IPsec Establishment via Dynamic Routing and IKE
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing IPsec relationship establishment methods require pre-configuration of IP addresses, which is cumbersome, especially in dynamic networks where addresses are not permanent and may change over time, and become impractical in large networks with many nodes.
Innovation Solution
A method using a dynamic routing protocol to collect information about other IP network nodes and establish IPSec relationships based on Internet Key Exchange (IKE) and certification protocols, with pre-stored node certificates, allowing decentralized setup without prior knowledge of IP addresses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If pre-configuration of IP addresses is used for IPsec establishment, then IPsec relationships can be established between nodes, but the configuration burden increases significantly especially in large networks with many nodes
Solution Approach 1:
Each IP node automatically discovers other nodes and establishes IPsec relationships without requiring manual pre-configuration. The node uses its own identity (such as hostname or certificate) to autonomously initiate IPsec tunnel establishment with discovered nodes, eliminating the need for administrators to pre-configure IP addresses and peer information on each node.
Solution Approach 2:
A directory service or naming service acts as an intermediary between IP nodes. When a node needs to establish an IPsec relationship, it queries the directory service which returns the target node's identity and location information. This intermediary eliminates the need for direct pre-configuration of IP addresses while enabling secure peer-to-peer IPsec tunnel establishment.
2Adaptability or versatility
If IP addresses are pre-configured for IPsec establishment, then IPsec tunnels can be created, but adaptability to dynamic IP address allocation deteriorates
Solution Approach 1:
The IPsec establishment mechanism transitions from static pre-configured IP addresses to dynamic node identity-based discovery. Nodes are discovered and identified using dynamic mechanisms such as multicast announcements, directory service lookups, or certificate-based identification, allowing IPsec relationships to be established regardless of whether IP addresses are statically assigned or dynamically allocated via DHCP.
Solution Approach 2:
Nodes perform preliminary registration of their identities and capabilities with a directory service or through mutual announcement before IPsec establishment is needed. This preliminary action stores node identification information (not IP addresses) that can be retrieved later for IPsec tunnel setup, enabling the system to adapt to changing IP addresses while maintaining reliable connection establishment.
3Reliability
If manual pre-configuration is used for IPsec setup, then security relationships can be established, but the time and effort required for setup increases
Solution Approach 1:
Nodes automatically perform security relationship establishment by exchanging certificates or authentication credentials through automated protocols such as IKE (Internet Key Exchange). The nodes independently verify each other's identities and establish secure IPsec tunnels without requiring manual security configuration, dramatically reducing setup time while maintaining strong security through cryptographic authentication.
Data Source
Figure 1~3
Figure 2~7
Figure 4
AI summary
The present invention relates to a method (500) performed at an IP network node for IPSec establishment with other IP network nodes in a network. The method comprises collecting (S1) information about the other IP network nodes in the network using a dynamic routing protocol, the information comprising an IP address associated with the respective other IP network node, and establishing (S2) an IPSec relationship with a predetermined set of the other IP network nodes in the network based on the collected information and based on Internet Key Exchange (IKE) using a certification protocol and the identity of the IP network node, wherein the identity of the IP network node is determined by a pre-stored node certificate.