Multi-layered packet security

Methods and media for multi-layered packet security control are described. In one embodiment, a header of a packet is modified to include an identifier that identifies a manner in which the packet should be subject to a particular set of a plurality of sets of rules. The particular set of rules dictates how the packet is to be handled. Further, in one embodiment, the packet is communicated to a routing component, and the routing component is configured to reference the identifier to determine which, if any, of the plurality of sets of rules to apply to the packet.

CROSS-REFERENCE TO RELATED APPLICATIONS

Not applicable.

SUMMARY

The present invention is defined by the claims below. Embodiments of the present invention address at least the issues described herein by providing, among other things, technologies for implementing multi-layered packet security. Embodiments of the present invention have several practical applications in the technical arts, including reducing processing resources expended in network communications, providing for configurability of packets and the rules applied to them as they are routed through a network, and providing for multiplexed security having multiple layers of control.

In a first illustrative aspect, a header of a data packet is modified to include an identifier. The identifier identifies and provides for the determination of a manner in which the packet should be subject to a particular set of a plurality of sets of rules, if at all. The particular set of rules dictates how the packet is to be handled. The packet is communicated to a routing component and the routing component is configured to reference the identifier to determine which, if any, of the plurality of sets of rules to apply to the packet.

In a second illustrative aspect, a packet is received that includes an identifier. The identifier identifies a manner in which the packet should be subject (if at all) to a particular set of rules form a group. The particular set of rules dictates how the packet is to be handled. The identifier is referenced to determine which, if any, of the sets of rules to apply to the packet. If there is a particular set of rules to apply, they are.

In a third illustrative aspect, a packet is received that includes a first identifier that identifies a first manner in which the packet should be subject to a first particular set of rules. The first particular set dictates how the packet is to be handled. The first identifier is referenced to determine which, if any, of the first plurality of sets of rules to apply to the packet. If there is a first particular set of rules to apply, the first particular set of rules is applied to the packet. A header of the packet is modified to include a second identifier that identifies a second manner in which the packet should be subject to a second particular set of a second plurality of sets of rules. The second particular set further dictates how the packet is to be handled. The packet is communicated to a routing component that is configured to reference the second identifier to determine which, if any, of the second plurality of sets of rules to apply to the packet.

It should be noted that this Summary is provided to generally introduce the reader to one or more select concepts described below in the Detailed Description in a simplified form. The Summary is not intended to identify key and/or required features of the claimed subject matter, nor is it intended to be used as an aid in determining the scope of the claimed subject matter.

DETAILED DESCRIPTION

Embodiments of the present invention provide multi-layered packet security. The multi-layered packet security allows a network host or a routing component to determine the level of security to be applied to a packet as the packet traverses the network and modify the header of the packet to include an identification of the manner in which the packet should be subject to one of a sets of rules. For instance, assuming a routing component has three available sets of rules that may be applied to a packet, the network host may indicate, by modifying the header of the packet, which of the sets of rules should be applied to the packet when the packet is received by the routing device. By allowing a network host or a routing component to set applicable security, a network can have multi-layered security instead of a single channel of security available only at the routing device using a single set of rules. Stated differently, with a single channel of security, every packet will be subjected to a single set of rules at a routing device. With multi-layered packet security, the routing device may have more than one available sets of rules and, by referencing the identifier in the packet header, the routing device will know which of the more than one available sets of rules to apply. Applying the multi-layered packet security may reduce the processing resources necessary to communicate a packet through a network because once the packet is within an internal security ring, the ingress routing device may modify the packet header to indicate to other routing devices within the security ring that no sets of rules need to be applied to the packet. Additionally, applying the multi-layered packet security provides more comprehensive control of packet communications because one packet from a source going to a destination may be configured to have a first set of rules applied to it at a routing device while another packet from the same source going to the same destination may have a second set of rules applied to it at the same routing device.

