IPSec Anti-Replay Sliding Window Interval Adjustment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In existing IPSec systems, packets are falsely discarded due to anti-replay mechanisms when the sequence number reaches a maximum value and is reversed, causing issues with the anti-replay sliding window configuration.
Innovation Solution
Setting a same maximum agreed value at both the transmit and receive ends, where the receive end adjusts the anti-replay sliding window interval to [M1, M2] when the upper limit value is the maximum agreed value, ensuring that the sequence number of subsequent packets starts from the minimum value, thereby preventing false packet discarding.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the sequence number reaches maximum value and is reversed, then the transmit end can continue sending packets, but the receive end falsely discards packets because the reversed sequence number falls outside the anti-replay sliding window interval
Solution Approach 1:
The anti-replay sliding window interval is made dynamic by detecting whether the upper limit value equals the maximum agreed value. When it does, the interval is adjusted to [M1, M2] where M2 = M1 + window size, allowing reversed sequence numbers to be properly accepted. This dynamic adjustment resolves the contradiction between maintaining transmission continuity and ensuring reception accuracy.
Solution Approach 2:
The patent changes the parameter of the anti-replay sliding window interval based on the sequence number state. When the upper limit reaches the maximum agreed value, the interval parameters are recalculated to accommodate the sequence number wraparound, thereby preventing false packet discarding while maintaining anti-replay protection.
2Reliability
If the anti-replay sliding window interval is maintained as [MAX-N, MAX], then anti-replay protection is strong, but reversed packets are falsely discarded
Solution Approach 1:
The sliding window interval transitions from a static [MAX-N, MAX] configuration to a dynamic configuration that adapts when the upper limit reaches the maximum agreed value. This allows the system to maintain strong anti-replay protection during normal operation while switching to an accommodating interval when sequence numbers reverse, thus resolving the contradiction between protection strength and packet acceptance.
Solution Approach 2:
The patent performs preliminary detection to identify when the upper limit value equals the maximum agreed value before reversed packets arrive. This preliminary action allows the system to proactively adjust the sliding window interval, preventing false discarding of reversed packets while maintaining anti-replay protection for normal sequence numbers.
Data Source
AI summary
An anti-replay method and apparatus are provided. The same maximum agreed value is set at a transmit end and a receive end. The receive end receives an Internet Protocol Security (IPSec) packet, where the IPSec packet includes a sequence number, and acquires an upper limit value of an anti-replay sliding window. If the upper limit value of the anti-replay sliding window is the maximum agreed value, the receive end sets an interval of the anti-replay sliding window to M1 to M2, where M1 is a minimum value of the packet sequence number, and M2 is a sum of M1 and a size of the anti-replay sliding window. When a sequence number of a packet sent by the transmit end reaches a maximum value, a sequence number of a next sent packet starts from the minimum value, thereby resolving a problem that a packet is falsely discarded because of anti-replay.