专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明授权

US08275989B2 Method of negotiating security parameters and authenticating users interconnected to a network 有权
标题翻译：协商安全参数和认证与网络互连的用户的方法
公开(公告)号：US08275989B2
公开(公告)日：2012-09-25
申请号：US12500381
申请日：2009-07-09
申请人： Christian Huitema , Paul G. Mayfield , Brian D. Swander , Sara Bitan , Daniel R. Simon
发明人： Christian Huitema , Paul G. Mayfield , Brian D. Swander , Sara Bitan , Daniel R. Simon
IPC分类号： H04L29/06
CPC分类号： H04L63/061 , H04L9/0844 , H04L63/0823 , H04L63/164 , H04L63/20
摘要： A method for authenticating and negotiating security parameters among two or more network devices is disclosed. The method has a plurality of modes including a plurality of messages exchanged between the two or more network devices. In a main mode, the two or more network devices establish a secure channel and select security parameters to be used during a quick mode and a user mode. In the quick mode, the two or more computers derive a set of keys to secure data sent according to a security protocol. The optional user mode provides a means of authenticating one or more users associated with the two or more network devices. A portion of the quick mode is conducted during the main mode thereby minimizing the plurality of messages that need to be exchanged between the initiator and the responder.
摘要翻译：公开了一种用于在两个或多个网络设备之间认证和协商安全参数的方法。该方法具有多个模式，包括在两个或多个网络设备之间交换的多个消息。在主模式中，两个或多个网络设备建立安全通道并选择在快速模式和用户模式期间使用的安全参数。在快速模式下，两台或多台计算机派生一组密钥来保护根据安全协议发送的数据。可选的用户模式提供了认证与两个或多个网络设备相关联的一个或多个用户的手段。快速模式的一部分在主模式期间进行，从而最小化需要在启动器和应答器之间交换的多个消息。

2. 发明申请

US20090276828A1 METHOD OF NEGOTIATING SECURITY PARAMETERS AND AUTHENTICATING USERS INTERCONNECTED TO A NETWORK 有权
标题翻译：协调安全参数和认证用户互联网络的方法
公开(公告)号：US20090276828A1
公开(公告)日：2009-11-05
申请号：US12500381
申请日：2009-07-09
申请人： Brian D. Swander , Sara Bitan , Christian Huitema , Paul G. Mayfield , Daniel R. Simon
发明人： Brian D. Swander , Sara Bitan , Christian Huitema , Paul G. Mayfield , Daniel R. Simon
IPC分类号： G06F21/00
CPC分类号： H04L63/061 , H04L9/0844 , H04L63/0823 , H04L63/164 , H04L63/20
摘要： A method for authenticating and negotiating security parameters among two or more network devices is disclosed. The method has a plurality of modes including a plurality of messages exchanged between the two or more network devices. In a main mode, the two or more network devices establish a secure channel and select security parameters to be used during a quick mode and a user mode. In the quick mode, the two or more computers derive a set of keys to secure data sent according to a security protocol. The optional user mode provides a means of authenticating one or more users associated with the two or more network devices. A portion of the quick mode is conducted during the main mode thereby minimizing the plurality of messages that need to be exchanged between the initiator and the responder.
摘要翻译：公开了一种用于在两个或多个网络设备之间认证和协商安全参数的方法。该方法具有多个模式，包括在两个或多个网络设备之间交换的多个消息。在主模式中，两个或多个网络设备建立安全通道并选择在快速模式和用户模式期间使用的安全参数。在快速模式下，两台或多台计算机派生一组密钥来保护根据安全协议发送的数据。可选的用户模式提供了认证与两个或多个网络设备相关联的一个或多个用户的手段。快速模式的一部分在主模式期间进行，从而最小化需要在启动器和应答器之间交换的多个消息。

