IPSec Key Distribution for Horizontally Scaled Gateways
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing IPSec deployments face challenges in cloud-native environments due to their long-lived and stateful nature, requiring vertical scaling of compute resources, leading to inefficiencies, over-provisioning, and high costs, while cloud environments demand elastic and horizontal scaling that traditional IPSec implementations struggle to provide.
Innovation Solution
Separate the IKE and ESP functionalities of IPSec, implementing horizontal scaling through a key/value store to manage state and enable independent scaling of IKE and ESP, leveraging Anycast and ECMP routing for seamless failover and global mobility.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If IPSec gateways are deployed using traditional High Availability pairs with active-master and standby-slave nodes, then reliability is improved, but resource utilization deteriorates due to idle compute resources in standby nodes
Solution Approach 1:
The patent segments the IPSec gateway functionality into independent virtual machine instances (VMs) that can be distributed across multiple physical hosts. Instead of requiring dedicated HA pairs, multiple VMs providing the same IPSec service can run in parallel on shared infrastructure, with each VM handling a portion of the traffic load. This segmentation enables active-active deployment where all instances contribute to service delivery rather than having standby nodes.
Solution Approach 2:
The patent implements a universal IPSec service architecture where a pool of VMs can serve multiple tenants and multiple service functions simultaneously. The same VM infrastructure provides IPSec gateway services to different customers with different requirements, eliminating the need for dedicated hardware or isolated HA pairs for each tenant. This multi-functionality maximizes resource utilization while maintaining service isolation and security.
2Productivity
If IPSec gateways are vertically scaled using more powerful VMs or compute nodes, then service capacity is improved, but scalability deteriorates due to hard capacity maximums and over-provisioning
Solution Approach 1:
The patent implements dynamic scaling capabilities where IPSec service capacity can be adjusted in real-time by adding or removing VM instances from the service pool. Unlike vertical scaling which requires provisioning larger individual machines, this approach allows incremental horizontal scaling by simply deploying additional standard-sized VMs. The system dynamically load-balances traffic across the varying number of available instances, enabling flexible adaptation to changing demand without over-provisioning.
Solution Approach 2:
The patent transitions from single-dimension vertical scaling to multi-dimensional horizontal scaling by distributing IPSec functions across multiple VMs on multiple physical hosts. This adds spatial distribution as a new dimension for scaling, allowing the service to grow by adding nodes across the data center infrastructure rather than being constrained by the capacity limits of individual machines. This enables scaling beyond the hard capacity maximums of single compute nodes.
3Stability of the object's composition
If traditional IPSec deployments are used in cloud-native environments, then service stability is improved, but adaptability deteriorates due to incompatibility with ephemeral and short-lived compute resources
Solution Approach 1:
The patent introduces a control plane as an intermediary layer that manages the IPSec service instances running on ephemeral cloud compute resources. The control plane handles session state management, key distribution, and coordination between multiple IPSec VM instances, abstracting away the complexity of managing stateful services on stateless infrastructure. This intermediary enables traditional IPSec protocols to function reliably on modern cloud platforms that use ephemeral VMs and containerized workloads.
Solution Approach 2:
The patent implements state replication mechanisms where session information and security associations are copied and synchronized across multiple IPSec VM instances. Instead of relying on persistent local storage in each VM, the system maintains redundant copies of critical state information across the VM pool and uses consensus protocols to ensure consistency. This copying approach enables seamless failover and load migration when VMs are created, destroyed, or moved in the cloud environment.
Data Source
AI summary
An Internet Key Exchange protocol message indicating a first Internet Protocol Security traffic flow is to be established via a first device is obtained at the first device. The Internet Key Exchange protocol message is forwarded from the first device to a second device. An encryption key used to transmit traffic via the first Internet Protocol Security Traffic flow is received at the first device from a key value store. The key value store is populated with the encryption key in response to the second device obtaining the Internet Key Exchange protocol message. A first data packet to be transmitted via the first Internet Protocol Security traffic flow is obtained at the first device. The first device provides the first data packet encrypted with the encryption key of the first Internet Protocol Security traffic flow.