US6938155B2
Expired / Lapsed
US
⏱️ 0.0 years remaining
System and method for multiple virtual private network authentication schemes
Assignee: Trend Micro Inc
•
Filing: 2001-05-24
•
Granted: 2005-08-30
•
Expires: 2021-05-24
Abstract
Abstract A system and method for providing multiple virtual private networks from a computer system. The computer system communicates with a remote computer system in order to allow encrypted data traffic to flow between the respective systems. Two phases are used to authenticate the computer systems to one another. During the first phase, digital certificates or pre-shared keys are used to authenticate the computer systems. A phase 1 ID rules list contains authentication rules for local-remote computer pairs. During the second phase, a hash value is used to authenticate the computer systems and a security association payload is created. The remote system's IP address is used for connecting. The phase 1 ID rules list corresponds to one or more phase 2 ID rules lists. If the remote ID is not found in the phase 2 ID rules list, a default rule is used based upon the phase 1 ID rules list.
Inventors
- 👤 Ajit Clarence D'Sa
- 👤 William Alton Fiveash
- 👤 Denise Marie Genty
- 👤 Guha Prasad Venkataraman
- 👤 Jacqueline Hegedus Wilson
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-30 02:41
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/02; H04L63/0272; H04L63/08; H04L63/0823
Claims Analysis
Total Claims: 23
Claim 1
Independent Claim
115 words
A method of establishing a secure communication path between a computer system and a remote computer system comprising: exchanging identification data with the remote computer system using a communication path; determining, based on the identification data, whether a predefined security policy exists corresponding to the remote computer system, wherein the predefined security policy defines at least one constraint on security associations (SAs) created in accordance with the predefined security policy; and establishing a secure communication path using a default security policy in response to determining that the predefined security policy does not exist, wherein the default security policy defines at least one constraint on security associations (SAs) created in accordance with the default security policy.
Claim 2
Independent Claim
115 words
A method of establishing a secure communication path between a computer system and a remote computer system comprising: exchanging identification data with the remote computer system using a communication path; determining, based on the identification data, whether a predefined security policy exists corresponding to the remote computer system, wherein the predefined security policy defines at least one constraint on security associations (SAs) created in accordance with the predefined security policy; and establishing a secure communication path using a default security policy in response to determining that the predefined security policy does not exist, wherein the default security policy defines at least one constraint on security associations (SAs) created in accordance with the default security policy.
Claim 3
Dependent Claim
34 words
The method as described in claim 1 wherein the identification data is selected from the group consisting of a gateway address, a host name, a user identifier, an IP address, and a distinguished name.
Claim 4
Dependent Claim
29 words
The method as described in claim 1 wherein establishing the secure communication path further includes: determining whether a digital certificate or a pre-shared key is used for encrypting data.
Claim 5
Dependent Claim
41 words
The method as described in claim 1 further comprising: searching a group table for a group identifier corresponding to the remote computer system; wherein the predefined security policy corresponds to the group identifier in response to a successful group identifier search.
Claim 6
Dependent Claim
45 words
The method as described in claim 1 further comprising: selecting a proposal and transforms corresponding to the default security policy; creating a security association payload using the selected proposal and transforms; and sending the security association from one computer system to the remote computer system.
Claim 7
Dependent Claim
39 words
The method as described in claim 5 further comprising: receiving a response from the remote computer system; determining whether the proposal was accepted by the other computer system; and verifying identification information in response to the proposal being accepted.
Claim 8
Dependent Claim
39 words
The method as described in claim 1 further comprising: verifying a remote identifier and a digital signature corresponding to the remote computer system; and creating the secure communication path to the remote computer system in response to the verification.
Claim 9
Dependent Claim
156 words
An information handling system comprising: one or more processors; a memory accessible by the processors; a nonvolatile storage accessible by the processors; a network interface connecting the information handling system to a computer network; and a network tool for creating a secure communication path to a remote computer system, the network tool including: means for exchanging identification data with the remote computer system using a communication path; means for determining, based on the identification data, whether a predefined security policy exists corresponding to the remote computer system, wherein the predefined security policy defines at least one constraint on security associations (SAs) created in accordance with the predefined security policy; and means for establishing a secure communication path using a default security policy in response to determining that the predefined security policy does not exist, wherein the default security policy defines at least one constraint on security associations (SAs) created in accordance with the default security policy.
