Central Controller for IPSec SA Configuration in Network Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Establishing IPSec Security Associations (SAs) among multiple routers is tedious, complex, and lacks security, especially in network virtualization, due to the need for manual configuration and excessive negotiation channels, and there is a lack of feasible methods for programmable interfaces to establish IPSec SAs.
Innovation Solution
A central controller configures parameter sets for each forwarding device to establish IPSec SAs, negotiates to create security channels, and sends these parameters through secure channels, using protocols like IKE and SNMP, to simplify the process and enhance security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual configuration or automatic negotiation is used to establish IPSec SAs among multiple routers, then security association can be established, but the process becomes tedious and complex with excessive negotiation channels
Solution Approach 1:
The patent introduces a controller as an intermediary device that centrally manages IPSec SA establishment among multiple forwarding devices. The controller generates SA parameters, distributes them to forwarding devices, and coordinates the establishment process, thereby simplifying the overall system complexity while maintaining reliable SA establishment. This mediator approach eliminates the need for complex peer-to-peer negotiations between multiple routers.
2Ease of operation
If automatic negotiation is used among multiple routers, then SA can be established without user intervention, but excessive negotiation channels are occupied
Solution Approach 1:
The controller acts as a central intermediary that manages all SA parameter distribution and negotiation coordination. Instead of having multiple direct negotiation channels between forwarding devices, all communication converges through the controller, reducing the number of active negotiation channels from O(n²) to O(n) where n is the number of forwarding devices.
Solution Approach 2:
The patent merges multiple negotiation functions into a single centralized controller. The controller consolidates the roles of multiple negotiating peers into one device, combining parameter generation, distribution, and coordination functions. This merging reduces the total number of negotiation channels required while maintaining automatic negotiation capabilities.
3Reliability
If manual configuration is used for each router, then security can be maintained, but operation becomes tedious and complex
Solution Approach 1:
The system implements self-service configuration where the controller automatically generates SA parameters and distributes them to forwarding devices without requiring manual intervention. The forwarding devices automatically receive and apply the configuration parameters, eliminating tedious manual operations while maintaining security through controlled parameter distribution.
Solution Approach 2:
The controller serves as a secure intermediary that manages configuration distribution. It generates cryptographically secure SA parameters and distributes them through controlled channels to forwarding devices, maintaining configuration security while automating the entire process. This eliminates the need for manual secure configuration while preserving security guarantees.
Data Source
Figure 1~2
Figure 3~4
Figure 5
AI summary
The disclosure discloses a method, device and system for sending configuration information. The method includes: a central controller respectively configures a parameter set for each of multiple forwarding devices, wherein the parameter set is used for establishing Security Associations (SA) between each pair of forwarding devices in the multiple forwarding devices; the central controller negotiates with the each of the multiple forwarding devices and creates one or more security channels between the central controller and the each of the multiple forwarding devices; and the central controller sends the parameter set to the each of the multiple forwarding devices through the one or more security channels. According to the technical solutions provided by the disclosure, complexity in establishment of SAs among the multiple forwarding devices is lowered, and data transmission security is improved.