Bidirectional IPSec Encryption Using Direction-Specific IV Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The use of unidirectional security associations (SAs) in IPSec communication consumes excessive system resources due to the need for separate SAs for inbound and outbound communication.
Innovation Solution
A method where nodes incrementally update serial numbers (SN) to calculate distinct initialization vectors (IVs) using mathematical transformations, ensuring different IVs for each direction of communication, allowing a single SA to be maintained for bidirectional security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If separate SAs are established for inbound and outbound communication, then communication security is ensured, but system resources are consumed excessively
Solution Approach 1:
The patent merges the inbound and outbound SAs into a single unidirectional SA by using different serial numbers (SN1 for inbound, SN2 for outbound) to generate distinct initialization vectors (IV1, IV2) while sharing the same security association. This reduces the number of SAs from two to one, thereby conserving system resources while maintaining communication security through direction-specific IV generation.
Solution Approach 2:
The patent segments the bidirectional communication into two independent unidirectional streams, each with its own serial number (SN1, SN2) and initialization vector (IV1, IV2). This segmentation allows each direction to be processed independently using the same SA, reducing overall resource consumption while ensuring security for both directions through distinct IVs.
2Quantity of substance
If a unidirectional SA is used for bidirectional communication, then the number of SAs is reduced, but distinct IVs for each direction cannot be generated
Solution Approach 1:
The patent introduces dynamic serial numbers (SN1, SN2) that change based on communication direction. Each node maintains its own serial number that increments independently for packets it sends, allowing the system to adapt to bidirectional communication needs while using a single SA. The dynamic nature of SN ensures distinct IVs are generated for each direction without requiring separate SAs.
3Device complexity
If the same SN is used for both directions, then calculation is simplified, but IV collision occurs between inbound and outbound packets
Solution Approach 1:
The patent applies asymmetry by assigning different serial numbers (SN1 ≠ SN2) to inbound and outbound communication directions. This asymmetric approach ensures that even though the same SA and key are used, the resulting initialization vectors (IV1, IV2) are distinct for each direction, preventing IV collisions while maintaining relatively simple calculation procedures.
Data Source
AI summary
The present application provides a method, apparatus, and device for secure data transmission. The method comprises: a node 1 incrementally updates an SN1 value, performs first mathematical transformation on the updated SN1 value to calculate an IV1, encrypts a first data packet according to the IV1 and a key, and then sends the encrypted first data packet to a node 2; the node 2 acquires the SN1 value in the first data packet, performs the first mathematical transformation on the acquired SN1 value to calculate the IV1, and decrypts the encrypted first data packet by using the IV1 and the key; the node 2 incrementally updates an SN2 value, performs second mathematical transformation on the updated SN2 value to calculate an IV2, encrypts a second data packet according to the IV2 and the key, and sends the encrypted second data packet to the node 1.