3. 发明授权

US07574603B2 Method of negotiating security parameters and authenticating users interconnected to a network 有权
标题翻译：协商安全参数和认证与网络互连的用户的方法
公开(公告)号：US07574603B2
公开(公告)日：2009-08-11
申请号：US10713980
申请日：2003-11-14
申请人： Brian D. Swander , Sara Bitan , Christian Huitema , Paul G. Mayfield , Daniel R. Simon
发明人： Brian D. Swander , Sara Bitan , Christian Huitema , Paul G. Mayfield , Daniel R. Simon
IPC分类号： H04L9/00
CPC分类号： H04L63/061 , H04L9/0844 , H04L63/0823 , H04L63/164 , H04L63/20
摘要： A method for authenticating and negotiating security parameters among two or more network devices is disclosed. The method has a plurality of modes including a plurality of messages exchanged between the two or more network devices. In a main mode, the two or more network devices establish a secure channel and select security parameters to be used during a quick mode and a user mode. In the quick mode, the two or more computers derive a set of keys to secure data sent according to a security protocol. The optional user mode provides a means of authenticating one or more users associated with the two or more network devices. A portion of the quick mode is conducted during the main mode thereby minimizing the plurality of messages that need to be exchanged between the initiator and the responder.
摘要翻译：公开了一种用于在两个或多个网络设备之间认证和协商安全参数的方法。该方法具有多个模式，包括在两个或多个网络设备之间交换的多个消息。在主模式中，两个或多个网络设备建立安全通道并选择在快速模式和用户模式期间使用的安全参数。在快速模式下，两台或多台计算机派生一组密钥来保护根据安全协议发送的数据。可选的用户模式提供了认证与两个或多个网络设备相关联的一个或多个用户的手段。快速模式的一部分在主模式期间进行，从而最小化需要在启动器和应答器之间交换的多个消息。

4. 发明申请

US20100318800A1 KEY MANAGEMENT IN SECURE NETWORK ENCLAVES 有权
标题翻译：安全网络安全的关键管理
公开(公告)号：US20100318800A1
公开(公告)日：2010-12-16
申请号：US12483095
申请日：2009-06-11
申请人： Daniel R. Simon , Brian D. Swander , Pascal Menezes , Gabriel E. Montenegro
发明人： Daniel R. Simon , Brian D. Swander , Pascal Menezes , Gabriel E. Montenegro
IPC分类号： H04L9/00
CPC分类号： H04L9/0836 , H04L9/0866 , H04L9/0869 , H04L9/3226 , H04L63/0272 , H04L63/0428 , H04L63/064 , H04L63/164
摘要： A hierarchical key generation and distribution mechanism for a computer system in which devices are organized into secure enclaves. The mechanism enables network access to be tailored to approximate minimum needed privileges for each device. At the lowest level of the hierarchy, keys are used to form security associations between devices. Keys at each level of the hierarchy are generated from keys at a higher level of the hierarchy and key derivation information. Key derivation information is readily ascertainable, either from identifiers for devices or from within messages, supporting hardware offload of cryptographic functions. Because keys may be generated based on the enclaves in which the hosts participating in a security association are located, the system includes a mechanism by which devices can discover the enclave in which they are located.
摘要翻译：用于计算机系统的分层密钥生成和分发机制，其中设备被组织成安全的飞地。该机制使网络访问能够被定制，以达到每个设备所需的最低权限。在层次结构的最低层，密钥用于形成设备之间的安全关联。层次结构的每个级别的密钥都是从层次较高级别的密钥和密钥导出信息生成的。密钥导出信息可以从设备的标识符或消息内容中确定，从而支持加密功能的硬件卸载。因为可以基于参与安全关联的主机所在的包围来生成密钥，所以系统包括一种机构，通过该机制，设备可以发现它们所在的飞地。

