate signing request is a first certificate signing request, wherein the certificate authority is a first certificate authority, and wherein the method further comprises:
querying, via the GUI, the user to input second input values for configuring a second encryption device;
sending the second input values and a second portion of the default encryption values settings to the second encryption device for configuring the second encryption device based on a selected second one of the plurality of encryption policies;
sending third instructions to the second encryption device to generate a second private key and a second certificate signing request or performing the generation of the second private key and the second certificate signing request on behalf of the second encryption device;
transmitting the second certificate signing request to the first certificate authority or second certificate authority for signature;
sending fourth instructions to the first or second certificate authority to sign the second certificate signing request; and
transmitting the second signed certificate to the second encryption device, wherein the transmitting of the second signed certificate to the second encryption device causes the second encryption device to load the second signed certificate for use in establishing and maintaining encrypted tunnels for communication,
wherein the encrypted tunnels are partially based on the first encryption device implementing encryption at a first layer of a communication stack and the second encryption device implementing encryption on a second layer of the communication stack.
3. The method of claim 2 , wherein the certificate authority is a first certificate authority, and wherein the first and second encryption devices, the first certificate authority, and a second certificate authority are located in the same location and commutatively coupled to the management system.
4. The method of claim 1 , wherein the encryption device is in a remote location relative to the certificate authority, and the management system communicates indirectly to the certificate authority or indirectly to the encryption device.
5. The method of claim 1 , wherein an intermediary system is configured to facilitate the signing of the certificate signing request on behalf of the encryption device by implementing an application program interface (API).
6. The method of claim 1 , wherein the querying the user for input values further comprising:
receiving, via the GUI, a request from the user that causes the management system to perform the transmitting of the certificate signing request to the certificate authority and to perform the transmitting of the signed certificate to the encryption device.
7. The method of claim 1 , wherein the user is a first user, further comprising:
implementing a separation of duties method,
wherein the separation of duties method includes:
causing the management system, in response to the first user, to cause the certificate signing request to be generated on the encryption device, and wherein the management system queues the certificate signing request for a second user for approval;
sending, via the management system, the certification signing request to the certificate authority to causes the certificate signing request to be signed; and
retrieving, via the management system, the signed certificate and loading it on the encryption device, or queuing it for the first user, wherein the first user causes the management system to load the signed certificate onto the encryption device.
8. The method of claim 1 , further comprising:
performing the generation of the private key and the certificate signing request on behalf of the encryption device if the encryption device cannot autonomously generate the private key and the certificate signing request.
9. A non-transitory computer-readable medium encoded with instructions that, when executed by a processor of a management system, perform a method for securing communications for a device, the method comprising:
maintaining a dataset of default encryption values for implementing a selected one of a plurality of encryption policies associated with one or more organizations;
querying, via a graphical user interface (GUI) of the management system, a user to input values for configuring an encryption device;
sending, via in-band or out-of-band communications methods, the input values, and at least a portion of the default encryption values to the encryption device, for configuring the encryption device based on the selected one of the plurality of encryption policies;
based on the input values and the at least a portion of the default encryption values, sending, via the management system, first instructions to the encryption device to generate a private key and a certificate signing request or performing the generation of the private key and the certificate signing request on behalf of the encryption device;
transmitting the certificate signing request to a certificate authority for signature;
sending, via the management system, second instructions to the certificate authority to sign the certificate signing request;
transmitting the signed certificate to the encryption device, wherein the transmitting of the signed certificate to the encryption device causes the encryption device to load the signed certificate for use in establishing and maintaining encrypted communication in accordance with the selected one of the plurality of encryption policies; and
in response to receiving a selection of a revoke option via the GUI of the management system to revoke the signed certificate, immediately sending, via the management system, both revocation instructions to the certificate authority and termination instructions to the encryption device to provide an integrated process of revocation and termination, wherein upon receiving the termination instructions, the encryption device immediately terminates all active encryption sessions associated with the signed certificate without manual intervention.
10. The non-transitory computer-readable medium of claim 9 , wherein the encryption device is a first encryption device, wherein the input values are first input values, wherein the private key is a first private key, wherein the certificate signing request is a first certificate signing request, wherein the certificate authority is a first certificate authority, and wherein the method further comprises:
querying, via the GUI, the user to input second input values for configuring a second encryption device;
sending the second input values and a second portion of the default encryption values to the second encryption device for configuring the second encryption device;
sending third instructions to the second encryption device to generate a second private key and a second certificate signing request or performing the generation of the second private key and the second certificate signing request on behalf of the second encryption device;
transmitting the second certificate signing request to the first certificate authority or a second certificate authority for signature;
sending fourth instructions to the first or second certificate authority to sign the second certificate signing request; and
transmitting the second signed certificate to the second encryption device, wherein the transmitting of the second signed certificate to the second encryption device causes the second encryption device to load the second signed certificate for use in establishing and maintaining encrypted tunnels for communication,
wherein the encrypted tunnels are partially based on the first encryption device implementing encryption at a first layer of a communication stack and the second encryption device implementing encryption on a second layer of the communication stack.
11. The non-transitory computer-readable medium of claim 10 , the certificate authority is a first certificate authority, and wherein the first and second encryption devices, the first certificate authority, and the second certificate authority are located in the same location and commutatively coupled to the management system.
12. The non-transitory computer-readable medium of claim 9 , wherein the encryption device is in a remote location relative to the certificate authority, and the management system communicates indirectly to the certificate authority or indirectly to the encryption device.
13. The non-transitory computer-readable medium of claim 9 , wherein the intermediary system is configured to sign the first and second certificate signing request on behalf of the first and second encryption devices by implementing an application program interface (API).
14. The non-transitory computer-readable medium of claim 9 , wherein querying the user for input values further comprising:
receiving, via the GUI, a request from the user that causes the management system to perform the transmitting of the certificate signing request to the certificate authority and to perform the transmitting of the signed certificate to the encryption device.
15. The non-transitory computer-readable medium of claim 9 , wherein the user is a first user, further comprising:
implementing a separation of duties method,
wherein the separation of duties method includes:
the first user causing the management system, in response to the first user, to cause the certificate signing request to be generated on the encryption device, and wherein the management system queues the certificate signing request for a second user for approval;
sending, via the management system, the certification signing request to the certificate authority to causes the certificate signing request to be signed; and
retrieving, via the management system, the signed certificate and loading it on the encryption device, or queuing it for the first user, wherein the first user causes the management system to load the signed certificate onto the encryption device.
16. The non-transitory computer-readable medium of claim 9 , wherein the method further comprises:
performing the generation of the private key and the certificate signing request on behalf of the encryption device if the encryption device cannot autonomously generate the private key and the certificate signing request.