Claim 10
Dependent Claim
156 words
An information handling system comprising: one or more processors; a memory accessible by the processors; a nonvolatile storage accessible by the processors; a network interface connecting the information handling system to a computer network; and a network tool for creating a secure communication path to a remote computer system, the network tool including: means for exchanging identification data with the remote computer system using a communication path; means for determining, based on the identification data, whether a predefined security policy exists corresponding to the remote computer system, wherein the predefined security policy defines at least one constraint on security associations (SAs) created in accordance with the predefined security policy; and means for establishing a secure communication path using a default security policy in response to determining that the predefined security policy does not exist, wherein the default security policy defines at least one constraint on security associations (SAs) created in accordance with the default security policy.
Claim 11
Dependent Claim
36 words
The information handling system as described in claim 8 wherein the identification data is selected from the group consisting of a gateway address, a host name, a user identifier, an IP address, and a distinguished name.
Claim 12
Dependent Claim
36 words
The information handling system as described in claim 8 wherein the means for establishing the secure communication path further includes: means for determining whether a digital certificate or a pre-shared key is used for encrypting data.
Claim 13
Dependent Claim
45 words
The information handling system as described in claim 8 further comprising: means for searching a group table for a group identifier corresponding to the remote computer system; wherein the predefined security policy corresponds to the group identifier in response to a successful group identifier search.
Claim 14
Dependent Claim
53 words
The information handling system as described in claim 8 further comprising: means for selecting a proposal and transforms corresponding to the default security policy; means for creating a security association payload using the selected proposal and transforms; and means for sending the security association from one computer system to the remote computer system.
Claim 15
Dependent Claim
47 words
The information handling system as described in claim 12 further comprising: means for receiving a response from the remote computer system; means for determining whether the proposal was accepted by the other computer system; and means for verifying identification information in response to the proposal being accepted.
Claim 16
Dependent Claim
129 words
A computer program product stored on a computer operable medium for establishing a secure communication path between a computer system and a remote computer system comprising: means for exchanging identification data with the remote computer system using a communication path; means for determining, based on the identification data, whether a predefined security policy exists corresponding to the remote computer system, wherein the predefined security policy defines at least one constraint on security associations (SAs) created in accordance with the predefined security policy; and means for establishing a secure communication path using a default security policy in response to determining that the predefined security policy does not exist, wherein the default security policy defines at least one constraint on security associations (SAs) created in accordance with the default security policy.
Claim 17
Dependent Claim
129 words
A computer program product stored on a computer operable medium for establishing a secure communication path between a computer system and a remote computer system comprising: means for exchanging identification data with the remote computer system using a communication path; means for determining, based on the identification data, whether a predefined security policy exists corresponding to the remote computer system, wherein the predefined security policy defines at least one constraint on security associations (SAs) created in accordance with the predefined security policy; and means for establishing a secure communication path using a default security policy in response to determining that the predefined security policy does not exist, wherein the default security policy defines at least one constraint on security associations (SAs) created in accordance with the default security policy.
Claim 18
Dependent Claim
36 words
The computer program product as described in claim 14 wherein the identification data is selected from the group consisting of a gateway address, a host name, a user identifier, an IP address, and a distinguished name.
Claim 19
Dependent Claim
36 words
The computer program product as described in claim 14 wherein the means for establishing the secure communication path further includes: means for determining whether a digital certificate or a pre-shared key is used for encrypting data.
Claim 20
Dependent Claim
45 words
The computer program product as described in claim 14 further comprising: means for searching a group table for a group identifier corresponding to the remote computer system; wherein the predefined security policy corresponds to the group identifier in response to a successful group identifier search.
Claim 21
Dependent Claim
53 words
The computer program product as described in claim 14 further comprising: means for selecting a proposal and transforms corresponding to the default security policy; means for creating a security association payload using the selected proposal and transforms; and means for sending the security association from one computer system to the remote computer system.
Claim 22
Dependent Claim
47 words
The computer program product as described in claim 18 further comprising: means for receiving a response from the remote computer system; means for determining whether the proposal was accepted by the other computer system; and means for verifying identification information in response to the proposal being accepted.
Claim 23
Dependent Claim
45 words
The computer program product as described in claim 14 further comprising: means for verifying a remote identifier and a digital signature corresponding to the remote computer system; and means for creating the secure communication path to the remote computer system in response to the verification.
References Cited (Backward Citations)
US5677955A
Cited
US5657390A
Cited
US5671279A
Cited
US5950195A
Cited
US5983350A
Cited
US5903882A
Cited
US5922074A
Cited
US6202157B1
Cited
US6618806B1
Cited
US6289450B1
Cited
US20020099668A1
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2008-08-29 | 2009-02-28 | 2009-08-30 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2012-08-29 | 2013-02-28 | 2013-08-30 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2016-08-29 | 2017-02-28 | 2017-08-30 | $7700.00 | Window Closed / Lapsed |