Acronyms and Shorthand Notations

Throughout the description of the present invention, several acronyms and shorthand notations are used to aid the understanding of certain concepts pertaining to the associated systems and services. These acronyms and shorthand notations are intended for the purpose of providing an easy methodology of communicating the ideas expressed herein and are in no way meant to limit the scope of the present invention. The following is a list of these acronyms:ACL Access Control ListCD-ROM Compact Disk Read Only MemoryDVD Digital Versatile DiscsEEPROM Electrically Erasable Programmable Read Only MemoryIP Internet ProtocolIPv6 Internet Protocol Version 6MTU Maximum Transmission UnitRAM Random Access MemoryROM Read Only Memory

Further, various technical terms are used throughout this description. An illustrative resource that fleshes out various aspects of these terms can be found inNewton's Telecom Dictionaryby H. Newton, 22nd Edition (2006).

Multi-layered packet security is used to control how a packet is to be handled as it traverses a network. In one embodiment, a header of a packet is modified to include an identifier that identifies a manner in which the packet should be subject to a particular set of a plurality of sets of rules. In one embodiment, the header of the packet may be modified by a network host, which may take the form of an edge router existing at the outside of an internal network, an internal router within an internal network, or various other routing components involved with handling of the packet. Further, in one embodiment, the plurality of sets of rules may include one or more ACLs. In one embodiment, routing components may apply ACLs to determine how to handle a packet. In one embodiment of the present invention, however, are not limited to ACLs. Instead, it is contemplated and within the scope of the present invention that other sets of rules applied to packets dictating how the packet is to be handled may be used. Still further, in one embodiment, the header of the packet is modified to include an extension header such as the extension headers available with IPv6. In one embodiment of the present invention, however, are not limited to modification of extension headers. Nor are embodiments of the present invention limited to IPv6. Instead, it is contemplated and within the scope of the present invention that other packet header modifications may be used to include the identifier. For instance, in one embodiment, the identifier may be included within an existing field of a packet header that is unused or only partially used.

While various embodiments discussed herein refer to a communications network including various components, embodiments are not limited to any particular network configuration or components discussed herein. Rather, other communication network configurations and other components may be used in conjunction with various embodiments of the present invention. Further, as used herein, the phrase “upstream routing component” is used to reference any routing component that receives the packet before the routing component being discussed. Similarly, as used herein, the phrase “downstream routing component” is used to reference any routing component that receives the packet after the routing component being discussed, either directly or indirectly. For instance, in various packet networks there may be a number of routing components existing at “hops” along the packet path from a network host to a destination. Where the routing component exists at one or more hops on the path before the routing component being discussed, it is referred to herein as an “upstream routing component.” Where the routing component exists at one or more hops on the path after the routing component being discussed, it is referred to herein as a “downstream routing component.”

Turning now toFIG. 1, a block diagram of an exemplary operating environment illustrating multi-layered packet security in accordance with an embodiment of the present invention is provided and designated generally by reference numeral100. Exemplary operating environment100is shown to illustratively include network host102, routing component104, destination component106, and packet108. As illustrated here, packet108is sublabeled with the reference numerals108A,108B, and108C for discussion of packet108as it travels through the network. The sub-labels are intended for clarity purposes while discussing packet108. Packet108may, in one embodiment, be routed differently depending upon how a set of rules applied to the packet dictates how the packet should be handled. As illustrated, exemplary operating environment100further includes a packet trash bin118and a reporting file120. As will be discussed in more detail herein, in certain instances, routing component104may communicate packet108to trash bin118and/or reporting file120.

Before engaging in discussion of the details of the functionality of various components included inFIG. 1, an exemplary overview discussion will be presented to help illustrate the functionality of exemplary operating environment100. In traditional packet network communications, a network host creates a packet and facilitates communication of the packet to a destination. During transmission between the network host and the destination, there may be various hops at routing components. Typically, each routing component will have a single ACL, the ACL being a set of rules to determine whether the packet should be forwarded to the destination (or downstream routing component), dropped, or reported to the network administrator. The typical ACLs consider each packet based on the source and destination for the packet. From the source and destination information, the ACLs determined whether to allow the packet and forward it, or whether the packet should be dropped or reported to the network administrator. In the typical scheme, each routing device included only one ACL and applied the ACL to all packets, basing the determination of how to handle the packet on the source and destination information.

