Gateway Replay Window Management for Multipath VPN Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managing secure connections between gateways in multipath connections is challenging due to disruptions in sequence numbers that prevent replay attacks, especially when multiple paths are used, as existing technologies struggle to maintain secure VPN connections effectively.
Innovation Solution
The method involves receiving packets with security protocol headers, identifying unique path identifiers and sequence numbers, and determining whether they are within a replay window or window update buffer to decide whether to drop or process the packets, using IPsec protocol headers and maintaining data structures for each path to manage replay windows and sequence numbers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If multiple paths are used for connection between gateways, then connection characteristics such as bandwidth and latency are improved, but sequence number management for preventing replay attacks becomes disrupted
Solution Approach 1:
The patent segments the sequence number space by creating separate replay windows for each path identified by unique path identifiers. This allows independent sequence number tracking per path while maintaining overall security across multipath connections, resolving the contradiction between utilizing multiple paths and maintaining reliable sequence number management.
2Reliability
If replay windows are maintained for each path, then security against replay attacks is improved, but device complexity increases due to multiple data structures
Solution Approach 1:
The patent creates a universal data structure template that can be instantiated for each path. The replay window data structure serves multiple paths simultaneously with the same structural design, reducing the complexity burden compared to implementing entirely separate management systems for each path while maintaining security for all paths.
3Reliability
If sequence numbers are strictly validated against replay windows, then protection against replay attacks is improved, but packet processing efficiency decreases due to additional validation operations
Solution Approach 1:
The patent performs preliminary actions by pre-establishing replay windows and path identifiers before packet validation. By having the replay window boundaries and path identification ready in advance, the actual packet validation process becomes more efficient as it only needs to compare against pre-computed values rather than performing complex real-time analysis.
Data Source
AI summary
Described herein are systems, methods, and software to manage replay windows in multipath connections between gateways. In one implementation, a first gateway may receive a packet directed toward a second gateway and identify a path from a plurality of paths to the second gateway. Once identified, the first gateway may increment a sequence number associated with the path and encapsulate the packet with a unique identifier for the path in the header with the incremented sequence number. The first gateway the communicates the encapsulated packet to the second gateway.