Standard format specification for automatically configuring IP security tunnels

1. A computer implemented method in a data processing system for automatically configuring IP security tunnels, said computer implemented method comprising the steps of:

retrieving a remote computer system identifier;

determining whether a local-remote pair corresponding to the identifier is found, wherein the local-remote pair is used in selecting a security policy, and wherein an error is reported indicating that a user needs to configure a tunnel with the remote computer system if the local-remote pair is not found;

defining a configuration of an IP security tunnel between the data processing system and the remote computer system utilizing a security policy specification format, wherein said security policy specification format is established as a document type definition (DTD) file capable of being utilized by a plurality of different operating systems and a plurality of different machine types; and

including a plurality of different elements in said DTD file, each of said plurality of different elements being utilized to configure an IP security tunnel.

2. The method according to claim 1 , wherein said DTD file defines a collection of elements, and further comprising:

generating an XML file utilizing the collection of elements defined in said DTD file, wherein said XML file defines a configuration of a particular IP security tunnel, and wherein said XML file is processed to automatically configure said IP security tunnel defined by the XML file.

3. The method according to claim 1 , further comprising the steps of:

generating an XML file utilizing a plurality of said plurality of different elements included within said DTD file; and

processing said XML file to automatically configure an IP security tunnel.

4. The method according to claim 1 , further comprising the step of including a root element in said security policy specification format.

5. The method according to claim 1 , further comprising the step of establishing a protection element in said security policy specification format, said protection element including a listing of IKE transforms.

6. The method according to claim 1 , further comprising the step of establishing a transform element in said security policy specification format.

7. The method according to claim 1 , further comprising the step of establishing a group element in said security policy specification format, wherein said group element contains multiple identification elements.

8. The method according to claim 1 , further comprising the step of establishing an identification element in said security policy specification format.

9. The method according to claim 1 , further comprising the step of establishing a tunnel element in said security policy specification format.

10. The method according to claim 1 , further comprising the step of establishing a root element, a protection element, a transform element, a group element, an identification element, a tunnel element, a local/remote identify element, an ID type element, an ID definition element, a pre-shared key element, an IPsec proposal element, an IPsec ESP protocol element, an IPsec authentication header element, and an IPsec protection element in said security policy specification format.

11. The method according to claim 1 , further comprising the step of automatically configuring an IP security tunnel utilizing said security policy specification format.

12. The method according to claim 1 , further comprising the step of comparing a first IP security tunnel to a second IP security tunnel utilizing a first security policy specification format that is associated with said first IP security tunnel and a second security policy specification format that is associated with a second IP security tunnel.

13. A computer program product comprising:

a computer readable recordable medium having computer usable program code for defining a configuration of IP security tunnels in a data processing system, comprising:

computer usable program code for retrieving a remote computer system identifier;

computer usable program code for determining whether a local-remote pair corresponding to the identifier is found, wherein the local-remote pair is used in selecting a security policy, and wherein an error is reported indicating that a user needs to configure a tunnel with the remote computer system if the local-remote pair is not found;

computer usable program code for automatically configuring an IP security tunnel between the data processing system and the remote computer system utilizing a security policy specification format wherein said security policy specification format is established as a document type definition (DTD) file capable of being utilized by a plurality of different operating systems and a plurality of different machine types; and

computer usable program code for including a plurality of different elements in said DTD file, each of said plurality of different elements being utilized to configure an IP security tunnel.

14. The product according to claim 13 , wherein said DTD file defines a collection of elements, and further comprising:

generating an XML file utilizing the collection of elements defined in said DTD file, wherein said XML file defines a configuration of a particular IP security tunnel, and wherein said XML file is processed to automatically configure said IP security tunnel defined by the XML file.

15. The product according to claim 13 , further comprising:

computer usable program code for generating an XML file utilizing a plurality of said plurality of different elements included within said DTD file; and

computer usable program code for processing said XML file to automatically configure an IP security tunnel.