Embodiments of the present invention provide multi-layer packet security. Using multi-layer packet security a header of a packet may be modified (either by a network host or a routing component) to include an identifier that identifies a manner in which the packet should be subject to a particular set of a plurality of sets of rules, the particular set dictating how the packet is to be handled. Stated differently, with multi-layer packet security, each routing component in a packet network may have a number of sets of rules to apply to determine whether to forward, drop, or report a packet. Because the routing component will not know which set of rules to apply to a given packet, packets will include the identifier instructing the routing component as to which set of rules to apply.

For instance, in one embodiment, a routing component may have three ACLs (e.g., (1) forwarding all packets from one source and dropping all others; (2) dropping all packets with one destination and forwarding all others; and (3) reporting all packets from one source and forwarding all others). In these embodiments, a network host may modify the header of the packet to include an indication of which ACL to apply to a packet. Or, in these embodiments, an upstream routing component may perform the header modification, including the indication of which ACL to apply. In fact, the network host or upstream routing component may instruct the routing component not to apply any of the three ACLs at all. Thus, instead of limiting packet networks to a single level of security at each individual routing component, embodiments of the present invention provide multi-layered packet security allowing for serial or overlapping security rings, as will be discussed in more detail herein.

Having provided an exemplary overview discussion of multi-layer packet security, the various components of exemplary operating environment100will now be discussed. Network host102facilitates communication of packet108. In one embodiment, network host102modifies a header of packet108to include an identifier that identifies the manner in which the packet should be subject to a particular set of rules, by routing component104for example. In one embodiment of the present invention, the header is modified using an extension header, such as the extension headers available in IPv6. Embodiments are not limited to extension headers, nor to IPv6 implementations. The discussion herein is illustrates various embodiments in which a header may be modified to include an identifier.

As discussed above, in one embodiment, the indicator may indicate to routing component104that a particular set of rules should be applied to packet108. In various other embodiments, the indicator may indicate to routing component104that no sets of rules should be applied to packet108. Still further, in one embodiment, the particular set of rules indicated by the indicator in the header of packet108may not be available to routing component104. For instance, where the set of rules is a particular ACL, routing component104may not have the particular ACL loaded or otherwise available. In one embodiment, where the set of rules indicated by the indicator in the header of packet108is unavailable to routing component104, routing component104may apply a default set of rules to the packet. Thus, network host102(or other upstream routing components) can control security for packets, or ensure that packets are subject to the proper security scheme. For instance, a network host102may classify packets either as part of an “executive” communication or part of a “standard user” communication. Where network host102classifies a packet as “executive,” network host102may modify the header of the packet to include an identifier that identifies a manner of subjecting the packet to a set of rules. In this example, the manner may be subjecting the packet to no rules at all. Thus, upon recognizing the identifier, routing component104would forward the packet without applying any sets of rules. Where network host102classifies a packet as “standard user,” network host102may modify the header of the packet to include an identifier that identifies a set of rules that forwards all packets except those packets with a source of a set of known malicious sites.

Once network host102has modified the header of packet108to include the identifier, network host102will communicate packet108to routing component104. As illustrated here there is only one routing component104between network host102and destination component106. As will be understood and appreciated by those having skill in the art, however, various embodiments of the present invention contemplate a plurality of routing components between network host102and destination component106. For instance, a particular packet, such as packet108, may be transmitted to a number of routing components (i.e., a number of hops) as it traverses a packet network. The illustration of exemplary operating environment100is intended for discussion and is a simplified version of many packet networks that may implement multi-layered packet security.

