IPsec Packet Fragmentation Before ESP for Reliable Decryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing IPsec implementations face challenges with large data packets, particularly in untrusted networks, where fragmentation by routers can lead to decryption failures due to unsupported reassembly and hardware limitations, resulting in service disruptions.
Innovation Solution
A method and apparatus that fragment IP datagrams into multiple packets with fragmentation information when they exceed a threshold, ensuring each packet is within the threshold limits, allowing secure IPsec processing and transmission without requiring reassembly at the receiver.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If IPsec is configured to process large data packets, then data confidentiality and security services are provided, but fragmentation by routers in untrusted networks causes decryption failures due to unsupported reassembly
Solution Approach 1:
The patent divides a large IP datagram into multiple IP packets before ESP processing when the datagram size exceeds a threshold. Each packet is processed independently through ESP encryption and transmitted separately. The receiver can decrypt each packet independently without needing reassembly support, resolving the contradiction between maintaining security for large packets and ensuring compatibility with receivers that cannot reassemble fragments.
2Reliability
If IPsec processes packets after they may be fragmented by routers, then security services are maintained, but hardware limitations and performance requirements cause service disruptions
Solution Approach 1:
The patent performs segmentation of the IP datagram into multiple packets before ESP processing occurs. By preparing the packets in advance with appropriate sizing, the system ensures that each packet fits within hardware processing capabilities and can be independently decrypted. This preliminary action prevents service disruptions caused by reassembly failures while maintaining efficient processing throughput.
3Reliability
If IPsec wraps and encrypts entire original IP packets in tunnel mode, then comprehensive security protection is achieved, but packet size exceeds MTU limits causing fragmentation issues
Solution Approach 1:
The patent segments the original IP datagram into multiple smaller IP packets before applying ESP encryption in tunnel mode. This ensures that after wrapping with IPsec headers, each encrypted packet remains within MTU limits and can be transmitted without requiring reassembly at the receiver. The segmentation maintains comprehensive security protection while controlling packet size.
Data Source
AI summary
Methods and apparatuses for security communication. A method performed by a first communication device includes determining whether a length of an Internet protocol, IP, datagram is larger than a threshold. The method further includes, when the length of the IP datagram is larger than the threshold, fragmenting the IP datagram into two or more IP packets. The length of each of two or more IP packets is not larger than the threshold and each of the two or more IP packets is filled with fragmentation information. The method further includes processing the two or more IP packets to generate two or more corresponding IP security, IPsec, packets. The method further includes sending the two or more corresponding IPsec packets to a second communication device.