IKE Call Admission Control Prioritization

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing VPN systems experience significant delays and resource constraints during peak periods when establishing VPN tunnels, particularly due to the computational intensity of IKE key exchange processes, leading to suboptimal quality of service for clients.

Innovation Solution

Implementing a method to prioritize VPN tunnel setup requests based on client profiles, using adapted ISAKMP profiles with assigned priority levels, and a Call Admission Control mechanism to manage resource utilization, ensuring that higher-priority requests are handled first.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If Call Admission Control is implemented to manage resource utilization during peak periods, then resource management is improved, but VPN tunnel establishment time increases

Engineering Contradiction:

Improveresource managementVSAvoidVPN tunnel establishment time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent segments VPN tunnel establishment requests into different priority classes (high priority and low priority) based on client profiles. High priority requests are processed immediately while low priority requests are delayed, allowing the system to manage peak period loads without uniformly increasing establishment time for all clients.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent implements dynamic Call Admission Control that adjusts resource allocation based on current system load and client priority. During peak periods, the system dynamically prioritizes high priority clients while managing overall resource utilization, preventing system overload while minimizing impact on critical services.

Inventive Principle:

Principle #15Dynamics

2Speed

If computational intensity of IKE key exchange is reduced, then processing speed is improved, but security is worsened

Engineering Contradiction:

Improveprocessing speedVSAvoidsecurity

Core Design Contradiction:

SpeedVSReliability

Solution Approach 1:

The patent performs IKE key exchange computations in advance during off-peak periods and caches the results. When VPN tunnel establishment requests are received during peak periods, the system uses pre-computed key exchange materials, significantly reducing processing time while maintaining full security through proper validation of cached credentials.

Inventive Principle:

Principle #10Preliminary action

3Productivity

If priority-based processing is implemented, then quality of service is improved, but system complexity increases

Engineering Contradiction:

Improvequality of serviceVSAvoidsystem complexity

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The patent applies priority-based processing locally at the VPN aggregator level rather than requiring system-wide complex scheduling. Each aggregator independently evaluates client profiles and applies appropriate priority handling, simplifying the overall system architecture while still achieving differentiated quality of service.

Inventive Principle:

Principle #3Local quality

Data Source

PatentUS7805602B1Prioritized call admission control for internet key exchange

Publication Date: 2010.09.28 CISCO TECHNOLOGY INC

AI summary

A method for communication includes predefining two or more client profiles applicable to clients of a communication network. Virtual Private Network (VPN) connections are initiated between at least two of the clients and the network. At least two of the clients are matched with respective profiles selected from the two or more predefined client profiles. Priorities are assigned to packets exchanged between the at least two of the clients and the network responsively to the profiles. The VPN connections are set up for the at least two of the clients responsively to the priorities.