As previously discussed, in one embodiment, routing components, in addition to network host102, may be configured to modify a header of a packet to include an identifier. For instance, a routing component may be an ingress router for an internal network that is part of the entire packet network. The internal network may include a number of hops before the egress router that communicates packets out to the remainder of the entire packets network. In these embodiments, the ingress router may apply a set of rules on a packet, such as packet108, and may determine that the packet should be forwarded. Instead of applying the same set of rules at every hop within the internal network, the ingress router may modify the header of a packet, such as packet108, to include an identifier that instructs the other routing components within the internal network to avoid the application of any rules to the packet. In this way, the processing power expended to communicate the packet across the internal network would be minimized. Then, in these embodiments, the egress router may remove the identifier from the packet. This functionality will be discussed in more detail herein, but is presented to provide an exemplary instance in which a downstream routing component may modify the header.

In one embodiment, network host102is responsible for ensuring packet108is at or below the MTU for the packet network. As will be understood and appreciated by those having ordinary skill in the art, the MTU is the maximum packet size for transmission in the packet network. Thus, in one embodiment, network host102will construct packets and include a payload appropriately sized so that the bytes of the payload and the packet header do not exceed the MTU. A problem may arise where network host102creates a packet, such as packet108, at the MTU where a downstream router adds additional information, such as an identifier that identifies a manner in which the packet should be subject to a set of rules, to the packet. For instance, if the MTU is 1500 bytes and network host102creates a packet with a 1450-byte payload and a 50-byte header, the packet will exceed the MTU if a downstream router adds an additional 20 bytes to the header to include an identifier. In one embodiment of the present invention contemplate various solutions to ensure the downstream router security functionality of multi-layer packet security does not compromise the viability of a packet as it traverses the packet network. For instance, in one embodiment, the downstream router having multi-layer packet security functionality may advertise an MTU to the network host lower than the actual MTU. For instance, if a downstream router is configured to add an identifier requiring an additional 50 bytes of header space, the downstream router may advertise an MTU to network host102that is 50 bytes less than the actual MTU. In the 1500-byte MTU example, the downstream router may advertise an MTU of 1450. Thus, network host102will create packets (payload+header) having no greater length than 1450 bytes. When downstream router adds an identifier, the total packet length will remain at or below the MTU of 1500 bytes. This exemplary discussion of MTU advertising by routing components is intended for illustrative purposes and is not intended to limit the scope of the present invention to the exemplary embodiments discussed. Instead, it is contemplated and within the scope of the present invention that various MTU advertising techniques may be used by routing components to ensure an appropriate packet size while using multi-layered packet security.

In another embodiment, the downstream router may be configured to split a packet if a packet exceeds an MTU. For instance, where network host102creates a packet at the MTU of 1500 bytes, and where a downstream router adds an identifier that requires an additional 50 bytes of header space, the packet will be above the MTU at 1550 bytes. Here, the downstream router may be configured to recognize that the 1550-byte packet is above the MTU and may further be configured to divide the payload into two smaller payloads and append the header to each. The divided payloads would result in two packets that are below the MTU, allowing for communication across the packet network that is within the bounds of the network's protocols. Again, this discussion is merely exemplary and is not intended to limit the scope of the present invention to the exemplary embodiments discussed because it is contemplated and within the scope of the present invention that other packet-dividing techniques may be used.

Turning now to other components in exemplary operating environment100, routing component104includes a particular set of rules110, a particular set of rules112, and a particular set of rules114, the plurality of sets of rules identified by reference numeral116. As illustrated here, the plurality of sets of rules116are included within routing component104. Embodiments of the present invention, however, are not limited to routing components having local sets of rules, such as the plurality of sets of rules116. Instead, it is contemplated and within the scope of the present invention that the plurality of sets of rules116may be remote from, and accessed by, routing components such as routing component104. As previously discussed, network host102(or another upstream routing component) may modify a header of a packet to include an identifier that identifies a manner in which routing component104should subject the packet to a particular set of rules. For instance, the identifier may indicate to routing component104that particular set of rules112should be applied to a packet. In that instance, routing component104will apply particular set of rules112which will dictate how the packet is to be handled (e.g., whether routing component104will forward the packet, drop the packet, or report the packet). As previously discussed, the plurality of sets of rules116may be ACLs that routing component104may be configured to apply to packets. Because the plurality of sets of rules116will dictate handling of the packet by routing component104, routing component104may forward the packet differently based upon the particular set of rules110,112, and114applied.

