IPSec Path Selection via Source Port Hashing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
IPSec protocols limit the number of routing paths for encrypted data packets, leading to connectivity issues if a selected path fails, as they rely on constant IP addresses in the IPSec header for hashing, resulting in no alternative paths being used even if other paths are available.
Innovation Solution
Enabling Network Address Translation Traversal (NAT-T) to encapsulate IPSec packets with UDP headers, allowing selection of different source ports for routing, which enables multiple paths to be identified and used based on probing and performance metrics, thereby switching to alternative paths if the selected path fails.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If IPSec protocols use constant IP addresses in the IPSec header for hashing, then encryption security is maintained, but the number of routing paths is limited to one path
Solution Approach 1:
The patent segments the routing path selection by introducing multiple source ports (e.g., ports 4500, 4501, 4502) that can be used independently for different paths. This allows the system to divide the single routing path into multiple possible paths while maintaining the same IPSec encryption mechanism, thus resolving the contradiction between security and routing flexibility.
Solution Approach 2:
The patent adds a new dimension to the routing decision by utilizing source port numbers as an additional parameter for path selection. Instead of being constrained to a single path determined solely by constant IP address hashing, the system now has multiple dimensions (IP addresses + source ports) to create diverse routing paths, enabling failover and load balancing without compromising encryption.
2Ease of operation
If only one routing path is selected for IPSec traffic, then path selection simplicity is maintained, but connectivity fails if the selected path deteriorates
Solution Approach 1:
The patent implements preliminary action by pre-configuring multiple alternative paths with different source ports before any failure occurs. The system maintains a pool of available paths (e.g., primary path via port 4500, secondary path via port 4501, tertiary path via port 4502) and can switch to alternative paths when the selected path deteriorates, ensuring continuous connectivity without complex real-time decision-making.
Solution Approach 2:
The patent applies beforehand cushioning by establishing multiple redundant paths in advance that can serve as backup options. This cushioning mechanism protects against path failure by having pre-prepared alternative routes, so when the primary path fails, the system can immediately switch to a backup path without interruption, thereby maintaining connectivity reliability.
3Adaptability or versatility
If multiple FOU tunnels are added to enable multiple paths, then routing flexibility is improved, but additional workload for maintaining and managing tunnels increases
Solution Approach 1:
The patent applies universality by making the existing IPSec protocol and UDP header structure serve multiple functions: both encryption and multi-path routing. The same IPSec tunnel can carry traffic over multiple paths by varying source ports, eliminating the need for separate FOU tunnels for each path. This multi-functional approach maintains routing flexibility while avoiding the additional management overhead of multiple dedicated tunnel protocols.
Solution Approach 2:
The patent merges the path selection mechanism with the existing IPSec tunneling framework by using source port variation within the same tunnel structure. Instead of creating separate FOU tunnels for each path, the system combines multiple paths into a single IPSec tunnel that can dynamically select paths based on source port hashing, thereby reducing device complexity and management overhead while maintaining routing flexibility.
4Adaptability or versatility
If dynamic route addition/removal is performed for FOU tunnels, then path switching capability is improved, but packet pipeline complexity increases
Solution Approach 1:
The patent applies self-service by enabling the routing system to automatically select and switch between paths based on predefined criteria (such as path performance or failure detection) without requiring manual intervention or complex dynamic configuration. The source port hashing mechanism inherently determines path selection, and the system self-adjusts to alternative paths when needed, simplifying the packet pipeline while maintaining path switching capability.
Data Source
AI summary
A method for selecting between a plurality of paths for sending an encrypted packet from a source endpoint to a destination endpoint is provided. The method selects a first path of the plurality of paths for sending the encrypted packet from the source endpoint to the destination endpoint, each of the plurality of paths associated with a different one of a plurality of source ports, the encrypted packet being encrypted based on a security association established between the source endpoint and the destination endpoint in accordance with an IPSec protocol. The method further encapsulates, based on the SA having NAT-T enabled, the encrypted packet with a UDP header having a first source port associated with the first path. The method then transmits the encapsulated encrypted packet from the source endpoint to the destination endpoint via the first path.