ESP Rehashing for Stateless IPsec Traffic Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for generating stateless ESP packets for performance testing of telecommunications equipment are computationally burdensome due to the high number of encryption operations required, which limits the speed of packet generation as networks handle increasing traffic volumes.
Innovation Solution
The method involves ESP rehashing, where a first ESP packet is generated by encrypting a portion, adding headers and trailers, computing an integrity check value (ICV), and then modifying the ESP header to create a second packet with a new ICV, reducing the need for repeated encryption operations by reusing or incrementing parameters in subsequent packets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional methods are used to generate stateless ESP packets by applying encryption and hashing operations to each packet, then the packets are properly secured with ESP encapsulation, but the number of encryption operations becomes computationally burdensome and limits packet generation speed
Solution Approach 1:
The patent applies preliminary action by performing encryption operations once on a base packet and then reusing the encrypted payload for multiple subsequent packets. The encrypted payload is pre-computed and stored, eliminating the need to re-encrypt the same data for each packet. Only the ICV (integrity check value) needs to be recomputed for each packet, which is computationally less intensive than full encryption.
Solution Approach 2:
The patent uses copying by creating multiple packets from a single encrypted payload template. The encrypted payload is copied and reused across multiple ESP packets, with only the header fields (such as sequence number and ICV) being modified for each packet. This copying approach maintains security while dramatically reducing the computational overhead of repeated encryption operations.
2Reliability
If encryption operations are performed on each packet to ensure security, then the packets maintain integrity and confidentiality, but the computational burden increases and testing efficiency decreases
Solution Approach 1:
The encryption operation is performed in advance on the payload data, and the encrypted result is cached for reuse. This preliminary encryption action eliminates the need to perform time-consuming encryption operations repeatedly for each packet in the test stream, significantly reducing the time loss while maintaining confidentiality.
Solution Approach 2:
The patent changes the parameter being modified for each packet from the encrypted payload itself to only the header fields (sequence number, ICV). By changing which parameters are modified rather than re-encrypting the entire packet, the time required per packet is reduced while still maintaining packet integrity through proper ICV computation.
3Reliability
If full encryption and hashing is applied to every packet for accurate security testing, then the testing reflects real-world security processing, but the equipment under test must handle increased computational load
Solution Approach 1:
The patent applies local quality by differentiating between packets that require full encryption processing and those that can use reused encrypted payloads. In testing scenarios, this allows the system to maintain security testing accuracy for packets that need verification while reducing computational load for packets that can safely reuse encrypted content, optimizing the balance between testing fidelity and processing power consumption.
Data Source
AI summary
Methods, systems, and computer readable media for accelerating stateless IPsec traffic generation by performing ESP rehashing of ESP packets are disclosed. A first ESP packet is generated by encrypting a portion of the packet and adding ESP headers and trailers to the encrypted portion, hashing the encrypted portion and the ESP header to compute a first ESP integrity check value (ICV), and adding the ESP ICV as a trailer to the ESP packet. At least one second ESP packet is generated by modifying parameters in the first ESP packet. The first and second ESP packets are transmitted to a device under test.