By way of example, assuming the identifier in the header of packet108indicates to routing component104to apply the particular set of rules110and the particular set of rules110instructs routing component104to forward the packet (e.g., the particular set of rules110may be an ACL allowing all packets except those from one malicious source and packet108is from a source other than the malicious source). As illustrated, routing component104will forward packet108A to destination component106. As illustrated here, there are no intermediate routing components between routing component104and destination component106, but those having skill in the art will understand and appreciate that in one embodiment of the present invention intermediate routing components may exist. By way of another example, assuming the identifier in the header of packet108indicates to routing component104to apply the particular set of rules112and the particular set of rules112instructs routing component104to drop the packet (e.g., the particular set of rules112may be an ACL dropping all packets except those from one known source and packet108is from a source other than the known source). As illustrated, routing component104will drop packet108B to packet trash bin118. As illustrated the packet is forwarded to packet trash bin118, but in one embodiment, routing component104may not forward the packet at all. By way of yet another example, assuming the identifier in the header of packet108indicates to routing component104to apply the particular set of rules114and the particular set of rules114instructs routing component104to report the packet (e.g., the particular set of rules114may be an ACL reporting all packets except those from one known source and packet108is from a source other than the known source). As illustrated, routing component104will report packet108C to reporting file120. As will be understood and appreciated by those having ordinary skill in the art, reporting file120may be a file, a database, or various types of computer storage media that is configured to collect reported packets for review by a network administrator.

Turning now toFIG. 2, a block diagram of an exemplary operating environment showing multi-layered packet security having overlapping security rings, in accordance with an embodiment of the present invention is illustrated and designated generally by reference numeral200. As illustrated here, exemplary operating environment200includes network host202, ingress routing component204, ingress routing component206, egress routing component208, egress routing component210, and a destination component212. The components illustrated here may be similar to the components ofFIG. 1, but are illustrated and numbered separately for clarity purposes during discussion of the security rings. As illustrated here, an outer security ring214overlaps an inner security ring216. As used herein, the phrase “edge routing component” may be used to refer to both ingress and egress routing components. A packet218is illustrated as it traverses the packet network. As before, sub-headings218A, B, C, and D are used to denote the packet as it progresses through the network so packet218may be more precisely described in some situations.

Exemplary operating environment200illustrates how overlapping security rings may be used with multi-layer packet security. Here, network host202creates packet218and communicates packet218to ingress routing component204without any identifier as to a particular set of rules to be applied by ingress routing component204. Thus, ingress router applies a default set of rules to packet218. Ingress routing component204, however, is not yet ready to communicate packet218to the next hop because ingress routing component204is within outer security ring214. In this exemplary discussion, assume outer security ring214is moderately secure and that a network administrator seeks to apply moderate security (e.g., an ACL dropping packets from known malicious sources and forwarding all others) to packet218. Ingress routing component204may modify packet218with an identifier of the desired set of rules, as indicated at218A having identifier220.

Ingress routing component206receives packet218A and, because it recognizes identifier220, applies the set of rules identified (here, the set of rules for moderate security). Ingress routing component206is not yet ready to communicate packet218A to the next hop because ingress routing component206is within inner security ring216and, in this example, inner security ring216may be very secure.

Thus, in this exemplary discussion, assume a network administrator seeks to apply no sets of rules to packet218A while the packet is in inner security ring216. Ingress routing component206may modify packet218A with an identifier of the manner in which rules are to be applied, indicating to downstream hops that no sets of rules need be applied to packet218A. This is illustrated at packet218B which has identifier220(from the outer security ring214) and identifier222(from inner security ring216).

Egress routing component208then receives packet218B and, because it first recognizes identifier222, applies the particular set of rules identified (here, the manner in which the rules are applied indicate that no sets of rules are to be applied). Egress routing component208is not yet ready to communicate packet218B to the next hop because, as an egress router, egress routing component208will remove the top layer of security from packet218B. Thus, as illustrated here, egress routing component208will remove identifier222from packet218B.