16. The product according to claim 13 , further comprising computer usable program code for including a root element in said security policy specification format.

17. The product according to claim 13 , further comprising computer usable program code for establishing a protection element in said security policy specification format, said protection element including a listing of IKE transforms.

18. The product according to claim 13 , further comprising computer usable program code for establishing a transform element in said security policy specification format.

19. The product according to claim 13 , further comprising computer usable program code for establishing a group element in said security policy specification format, wherein said group element contains multiple identification elements.

20. The product according to claim 13 , further comprising computer usable program code for establishing an identification element in said security policy specification format.

21. The product according to claim 13 , further comprising computer usable program code for establishing a tunnel element in said security policy specification format.

22. The product according to claim 13 , further comprising computer usable program code for establishing a root element, a protection element, a transform element, a group element, an identification element, a tunnel element, a local/remote identify element, an ID type element, an ID definition element, a pre-shared key element, an IPsec proposal element, an IPsec ESP protocol element, an IPsec authentication header element, and an IPsec protection element in said security policy specification format.

23. The product according to claim 13 , further comprising computer usable program code for automatically configuring an IP security tunnel utilizing said security policy specification format.

24. The product according to claim 13 , further comprising computer usable program code for comparing a first IP security tunnel to a second IP security tunnel utilizing a first security policy specification format that is associated with said first IP security tunnel and a second security policy specification format that is associated with a second IP security tunnel.

25. A data processing system for automatically configuring IP security tunnels, comprising:

a computer;

a computer readable medium containing computer readable instructions, wherein the computer executes the computer readable instructions to retrieve a remote computer system identifier; determine whether a local-remote pair corresponding to the identifier is found, wherein the local-remote pair is used in selecting a security policy, and wherein an error is reported indicating that a user needs to configure a tunnel with the remote computer system if the local-remote pair is not found; automatically configure an IP security tunnel between the data processing system and the remote computer system utilizing a security policy specification format, wherein said security policy specification format is established as a document type definition (DTD) file capable of being utilized by a plurality of different operating systems and a plurality of different machine types; and include a plurality of different elements in said DTD file, each of said plurality of different elements being utilized to configure an IP security tunnel.

26. The system according to claim 25 , wherein said DTD file defines a collection of elements, and further comprising:

generating an XML file utilizing the collection plurality of different elements defined in said DTD file, wherein said XML file defines a configuration of a particular IP security tunnel, and wherein said XML file is processed to automatically configure said IP security tunnel defined by the XML file.

27. The system according to claim 25 , further comprising:

an XML file being generated utilizing a plurality of said plurality of different elements included within said DTD file; and

said system for processing said XML file to automatically configure an IP security tunnel.

28. The system according to claim 25 , further comprising a root element being included in said security policy specification format.

29. The system according to claim 25 , further comprising a protection element being included in said security policy specification format, said protection element including a listing of IKE transforms.

30. The system according to claim 25 , further comprising a transform element being included in said security policy specification format.

31. The system according to claim 25 , further comprising a group element being included in said security policy specification format, wherein said group element contains multiple identification elements.

32. The system according to claim 25 , further comprising an identification element being included in said security policy specification format.

33. The system according to claim 25 , further comprising a tunnel element being included in said security policy specification format.

34. The system according to claim 25 , further comprising a root element, a protection element, a transform element, a group element, an identification element, a tunnel element, a local/remote identify element, an ID type element, an ID definition element, a pre-shared key element, an IPsec proposal element, an IPsec ESP protocol element, an IPsec authentication header element, and an IPsec protection element being included in said security policy specification format.

35. The system according to claim 25 , further comprising said system for automatically configuring an IP security tunnel utilizing said security policy specification format.

36. The system according to claim 25 , further comprising said system for comparing a first IP security tunnel to a second IP security tunnel utilizing a first security policy specification format that is associated with said first IP security tunnel and a second security policy specification format that is associated with a second IP security tunnel.