ESP Packet MTU Discovery for IKE over NAT Traffic Continuity

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In IKE over NAT scenarios, IP fragmentation can lead to incorrect processing of non-initial fragments by routers, causing traffic interruptions due to unknown Maximum Transmission Unit (MTU) in untrusted networks.

Innovation Solution

A method where a first communication device receives an ESP packet from a second communication device, calculates the MTU in the path, and notifies the second communication device. The second communication device then adjusts the packet size or fragments the original IP packet based on the notified MTU to prevent incorrect processing.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If IP fragmentation is used to traverse networks with unknown MTU, then packets can reach their destination, but non-initial fragments may be incorrectly processed by routers causing traffic interruption

Engineering Contradiction:

Improvepacket transmission capabilityVSAvoidtraffic flow continuity

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent applies preliminary action by performing MTU discovery and path capability assessment before actual data transmission. The method establishes security associations with pre-negotiated packet size parameters, ensuring that packets are transmitted at appropriate sizes from the outset, thereby preventing fragmentation issues before they occur.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent implements feedback mechanisms where endpoints exchange information about path MTU and fragmentation capabilities during IKEv2 negotiations. This feedback allows the system to adapt packet sizes based on actual network conditions, preventing incorrect processing of fragments while maintaining reliable traffic flow.

Inventive Principle:

Principle #23Feedback

2Productivity

If large packets are transmitted without fragmentation, then processing overhead is reduced, but packets may be dropped if they exceed the MTU of intermediate routers

Engineering Contradiction:

Improveprocessing efficiencyVSAvoidpacket delivery reliability

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent performs preliminary MTU discovery and path assessment before transmission, allowing the system to determine the maximum packet size that can traverse the network path without fragmentation. This preliminary action ensures optimal packet sizing is established in advance, balancing processing efficiency with delivery reliability.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent dynamically adjusts packet size parameters based on discovered path characteristics and negotiated security association parameters. By changing the packet size parameter to match the path MTU, the system maintains high processing efficiency while ensuring reliable packet delivery without excessive fragmentation.

Inventive Principle:

Principle #35Parameter changes

3Reliability

If packet size is reduced to avoid fragmentation, then correct processing is ensured, but transmission efficiency decreases due to increased packet count

Engineering Contradiction:

Improvepacket processing accuracyVSAvoidtransmission efficiency

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent optimizes the packet size parameter by negotiating the maximum transmission unit during IKEv2 security association establishment. This parameter adjustment allows packets to be transmitted at the largest possible size that avoids fragmentation, thereby maintaining both processing accuracy and transmission efficiency simultaneously.

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS20250141843A1Communication Devices and Methods Therein for Facilitating IPSEC Communications

Publication Date: 2025.05.01 TELEFONAKTIEBOLAGET LM ERICSSON (PUBL)

AI summary

The present disclosure provides a method (200) performed by a first communication device. The method (200) includes: receiving (210), from a second communication device, an Encapsulating Security Payload, ESP, packet that is an initial fragment; calculating (220), from the ESP packet, a Maximum Transmission Unit, MTU, in a path from the second communication device to the first communication device; and notifying (230) the second communication device of the calculated MTU.