Egress routing component208removes this identifier because, once egress routing component208has communicated the packet, the packet will be outside of inner security ring216, although still within outer security ring214. This is illustrated at packet218C, which has only identifier220(from the outer security ring214). Similarly, egress routing component210, which exists at the downstream edge of outer security ring214, receives packet218C and, recognizing identifier220, applies the particular set of rules identified (here, the set of rules for moderate security).

Egress routing component210then removes identifier220from packet218C and communicates the packet outside outer security ring214to destination component212, as illustrated with packet218D. The exemplary discussion provided with reference toFIG. 2is intended to be illustrative only as a way of demonstrating overlapping security rings. But this exemplary discussion is not intended to limit embodiments of the present invention to the particular examples discussed.

Turning now toFIG. 3, a block diagram of an exemplary operating environment showing multi-layered packet security having serial security rings, in accordance with an embodiment of the present invention is illustrated and designated generally by reference numeral300. As illustrated here, exemplary operating environment300includes a network host302, an ingress routing component304, an egress routing component306, an ingress routing component308, an egress routing component310, and a destination component312. The components illustrated here may be similar to the components ofFIGS. 1-2, but are illustrated and numbered separately for clarity purposes during discussion of the security rings.

As illustrated here, a first security ring314resides adjacent to, or in series with, a second security ring316. A packet318is illustrated as it traverses the packet network. As before, sub-headings318A, B, C, and D are used to denote the packet as it progresses through the network so packet319may be accurately described at various positions. Exemplary operating environment300illustrates how serial security rings may be used with multi-layer packet security. Here, network host302creates packet318and communicates packet318to ingress routing component304without any identifier as to a particular set of rules to be applied by ingress routing component304. Thus, ingress routing component304applies a default set of rules to packet318.

Ingress routing component304, however, is not yet ready to communicate packet318to the next hop because ingress routing component304is within first security ring314. In this exemplary discussion, assuming first security ring314is moderately secure and that a network administrator seeks to apply moderate security (e.g., an ACL dropping packets from known malicious sources and forwarding all others) to packet318. Ingress routing component304may modify packet318with an identifier of the desired set of rules, as illustrated with packet318A, which includes identifier320. Egress routing component306then receives packet318A and, because it recognizes identifier320, applies the set of rules identified (here, the set of rules for moderate security). Egress routing component306, however, will strip packet318A of identifier320before communicating the packet to the next hop because egress routing component306exists at the downstream edge of first security ring314.

Ingress routing component308then receives packet318B and, because there is no identifier attached, applies a default set of rules to packet318B. Ingress routing component308, because it exists at the front edge of second security ring316, is not yet ready to communicate packet318B to the next hop. Instead, assuming for this example that second security ring316is very secure and a network administrator does not want any sets of rules applied to packets while within second security ring316, ingress routing component308may modify packet318B with an identifier of the manner in which rules are to be applied, indicating to downstream hops that no sets of rules need be applied to packet318B.

This is illustrated at packet318C which includes identifier322(from second security ring316). Packet318C is then received by egress routing component310, which exists at the downstream edge of second security ring316. Egress routing component310recognizes identifier322and applies the particular set of rules identified (here, the manner in which the rules are applied indicate that no sets of rules are to be applied). Egress routing component310then removes identifier322from packet318C and communicates the packet outside second security ring316to destination component312, as illustrated with packet318D. The exemplary discussion provided with reference toFIG. 3is intended to be illustrative only as a way of demonstrating overlapping security rings. But this exemplary discussion is not intended to limit embodiments of the present invention to the particular examples discussed.

Turning now toFIG. 4, a block diagram illustrating an exemplary packet header, in accordance with an embodiment of the present invention, is illustrated and designated generally by reference numeral400. Although exemplary packet header400is provided for illustrative purposes, embodiments of the present invention are not limited to the particular header configuration shown inFIG. 4. Instead, it is contemplated that various types of packets, including various header configurations, may be utilized. In the exemplary packet header400, an identifier410may be included within an extension header402. As illustrated, extension header402also includes a next header field404, an extension header length field406, and a reserved field408.

