Bidirectional Security Association for Low-Resource IPSec Transmission
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The use of unidirectional security associations (SAs) in IPSec communication consumes excessive system resources, necessitating the establishment and maintenance of multiple SAs for inbound and outbound communications.
Innovation Solution
A method and apparatus that utilize a single bidirectional SA by employing incremental serial number updates and distinct mathematical transformations to generate different initialization vectors (IVs) for encryption and decryption, allowing a single SA to secure both directions of communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If unidirectional security associations (SAs) are used for IPSec communication, then communication security is ensured, but system resource consumption increases due to the need to establish and maintain multiple SAs for inbound and outbound communications
Solution Approach 1:
The patent merges the functionality of separate inbound and outbound SAs into a single bidirectional SA. By allowing one SA to handle both incoming and outgoing encrypted communications between two nodes, the system reduces the total number of SAs from two per communication pair to one, thereby reducing system resource consumption while maintaining security through the use of distinct initialization vectors for each direction.
Solution Approach 2:
The patent makes a single SA universal by enabling it to serve dual purposes: both inbound and outbound communication security. The same SA identifier and key can be used for both directions, with the distinction handled through different initialization vectors calculated based on the direction of communication, thus eliminating the need for separate dedicated SAs for each direction.
2Reliability
If separate SAs are established for inbound and outbound communication, then communication security is maintained, but the number of SAs increases leading to higher system resource consumption
Solution Approach 1:
The patent combines the resource-intensive SA establishment and maintenance operations into a single bidirectional SA rather than requiring separate SAs for each communication direction. This merging reduces the computational overhead and memory resources required for SA management while preserving security through directional initialization vectors.
Solution Approach 2:
The patent changes the parameters used in SA management by introducing direction-based initialization vectors that allow a single SA to securely handle bidirectional communication. By modifying how IVs are generated (incorporating direction information) rather than creating separate SAs, the system reduces resource consumption while maintaining security requirements.
3Reliability
If multiple SAs are maintained for bidirectional communication, then security policies are enforced for each direction, but the complexity of SA management increases
Solution Approach 1:
The patent merges SA management operations by allowing a single SA to handle both inbound and outbound communications. The simplification is achieved through the use of direction-specific initialization vectors that maintain security policy enforcement without requiring separate SA configurations, thus easing management complexity.
Solution Approach 2:
The patent introduces initialization vectors as intermediaries that carry directional information and security parameters. These IVs act as mediators that enable a single SA to enforce different security policies for inbound and outbound communications without requiring separate SA structures, thereby simplifying SA management while maintaining security enforcement.
Data Source
Figure 1~2
Figure 3~4
Figure 5
AI summary
The present application provides a secure data transmission method and apparatus, and a device. The method comprises: a node 1 incrementally updates an SN1 value, performs first mathematical transformation on the updated SN1 value to calculate an IV1, encrypts a first data packet according to the IV1 and a key, and then sends the encrypted first data packet to a node 2; the node 2 acquires the SN1 value in the first data packet, performs the first mathematical transformation on the acquired SN1 value to calculate the IV1, and decrypts the encrypted first data packet by using the IV1 and the key; the node 2 incrementally updates an SN2 value, performs second mathematical transformation on the updated SN2 value to calculate an IV2, encrypts a second data packet according to the IV2 and the key, and sends the encrypted second data packet to the node 1; the node 1 acquires the SN2 value in the second data packet, performs the second mathematical transformation on the acquired SN2 value to calculate the IV2, and decrypts the encrypted second data packet by using the IV2 and the key. According to the present application, secure data transmission between two nodes is achieved by means of bidirectional SA, and thus required resources are reduced.