US 12,289,600 B2
Establishing multiple security associations in a connection operation
Adhip Gupta, San Jose, CA (US); Rajagopalan Ammanur, Los Altos, CA (US); Sreedhar Ganjikunta, Cupertino, CA (US); and Uday Srinivasan, Fremont, CA (US)
Assigned to ARISTA NETWORKS, INC., Santa Clara, CA (US)
Filed by Arista Networks, Inc., Santa Clara, CA (US)
Filed on May 17, 2022, as Appl. No. 17/746,503.
Application 17/746,503 is a continuation in part of application No. 17/495,705, filed on Oct. 6, 2021, abandoned.
Application 17/495,705 is a continuation of application No. 16/667,805, filed on Oct. 29, 2019, granted, now 11,146,959, issued on Oct. 12, 2021.
Prior Publication US 2022/0279350 A1, Sep. 1, 2022
This patent is subject to a terminal disclaimer.
Int. Cl. H04W 12/08 (2021.01); H04L 9/40 (2022.01); H04W 12/0433 (2021.01)
CPC H04W 12/08 (2013.01) [H04L 63/18 (2013.01); H04L 63/20 (2013.01); H04W 12/0433 (2021.01)] 20 Claims
OG exemplary drawing
 
1. A non-transitory computer-readable storage medium having embodied thereon a program, the program being executable by a processor to perform a method comprising:
identifying, by an agent of a first networking device, a plurality of data paths between the first networking device and a second networking device, wherein a given data path connects an interface of the first networking device with an interface of the second networking device, each interface being uniquely identified by an associated Internet Protocol (IP) address;
establishing, by the agent, a secure connection, wherein establishing the secure connection includes:
establishing a connection between the first and second networking devices using a first IP address of the first networking device and a second IP address of the second networking device;
negotiating security keys to establish the secure connection, the security keys including encryption keys and decryption keys;
generating an inbound security association and an outbound security association for each of the plurality of data paths, a given inbound security association including IP addresses associated with the given data path and a respective decryption key of the decryption keys, a given outbound security association including IP addresses associated with the given data path and a respective encryption key of the encryption keys; and
installing the inbound security association and outbound security association of each of the plurality of data paths in a data plane of the first networking device.