The illustrated header is similar to headers and header extensions used with IPv6. Embodiments of the present invention, however, are not limited to IPv6 implementations. Instead, it is contemplated and within the scope of the present invention that multi-layered packet security may be used with various packet types having various header structure. Further, although the discussion herein focuses on modifying a header of a packet to include an identifier, such as identifier410into an extension header, embodiments of the present invention contemplate that a header of a packet may be modified in other ways to include an identifier.

Turning now toFIG. 5, a flow diagram illustrating an exemplary method for multi-layered packet security, in accordance with an embodiment of the present invention, is illustrated and designated generally by reference numeral500. Initially, as indicated at a step502, a header of a packet, e.g., packet108ofFIG. 1, is modified to include an identifier that identifies a manner in which the packet should be subject to a particular set of a plurality of sets of rules. In one embodiment, the particular set of rules dictates how the packet is to be handled. As previously stated, the packet may be modified by a network host, an edge router existing on the edge of a security ring, or any other routing component existing on a packet network.

At a step504, the packet is communicated to a routing component, e.g., routing component104ofFIG. 1. In one embodiment, the routing component is configured to reference the identifier to determine which, if any, of the plurality of sets of rules to apply to the packet. For instance, as previously stated, the routing component may have three available ACLs to apply to packets and the indicator may instruct the routing component to apply a particular ACL or no ACL at all. Depending upon the result of applying a particular ACL or no ACL to the packet, the routing component may be configured to forward, drop, or report the packet.

Turning now toFIG. 6, a flow diagram of an exemplary method for multi-layered packet security, the method having a different point of view than the method ofFIG. 5, in accordance with an embodiment of the present invention, is illustrated and designated generally by reference numeral600. Initially, as indicated at a step602, a packet is received, e.g., by routing component104ofFIG. 1. As previously discussed, in one embodiment the packet includes an identifier that identifies a manner in which the packet should be subject to a particular set of a plurality of sets of rules and the particular set dictates how the packet is to be handled. For instance, where a network host or an upstream router is within a security ring, the network host or upstream router may provide instructions regarding the type of security, or sets of rules, to apply.

As indicated at a step604, the identifier is referenced to determine which, if any, of the plurality of sets of rules to apply to the packet. As previously discussed, a routing component may have available a number of sets of rules and the identifier may indicate which of the sets of rules to apply. Also, in one embodiment the identifier indicates that none of the sets of rules is to be applied. Still further the identifier may indicate a set of rules that is unavailable to the routing component. In those embodiments, the routing component may be configured to apply a default set of rules to the packet.

At a step606, a particular set of the plurality of sets of rules, if any, is applied to the packet. For instance, as previously discussed, where the sets of rules are ACLs, the routing component may apply a particular ACL to determine whether to forward the packet to the next hop. If the routing component determines, by applying the particular ACL that the packet is not to be forwarded, the routing component will further determine whether to drop the packet or to report the packet to a network administrator. At a step608, the packet is communicated to a routing component, e.g., routing component104ofFIG. 1, as discussed with reference toFIG. 5.

Turning now toFIG. 7, a flow diagram of an exemplary method for multi-layered packet security, the method having more detail than the method ofFIGS. 5 and 6, in accordance with an embodiment of the present invention is illustrated and designated generally by reference numeral700. Initially, as indicated at step702, a packet is received, e.g., by routing component104ofFIG. 1. At steps704and706, the identifier is referenced and a particular set of rules, if any, is applied to the packet as previously discussed with reference toFIG. 6. Further, at a step708, the packet is modified to include another identifier and then the packet is communicated as illustrated at a step710and as previously discussed with reference toFIG. 5. Thus, the flow shown inFIG. 7may include embodiments in which a routing component receives a packet with multi-layered packet security and applies yet another layer of security to the packet. For instance, in one embodiment, the routing component may be in an overlapping security ring scheme such as that discussed with reference toFIG. 2.