IKE Tunnel Dead Peer Detection Using Timestamp Arrays
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing dead peer detection (DPD) techniques for IPsec gateways are not scalable, resource efficient, or effective, particularly when multiple IKE tunnels are established between gateways, leading to inefficient resource usage and potential delays in network traffic transmission.
Innovation Solution
A method involving a timestamp array indexed by IKE tunnel IDs, where each array element tracks the last packet receipt time and idle timeout threshold, allowing for periodic examination of IKE tunnel liveliness without unnecessary notifications, and utilizing a bitmap to optimize write operations, ensuring efficient DPD even in policy-based or route-based tunneling modes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing dead peer detection techniques are used to monitor multiple IKE tunnels, then detection coverage is provided, but resource consumption increases and scalability deteriorates
Solution Approach 1:
The patent segments the monitoring task by creating separate timestamp array entries for each IKE tunnel ID, allowing independent tracking of each tunnel's peer activity. This segmentation enables the system to handle multiple tunnels efficiently without requiring complex centralized monitoring logic, thus improving scalability while maintaining detection effectiveness.
Solution Approach 2:
The patent introduces a timestamp array as an intermediary data structure that mediates between packet reception and dead peer detection. Instead of directly monitoring each tunnel, the system uses timestamp entries indexed by IKE tunnel IDs to record and track peer activity, simplifying the detection mechanism and improving resource efficiency.
2Reliability
If periodic notifications are sent to all peer gateways, then dead peer detection is performed, but resource consumption increases
Solution Approach 1:
The patent applies partial action by sending DPD notifications selectively only when necessary. The system monitors timestamp entries and sends notifications only when the idle timeout threshold is exceeded for specific IKE tunnels, rather than sending periodic notifications to all peer gateways unconditionally. This reduces unnecessary resource consumption while maintaining effective dead peer detection.
Solution Approach 2:
The patent changes the parameter of notification timing from periodic to event-driven. By monitoring the idle timeout parameter and triggering notifications only when this parameter exceeds the threshold, the system optimizes resource consumption by eliminating unnecessary periodic communications while maintaining reliable dead peer detection.
3Reliability
If multiple IPSec tunnels are monitored individually, then comprehensive monitoring is achieved, but processing efficiency decreases
Solution Approach 1:
The patent merges the monitoring of multiple IPSec tunnels by tracking them through their associated IKE tunnel IDs in a unified timestamp array. Instead of maintaining separate monitoring structures for each IPSec tunnel, the system combines monitoring at the IKE tunnel level, which reduces processing overhead while maintaining comprehensive monitoring coverage through the indexed timestamp entries.
Data Source
AI summary
Certain embodiments described herein relate to a method for performing dead peer detection (DPD) by a local gateway. The method includes periodically examining one or more array elements of a timestamp array. The method further includes, for each of the examined one or more array elements, determining whether a corresponding idle timeout threshold is met. The method further includes, upon determining that the corresponding idle timeout threshold is not met, refraining from causing a notification to be transmitted to a peer gateway. The method also includes, upon determining that the corresponding idle timeout threshold is met, causing a notification to be transmitted to the peer gateway to determine whether the peer gateway is responsive with respect to a tunnel associated with the examined array element.