Method and system for traffic engineering in secured networks
Aspects of a method and system for traffic engineering in an IPSec secured network are provided. In this regard, a node in a network may be authenticated as a trusted third party and that trusted third party may be enabled to acquire security information shared between or among a plurality of network entities. In this manner, the trusted third party may parse, access and operate on IPSec encrypted traffic communicated between or among the plurality of network entities. Shared security information may comprise one or more session keys utilized for encrypting and/or decrypting the IPSec secured traffic. The node may parse IPSec traffic and identify a flow associated with the IPsec traffic. In this manner, the node may generate and/or communicate statistics pertaining to said IPSec secured traffic based on the flow with which the traffic is associated.
1. A network device comprising:
circuitry configured to
receive encrypted IPSec secured traffic;
receive flow information corresponding to the encrypted IPSec secured traffic at the network device for handling the encrypted IPSec secured traffic; and
forward the encrypted IPSec secured traffic without decrypting the encrypted IPSec secured traffic based at least in part on the flow information.
2. The network device of claim 1 , wherein
the network device is authenticated by another network device in a network as being a trusted third party.
3. The network device of claim 2 , wherein
the circuitry is configured to receive the IPSec secured traffic from the another network device.
4. The network device of claim 1 , wherein
the circuitry is configured to register the network device with a directory service.
5. The network device of claim 4 , wherein
the circuitry is configured to authenticate the network device with the directory service.
6. The network device of claim 5 , wherein
the circuitry is configured to transmit information received from the directory service as a result of the authentication to another network device from which the IPSec secured traffic is received.
7. The network device of claim 6 , wherein
the information received from the directory service as a result of the authentication is a certificate.
8. The network device of claim 1 , wherein
the circuitry is configured to parse IPSec secured traffic based at least in part on the flow information.
9. The network device of claim 8 , wherein
the circuitry is configured to time division multiplex the parsed IPSec secured traffic.
10. The network device of claim 1 , wherein
the circuitry is configured to exchange security information with another network device via a three-way key negotiation protocol.
11. The network device of claim 1 , wherein
the circuitry is configured to share security information with another network device via a bilateral negotiation.
12. The network device of claim 1 , wherein
the circuitry is configured to establish an end-to-end trust between the network device and at least one of a plurality of other network devices without security information.
13. The network device of claim 1 , wherein
the flow information is communicated via a NetFlow protocol or an Internet Protocol Flow Information Export (IPFIX) protocol.
14. The network device of claim 1 , wherein
the flow information comprises at least one of a source IP address or a destination IP address.
15. The network device of claim 1 , wherein
the flow information comprises at least one of upper protocol ports or a requested bandwidth.
16. The network device of claim 1 , wherein
the flow information comprises at least one of a keyword used in data included in a payload of the encrypted IPSec secured traffic or a result of a search for a keyword of the payload of the encrypted IPSec secured traffic prior to encryption.
17. The network device of claim 1 , wherein
a header and a payload of the IPSec secured traffic is encrypted, and the flow information is distinct from header information included in the header of the IPSec secured traffic.
18. The network device of claim 1 , wherein
the circuitry is configured to perform at least one of enforcing network policies, providing traffic statistics or communicating with management entities based at least in part on the flow information.
19. A method performed by a network device, the method comprising:
receiving encrypted IPSec secured traffic;
receiving flow information corresponding to the encrypted IPSec secured traffic at the network device for handling the encrypted IPSec secured traffic; and
forwarding the encrypted IPSec secured traffic without decrypting the encrypted IPSec secured traffic based at least in part on the flow information.
20. A network device comprising:
circuitry configured to
control performing authentication with a second network device remote from the network device;
receive authentication information from the second network device based on the authentication;
control performing authentication with a third network device based on the authentication information received from the second network device;
receive encrypted IPSec secured traffic from the third network device;
receive flow information pertaining to the encrypted IPSec secured traffic from the third network device for handling the encrypted IPSec secured traffic; and
forward the encrypted IPSec secured traffic without decrypting the encrypted IPSec secured traffic based at least in part on the flow information.