Path-Aware IPsec Gateway for Multi-Uplink Routing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing IPsec VPN systems are limited in their ability to effectively utilize multiple paths for secure data transmission due to the reliance on equal-cost multi-path routing (ECMP), which can result in suboptimal path selection when inner packets are encrypted, leading to potential routing issues and reduced performance.
Innovation Solution
A path-aware IPsec gateway that collects metrics on multiple paths, including connectivity, latency, and jitter, to dynamically select the best path for IPsec data transmission, allowing for load balancing across multiple security associations (SAs) and tunnels, and adjusts source and destination addresses using protocols like MOBIKE to optimize path utilization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If ECMP is used for path selection, then bandwidth utilization is improved through load balancing, but routing reliability deteriorates due to suboptimal path selection when inner packets are encrypted
Solution Approach 1:
The system performs preliminary path probing and metric collection before actual data transmission. The gateway sends probe messages through multiple paths to gather connectivity, latency, and jitter metrics in advance, then uses this pre-collected information to make informed routing decisions for subsequent encrypted IPsec traffic, avoiding the need to route based on encrypted packets alone
Solution Approach 2:
The patent introduces an intermediary mechanism (the gateway's path selection logic) that sits between the ECMP load balancer and the IPsec encryption process. This intermediary collects path metrics and makes intelligent routing decisions by selecting which security association to use for each packet, rather than relying solely on ECMP's hash-based distribution or routing based on encrypted payloads
2Reliability
If multiple security associations are used for multiple paths, then path diversity and reliability are improved, but system complexity increases due to multiple encryption contexts
Solution Approach 1:
The gateway implements a universal path selection mechanism that works across multiple security associations and tunnels. Instead of maintaining separate routing logic for each SA, the system uses a single intelligent gateway that can select among multiple SAs based on collected path metrics, providing multi-functionality in path management while abstracting away the complexity of individual SA configurations
Solution Approach 2:
The system implements feedback loops where the gateway continuously monitors path metrics (connectivity, latency, jitter) and uses this feedback to dynamically adjust security association selection. This feedback mechanism allows the system to adapt to changing network conditions automatically, reducing the need for manual configuration and simplifying management of multiple encryption contexts
3Productivity
If dynamic path selection based on real-time metrics is implemented, then transmission efficiency is improved, but measurement and detection difficulty increases due to multiple path metrics
Solution Approach 1:
The patent extracts the path measurement and evaluation logic from the core IPsec processing path. The gateway separately collects path metrics through probe messages and extracts only the necessary routing decision information (which SA to use) from the complex set of available metrics. This separation allows efficient transmission decisions without requiring the IPsec processing to directly handle or understand all the measurement details
Data Source
AI summary
Some embodiments provide a method that collects metrics for one or more paths of a first tunnel implementing a first security association (SA) and for one or more paths of a second tunnel implementing a second SA. The method selects a path based on the collected metrics of the paths of the first and second tunnels. When the selected path belongs to the first tunnel, the method encrypts data transmitted as encrypted payload of the first SA and transmits the encrypted payload in the first tunnel. When the selected path belongs to the second tunnel, the method encrypts data to be transmitted as encrypted payload of the second SA and transmits the encrypted payload in the second tunnel.