5. 发明授权

US08352741B2 Discovery of secure network enclaves 有权
标题翻译：发现安全网络飞地
公开(公告)号：US08352741B2
公开(公告)日：2013-01-08
申请号：US12483052
申请日：2009-06-11
申请人： Daniel R. Simon , Brian D. Swander , Pascal Menezes , Gabriel E. Montenegro
发明人： Daniel R. Simon , Brian D. Swander , Pascal Menezes , Gabriel E. Montenegro
IPC分类号： H04L9/32
CPC分类号： H04L9/0836 , H04L9/0861 , H04L9/14 , H04L9/32 , H04L63/0272 , H04L63/0281 , H04L63/0464 , H04L63/061 , H04L63/064 , H04L63/164 , H04L2463/061
摘要： A hierarchical key generation and distribution mechanism for a computer system in which devices are organized into secure enclaves. The mechanism enables network access to be tailored to approximate minimum needed privileges for each device. At the lowest level of the hierarchy, keys are used to form security associations between devices. Keys at each level of the hierarchy are generated from keys at a higher level of the hierarchy and key derivation information. Key derivation information is readily ascertainable, either from identifiers for devices or from within messages, supporting hardware offload of cryptographic functions. Because keys may be generated based on the enclaves in which the hosts participating in a security association are located, the system includes a mechanism by which devices can discover the enclave in which they are located.
摘要翻译：用于计算机系统的分层密钥生成和分发机制，其中设备被组织成安全的飞地。该机制使网络访问能够被定制，以达到每个设备所需的最低权限。在层次结构的最低层，密钥用于形成设备之间的安全关联。层次结构的每个级别的密钥都是从层次较高级别的密钥和密钥导出信息生成的。密钥导出信息可以从设备的标识符或消息内容中确定，从而支持加密功能的硬件卸载。因为可以基于参与安全关联的主机所在的包围来生成密钥，所以系统包括一种机构，通过该机制，设备可以发现它们所在的飞地。

6. 发明申请

US20100318799A1 DISCOVERY OF SECURE NETWORK ENCLAVES 有权
标题翻译：发现安全网络包装
公开(公告)号：US20100318799A1
公开(公告)日：2010-12-16
申请号：US12483052
申请日：2009-06-11
申请人： Daniel R. Simon , Brian D. Swander , Pascal Menezes , Gabriel E. Montenegro
发明人： Daniel R. Simon , Brian D. Swander , Pascal Menezes , Gabriel E. Montenegro
IPC分类号： H04L9/32
CPC分类号： H04L9/0836 , H04L9/0861 , H04L9/14 , H04L9/32 , H04L63/0272 , H04L63/0281 , H04L63/0464 , H04L63/061 , H04L63/064 , H04L63/164 , H04L2463/061
摘要： A hierarchical key generation and distribution mechanism for a computer system in which devices are organized into secure enclaves. The mechanism enables network access to be tailored to approximate minimum needed privileges for each device. At the lowest level of the hierarchy, keys are used to form security associations between devices. Keys at each level of the hierarchy are generated from keys at a higher level of the hierarchy and key derivation information. Key derivation information is readily ascertainable, either from identifiers for devices or from within messages, supporting hardware offload of cryptographic functions. Because keys may be generated based on the enclaves in which the hosts participating in a security association are located, the system includes a mechanism by which devices can discover the enclave in which they are located.
摘要翻译：用于计算机系统的分层密钥生成和分发机制，其中设备被组织成安全的飞地。该机制使网络访问能够被定制，以达到每个设备所需的最低权限。在层次结构的最低层，密钥用于形成设备之间的安全关联。层次结构的每个级别的密钥都是从层次较高级别的密钥和密钥导出信息生成的。密钥导出信息可以从设备的标识符或消息内容中确定，从而支持加密功能的硬件卸载。因为可以基于参与安全关联的主机所在的包围来生成密钥，所以系统包括一种机构，通过该机制，设备可以发现它们所在的飞地。

7. 发明申请

US20100228962A1 OFFLOADING CRYPTOGRAPHIC PROTECTION PROCESSING 审中-公开
标题翻译：卸载CRYPTOGRAPHIC保护处理
公开(公告)号：US20100228962A1
公开(公告)日：2010-09-09
申请号：US12400281
申请日：2009-03-09
申请人： Daniel R. Simon , Pascal Menezes , Brian D. Swander
发明人： Daniel R. Simon , Pascal Menezes , Brian D. Swander
IPC分类号： H04L9/06
CPC分类号： H04L9/0844 , H04L63/0428 , H04L63/0471 , H04L63/0485 , H04L63/061
摘要： Some embodiments are directed to processing packet data sent according to a security protocol between a first computer and a second computer via a forwarding device. The forwarding device performs a portion of the processing, and forwards the packet data to a third computer, connected to the forwarding device, for other processing. The third computer may support non-standard extensions to the security protocol, such as extensions used in authorizing and establishing a connection over the secure protocol. The packet data may be subject to policies, such as firewall policies or security policies, that may be detected by the third computer. The third computer sends the results of its processing, such as a cryptographic key, or a detected access control policy, to the forwarding device.
摘要翻译：一些实施例涉及经由转发设备处理根据第一计算机和第二计算机之间的安全协议发送的分组数据。转发设备执行处理的一部分，并将分组数据转发到连接到转发设备的第三计算机，以进行其他处理。第三台计算机可能支持安全协议的非标准扩展，例如用于通过安全协议建立和建立连接的扩展。分组数据可能受到可能由第三计算机检测到的策略，例如防火墙策略或安全策略。第三台计算机向转发设备发送其处理结果，如加密密钥或检测到的访问控制策略。

