1. Field of the Invention
The present invention relates to the formation and use of secure network connections. More specifically, the present invention relates to fonning secure, scaleable network connections for a plurality of network devices.
2. Description of the Related Art
Computer networks, and in particular Wide Area Networks (WANs) such as the Internet, provide opportunities for the misuse and abuse of communications traveling thereover. For example, two users communicating via the WAN may have their communications intercepted and/or altered. Also, it is possible for one user to misrepresent his or her identity to another user. As a final example, a user may utilize network resources and communications to disrupt all or part of the network.
Thus, there is a need for both privacy and authentication between users of the WAN communicating with one another. In other words, users should be able to rely on the fact that their transmissions will not be intercepted or altered, and that transmissions from someone purporting to be a particular user do in fact originate from that user.
One type of defense against ill-intentioned uses of the WAN is a device operating at the edge of a private network, such as a Gateway, Firewall or some other dedicated network appliance. Such a device operates to filter transmissions between the private network and the WAN and/ or to protect the transmissions that do go through by encrypting/decrypting (i.e., encoding/decoding) those transmissions.
Other related types of defenses function by establishing the identity of a sender and/ or recipient before sending/receiving a communication. Still other defenses include establishing a secure channel between two communicating devices.
A particular conventional protocol for providing security between devices operating over an Internet Protocol (IP) network is known as IPsec. Short for IP Security, IPsec is a set of protocols supporting the secure exchange of IP packets at a network layer. Two of the protocols used are the Authentication Header protocol (AH) and the Encapsulating Security Payload protocol (ESP).
AH is designed to ensure that transmitted packets are not altered during transit over the network, but does not protect the contents of the packets from being viewed by other users of the network such as intercepting parties. ESP, on the other hand, ensures the confidentiality of the packet contents. ESP provides an optional authentication mechanism; however, this mechanism is only for authenticating the data payload of the packet (and associated ESP headers/trailers). Therefore, ESP does not authenticate an IP Header of a packet indicating an original IP address on the network from which the packet originated. It is also possible to use AH and ESP in conjunction with one another, in order to achieve the advantages of both.
Whether using AH or ESP, IPsec operates in either transport or turmel mode. Transport mode is often used in host-tohost communications; i.e., when the peer devices are the endpoints of communication. Transport mode is most useful within an overall IPsec enviromnent including the two endpoints. Tunnel mode is typically used in communications between an IPsec-protected system and some other endpoint, such as communications sent from a private network over the
Internet. In tunnel mode, the payload of a secured IP packet carries another packet containing the actual data payload to be transmitted.
A comrnonuse of the tunnel mode is to implement aVirtual Private Network (VPN). VPNs are networks that use publicly-available network resources, such as the Internet, to construct a network accessible only by selected parties. For example, a company may create its own version of a Local Area Network (LAN) using the Internet, or a worker working from a remote location may be able to utilize company resources at a company headquarters.
In order to implement the various protocols and modes of IPsec such as those discussed above, a security association (SA) is typically fonned. An IPsec SA is essentially a contract or agreement between parties defining conditions according to which the two parties will communicate. For example, an IPsec SA is typically a one-way connection that defines, for example, encryption algorithms to be used during information exchange. SAs are defined by such parameters as an IP destination address and a security protocol identifier (e.g., AH or ESP). SAs typically include a security parameter index (SPI), which is a 32 bit identification number.
If an IPsec SA is considered a contract or agreement, then the tenns thereof can be considered to be negotiated by a separate protocol (or manually). In other words, both communicating parties must agree on actions that will be taken on communicated packets in order to encrypt/ decrypt those packets. One such protocol is known as the Intemet Security Association and Key Management Protocol (ISAKMP), and one implementation of ISAKMP is known as the Intemet Key Exchange (IKE).
IKE typically operates in two phases. In a first phase, parties agree as to how to protect further negotiation traffic. For example, IKE may authenticate a sender by virtue of, for example, public key encryption, also known as Diffie-Hellman encryption. In public key encryption, each user generates a public and private key, where the public key is then sent to the other party. When each user combines his own private key with the other’s public key (and perhaps additional information), they each obtain an identical secret key. This secret key serves as a basis for deriving subsequent cryptographic keys.
In this way, a first user can encrypt a message using the second user’ s public key, and then only the second user (using his own private key) will be able to decrypt and receive the message.
Also, a first user can use his private key to sign a message and the second user, with the first user’s public key, can receive and authenticate the transmitted message. Thus, the first user is authenticated to the second user as the one who sent the transmission; i.e., a “digital signature.”
This latter methodology, however, does nothing to guard against the eventuality that a third party is merely pretending to be the sender (i.e., the first user) when the keys were generated in the first place. Therefore, independent and trusted CertificationAuthorities (CAs) exist which issue digital certificates verifying the association of a public key with a particular user, along with other identifying infonnation.
There are two primary modes for phase 1 of IKE: main mode and aggressive mode. Main mode, generally speaking, is a more involved but more secure method. Aggressive mode, though faster, sacrifices identity protection; however, using the public key encryption methodology just discussed obviates the need for this feature.
In a second phase, IKE negotiates the actual IPsec SA (over which the actual application layer data exchanges will take place) by setting up the encryption/ authentication keys for the AH and/or ESP protocols. In particular, “quick mode” nego