IPsec Peer Reauthentication Using Post-Quantum Pre-Shared Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing IKEv2/IPsec secure tunnel solutions require inefficient re-authentication processes that cause traffic disruption and do not adequately support a zero-trust security model, especially in the context of increasing network attacks.
Innovation Solution
Implementing post-quantum pre-shared keys (PPKs) for continuous authentication during key refresh processes, using manual or dynamic PPKs stirred with DH/ECDH, and exchanging authentication payloads signed with PPKs to ensure quantum-safe session keys and re-authentication without traffic disruption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional IKEv2 re-authentication is performed by reestablishing a new session, then mutual authentication of peers is achieved, but traffic disruption occurs and efficiency is reduced
Solution Approach 1:
The patent segments the re-authentication process from the full session establishment process. Instead of reestablishing the entire IKEv2 session, only the authentication phase is repeated using a simplified exchange that leverages existing session parameters, thereby achieving mutual authentication without the overhead of complete session reestablishment
Solution Approach 2:
The patent performs preliminary actions during the initial session establishment by storing authentication credentials and session parameters that can be reused during re-authentication. This preliminary preparation enables faster re-authentication without requiring full session reestablishment, thus improving efficiency while maintaining security
2Reliability
If periodic key refresh is implemented in IKEv2/IPsec, then security posture is maintained, but continuous re-evaluation of authorization and access policy is not achieved
Solution Approach 1:
The patent implements a feedback mechanism where the key refresh process triggers a re-authentication event that re-evaluates authorization and access policies. The system continuously monitors session state and initiates re-authentication when key refresh is needed, ensuring that security policies are re-evaluated based on current security posture rather than just maintaining static keys
Solution Approach 2:
The patent implements periodic key refresh at defined intervals during the IKEv2/IPsec session. This periodic action ensures that security posture is maintained through regular key rotation, and simultaneously triggers re-authentication to re-evaluate authorization and access policies, combining both security maintenance and policy adaptability in a rhythmic cycle
3Reliability
If post-quantum pre-shared keys are used for re-authentication, then quantum-safe security is achieved, but key management complexity increases
Solution Approach 1:
The patent makes the post-quantum pre-shared key serve multiple functions: it is used both for initial session establishment and for subsequent re-authentication events. This multi-functionality eliminates the need for separate key management processes for different authentication phases, thereby reducing overall key management complexity while maintaining quantum-safe security throughout the session lifecycle
Data Source
AI summary
Techniques and architecture are described for reauthentication of two IPsec peers, during a key refresh process. The peers may reauthenticate each other based upon a shared secret, which in configurations, is a PPK. In configurations the PPKs are stirred (mixed with DH/ECDH) during key derivation while refreshing the session keys during IKE_v2 and IPsec rekey. This may involve communicating the PPK-ID from a rekey initiator to a rekey responder by adding a PPK_ID payload in the rekey message exchange. This enables stronger quantum safe session keys, when dynamic PPK is used or when the manual PPK is rotated frequently. In configurations, the knowledge of the shared PPK is proved by having both peers exchange authentication payloads signed with a PPK. This involves exchanging a IKEv2 NOTIFY payload “AUTH_PPK” to carry PPK-signed authentication data. This serves the purpose of frequent re-authentication of the peers as part of the key refreshes.