IPSec Security Association Deletion Unit for Memory Optimization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In communication systems using IPSec, old Security Associations (SAs) remain in memory for extended periods due to hardware expiration dates, leading to memory compression and increased processing loads during searches, as the deletion of old SAs relies on timely instructions from communication partners, which may be delayed or lost in networks.
Innovation Solution
A communication apparatus is equipped with a deletion unit that automatically deletes the old SA from storage once a packet encrypted with the new SA is received, ensuring timely key updates and reducing memory usage and processing loads by managing SA expiration dates and deletion independently.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the hardware expiration date is set to retain the old SA for a long time, then the reliability of packet reception is improved, but the memory space is compressed and processing load increases
Solution Approach 1:
The system performs preliminary actions by setting up two deletion mechanisms: (1) deleting the old SA when a packet encrypted with the new SA is received, and (2) deleting the old SA when the hardware expiration date passes. This preliminary action structure ensures that the old SA is deleted promptly under normal conditions while maintaining reliability through the extended retention period.
Solution Approach 2:
The system enables self-service by automatically detecting and deleting obsolete SAs without requiring external deletion instructions from communication partners. The determination unit autonomously identifies when the new SA has been received and triggers deletion of the old SA, making the system self-managing and reducing dependency on partner coordination.
2Reliability
If the hardware expiration date is set to retain the old SA for a long time, then the reliability of packet reception is improved, but the processing load when searching for SA increases
Solution Approach 1:
The system performs preliminary deletion actions to remove obsolete SAs before they accumulate and interfere with search operations. By deleting the old SA when the new SA packet is received or when the hardware expiration date passes, the system maintains a cleaner SA database, thereby improving search efficiency while preserving reliability through controlled retention periods.
3Quantity of substance
If automatic deletion of old SA is implemented, then memory space is optimized and processing load is reduced, but the system complexity increases
Solution Approach 1:
The system segments the key management function into distinct modular components: (1) the updating unit that manages SA updates, (2) the determination unit that detects new SA packets, and (3) the deletion unit that removes old SAs. This segmentation allows each component to perform its specific function independently, making the overall complex system manageable through clear separation of concerns.
Solution Approach 2:
The determination unit acts as an intermediary between packet reception and the deletion decision. It receives packets, determines whether they are encrypted with a new SA, and triggers the deletion process accordingly. This intermediary layer simplifies the control flow by centralizing the deletion logic in a dedicated component that coordinates between packet processing and key management.
Data Source
AI summary
A communication apparatus includes a storage unit, an updating unit, a determination unit, and a deletion unit. The storage unit stores, in a storage, a first key used to decrypt or authenticate a packet to be communicated between the communication apparatus and a second communication apparatus. The updating unit updates the first key to a second key different from the first key when an expiration date of the first key has passed. The determination unit determines that a packet to be decrypted or authenticated using the second key has been received from the second communication apparatus. The deletion unit deletes the first key from the storage unit in response to the determination unit determining that the packet to be decrypted or authenticated using the second key has been received from the second communication apparatus.