8. 发明授权

US09742560B2 Key management in secure network enclaves 有权
公开(公告)号：US09742560B2
公开(公告)日：2017-08-22
申请号：US12483095
申请日：2009-06-11
申请人： Daniel R. Simon , Brian D. Swander , Pascal Menezes , Gabriel E. Montenegro
发明人： Daniel R. Simon , Brian D. Swander , Pascal Menezes , Gabriel E. Montenegro
IPC分类号： H04L9/00 , H04L9/08 , H04L29/06
CPC分类号： H04L9/0836 , H04L9/0866 , H04L9/0869 , H04L9/3226 , H04L63/0272 , H04L63/0428 , H04L63/064 , H04L63/164
摘要： A hierarchical key generation and distribution mechanism for a computer system in which devices are organized into secure enclaves. The mechanism enables network access to be tailored to approximate minimum needed privileges for each device. At the lowest level of the hierarchy, keys are used to form security associations between devices. Keys at each level of the hierarchy are generated from keys at a higher level of the hierarchy and key derivation information. Key derivation information is readily ascertainable, either from identifiers for devices or from within messages, supporting hardware offload of cryptographic functions. Because keys may be generated based on the enclaves in which the hosts participating in a security association are located, the system includes a mechanism by which devices can discover the enclave in which they are located.

9. 发明授权

US08289970B2 IPSec encapsulation mode 有权
标题翻译： IPSec封装模式
公开(公告)号：US08289970B2
公开(公告)日：2012-10-16
申请号：US12505074
申请日：2009-07-17
申请人： Brian D. Swander , Daniel R. Simon
发明人： Brian D. Swander , Daniel R. Simon
IPC分类号： H04L12/28 , H04L12/56 , H04L29/06 , G06F9/00 , G06F15/16 , G06F17/00
CPC分类号： H04L63/02 , H04L63/164 , H04L63/20
摘要： Described are embodiments directed to negotiating an encapsulation mode between an initiator and a responder. As part of the negotiation of the security association, an encapsulation mode is negotiated that allows packets to be sent between the initiator and responder without encapsulation. The ability to send packets without encapsulation allows intermediaries, such as a firewall, at the responder to easily inspect the packets and implement additional features such as security filtering.
摘要翻译：描述了旨在协商发起者和应答者之间的封装模式的实施例。作为安全关联协商的一部分，协商一种封装模式，允许在发起者和应答者之间发送数据包，而无需封装。发送数据包而不封装的能力允许响应方的中间人（如防火墙）轻松检查数据包，并实现其他功能，如安全过滤。

10. 发明申请

US20110013634A1 Ipsec Encapsulation Mode 有权
标题翻译： Ipsec封装模式
公开(公告)号：US20110013634A1
公开(公告)日：2011-01-20
申请号：US12505074
申请日：2009-07-17
申请人： Brian D. Swander , Daniel R. Simon
发明人： Brian D. Swander , Daniel R. Simon
IPC分类号： H04L12/56 , G06F3/00 , G06F17/00
CPC分类号： H04L63/02 , H04L63/164 , H04L63/20
摘要： Described are embodiments directed to negotiating an encapsulation mode between an initiator and a responder. As part of the negotiation of the security association, an encapsulation mode is negotiated that allows packets to be sent between the initiator and responder without encapsulation. The ability to send packets without encapsulation allows intermediaries, such as a firewall, at the responder to easily inspect the packets and implement additional features such as security filtering.
摘要翻译：描述了旨在协商发起者和应答者之间的封装模式的实施例。作为安全关联协商的一部分，协商一种封装模式，允许在发起者和应答者之间发送数据包，而无需封装。发送数据包而不封装的能力允许响应方的中间人（如防火墙）轻松检查数据包，并实现其他功能，如安全过滤。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式