IKEv2 Re-authentication Optimization via Payload Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing IKEv2 re-authentication processes unnecessarily consume bandwidth, processing time, and power by sending SA and TS payloads even when there are no configuration changes, and are vulnerable to attacks due to unencrypted initial negotiations.
Innovation Solution
Implementing a mechanism that sends a notification (SA_TS_UNCHANGED) indicating no changes in SA and TS payloads, and combining INIT and AUTH exchanges for encryption within the existing IKE tunnel to reduce message count and prevent attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SA and TS payloads are sent during IKEv2 re-authentication, then authentication reliability is maintained, but bandwidth consumption increases unnecessarily
Solution Approach 1:
The patent extracts and removes the SA and TS payloads from the re-authentication messages when no changes are detected. By using change detection mechanisms, the system identifies when full payload transmission is unnecessary and extracts only the essential authentication components, thereby reducing bandwidth consumption while maintaining authentication reliability.
Solution Approach 2:
The patent applies partial action by transmitting only the necessary portions of authentication data during re-authentication. Instead of always sending complete SA and TS payloads, the system transmits only changed portions or essential authentication parameters, reducing unnecessary bandwidth usage while ensuring adequate authentication coverage.
2Reliability
If complete SA and TS payloads are transmitted during re-authentication, then authentication completeness is ensured, but processing time increases
Solution Approach 1:
The patent extracts and eliminates unnecessary SA and TS payload transmissions during re-authentication. By detecting when configurations remain unchanged, the system extracts only the essential authentication components for re-transmission, significantly reducing processing time while maintaining authentication completeness through targeted verification of critical parameters.
Solution Approach 2:
The patent implements partial action by processing only the necessary authentication elements during re-authentication. Instead of completely re-processing all SA and TS payloads, the system performs partial processing on changed or critical parameters, reducing processing time while ensuring adequate authentication coverage.
3Ease of manufacture
If INIT exchange is performed in plain text, then implementation simplicity is maintained, but security vulnerability increases
Solution Approach 1:
The patent applies preliminary action by establishing encrypted communication channels before performing the INIT exchange. The system pre-configures encryption parameters and establishes secure contexts prior to transmitting initialization messages, thereby preventing plain-text exposure to attacks while maintaining implementation simplicity through automated encryption setup.
Solution Approach 2:
The patent introduces encryption mechanisms as intermediaries between the INIT exchange and the network. Instead of directly transmitting initialization data in plain text, the system uses encryption layers as intermediaries to protect the INIT exchange, eliminating security vulnerabilities while preserving the simplicity of the overall implementation through standardized encryption protocols.
4Reliability
If multiple message exchanges are used for re-authentication, then authentication thoroughness is improved, but message count and complexity increase
Solution Approach 1:
The patent merges multiple authentication message exchanges into a single integrated re-authentication transaction. By combining INIT, AUTH, and SA establishment messages into unified exchanges, the system reduces the total message count while maintaining authentication thoroughness through comprehensive verification within consolidated message structures.
Solution Approach 2:
The patent applies universality by designing re-authentication messages that perform multiple functions simultaneously. The messages are structured to handle authentication verification, key exchange, and SA establishment in a single multi-functional communication, reducing the number of separate message exchanges needed while ensuring thorough authentication.
Data Source
AI summary
A method for Internet Key Exchange (IKE) re-authentication optimization includes sending, by a first network device and a second network device, a notification, which contains new Security Parameters Index (SPI) for new security association (SA), and sending, by the first network device alone, an OLD_SPI notification to map SPI of Internet Protocol Security (IPsec) (Authentication Header (AH)/Encapsulating Security Payload (ESP)) with the old IPSec SA.