Distributed IPSec Session Rekeying Across IKE Nodes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Internet Protocol Security (IPsec) environments face scaling limitations due to single-host key negotiation processes for IKE and ESP security associations, which restricts the distribution and dynamic rekeying of sessions, treating IKE nodes like 'pets' rather than 'cattle', limiting cloud-native scalability.
Innovation Solution
Implementing decentralized IPSec key negotiations by splitting the rekeying process across multiple IKE nodes, utilizing a key value store to distribute and manage encryption keys, allowing any IKE node to initiate rekeying, and employing equal cost multi-path routing for load balancing, treating IKE nodes as 'cattle' for scalable cloud-native VPNs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If single-host key negotiation process is used for IKE and ESP security associations, then security key management is simplified and performed on a single host, but scaling limitations occur and cloud-native scalability is restricted
Solution Approach 1:
The patent segments the key negotiation process by separating IKE SA management (control plane) from ESP SA management (data plane). IKE SAs are negotiated and managed on a single host, while ESP SAs can be negotiated and managed on multiple hosts. This segmentation allows the system to maintain simplified control plane operations while enabling scalable data plane operations across multiple hosts, thereby resolving the contradiction between process simplicity and cloud-native scalability.
2Reliability
If rekeying process is handled on a single host, then key negotiation is centralized and secure, but scaling limitations prevent dynamic rekeying across multiple hosts
Solution Approach 1:
The patent divides the rekeying functionality into two segments: IKE rekeying remains centralized on a single host to maintain security and reliability, while ESP rekeying is distributed across multiple hosts to enable scalable operations. This segmentation allows the system to preserve the security benefits of centralized key management while achieving the productivity gains of distributed rekeying operations.
3Stability of the object's composition
If all IKE nodes are treated as 'pets' with dedicated session management, then session stability is maintained, but scalability is limited and resource utilization is inefficient
Solution Approach 1:
The patent segments session management by separating control plane sessions (IKE SAs) from data plane sessions (ESP SAs). IKE sessions are maintained with stable, dedicated node assignments similar to 'pets', while ESP sessions can be dynamically assigned and reassigned across multiple hosts similar to 'cattle'. This segmentation allows the system to maintain session stability for control plane operations while achieving cloud-native scalability for data plane operations.
Data Source
AI summary
Methods are provided for decentralized key negotiation. One method includes initiating, by a first Internet Key Exchange (IKE) node from among a plurality of IKE nodes, a rekeying process for an Internet Protocol Security (IPSec) communication session established with a client device and serviced by a second IKE node from among the plurality of IKE nodes, and in which a first encryption key is used to encrypt traffic. The method further includes obtaining, by the first IKE node from a key value store, information about the IPSec communication session and performing, by the first IKE node, at least a part of the rekeying process in which the first encryption key is replaced with a second encryption key for the IPSec communication session.