Scalable IPSec Services Through Separated IKE and ESP Functions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing IPSec deployments in cloud-native environments face challenges due to their long-lived and stateful nature, which conflicts with the ephemeral and dynamic nature of cloud resources, leading to inefficiencies in scaling, resource waste, and high costs, especially in multi-tenant setups.
Innovation Solution
The solution involves separating the IKE and ESP functionalities of IPSec and implementing horizontal scaling, using a key/value store to manage state, and leveraging Anycast and ECMP routing for elastic scaling and global mobility.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If IPSec gateways are deployed using traditional High Availability pairs with active-master and standby-slave nodes, then reliability is improved, but resource utilization deteriorates due to idle compute resources in standby nodes
Solution Approach 1:
The IPSec gateway functionality is segmented into two independent components: IKE (Internet Key Exchange) for control plane operations and ESP (Encapsulating Security Payload) for data plane operations. This segmentation allows each component to be scaled and managed independently, enabling multiple ESP nodes to share a single IKE node, thereby eliminating the need for standby nodes while maintaining high availability.
Solution Approach 2:
The IKE node is designed to serve multiple ESP nodes simultaneously, making it a universal control point for multiple data plane instances. This multi-functionality allows a single IKE node to manage security associations and key exchange for numerous ESP nodes, maximizing resource utilization while maintaining reliability through redundancy of ESP nodes.
2Power
If IPSec gateways are scaled vertically by deploying on more powerful VMs or compute nodes, then processing capacity is improved, but scalability deteriorates due to hard capacity maximums determined by single compute node resources
Solution Approach 1:
By separating IKE and ESP functionalities, the system enables horizontal scaling of ESP nodes independently from the IKE node. Each ESP node can be added or removed based on demand without affecting the IKE node's processing capacity, allowing the system to scale from a single compute node to multiple nodes seamlessly, thus overcoming the hard capacity maximums of vertical scaling.
3Reliability
If dedicated HA pairs are deployed for each tenant in multi-tenant IPSec gateway setups, then reliability is improved, but cost deteriorates due to over-provisioning and idle resources
Solution Approach 1:
Multiple tenant IPSec gateways are merged into a shared infrastructure where a single IKE node serves multiple ESP nodes for different tenants. This consolidation eliminates the need for dedicated HA pairs per tenant, reducing compute resource consumption while maintaining tenant-specific reliability through logical isolation and independent ESP node deployment for each tenant.
Solution Approach 2:
The IKE node is designed as a universal control plane that can simultaneously manage security associations and key exchange for multiple tenants and their respective ESP nodes. This multi-tenant capability allows a single IKE node to provide reliable IPSec services to multiple tenants without requiring dedicated HA pairs for each, thereby reducing overall resource requirements.
4Adaptability or versatility
If cloud-native ephemeral compute resources are used for IPSec deployments, then scalability is improved, but reliability deteriorates due to the dynamic and less reliable nature of cloud resources
Solution Approach 1:
The separation of IKE and ESP functionalities enables the system to leverage cloud-native ephemeral resources effectively. ESP nodes can be rapidly provisioned and deprovisioned as ephemeral compute resources without affecting the persistent IKE node, which maintains long-lived security associations. This segmentation allows the system to achieve both cloud-native scalability and reliability by matching the ephemeral nature of cloud resources to the stateless ESP function while maintaining stateful IKE operations on more stable infrastructure.
Data Source
Figure 1A
Figure 1B
Figure 1C
AI summary
An Internet Key Exchange protocol message indicating a first Internet Protocol Security traffic flow is to be established via a first device is obtained at the first device. The Internet Key Exchange protocol message is forwarded from the first device to a second device. An encryption key used to transmit traffic via the first Internet Protocol Security Traffic flow is received at the first device from a key value store. The key value store is populated with the encryption key in response to the second device obtaining the Internet Key Exchange protocol message. A first data packet to be transmitted via the first Internet Protocol Security traffic flow is obtained at the first device. The first device provides the first data packet encrypted with the encryption key of the first Internet Protocol Security traffic flow.