IPsec SA Lookup Using Source Port in CG-NAT Deployments
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In communication systems with Carrier Grade NAT (CG-NAT) functions, endpoints deployed behind a single public IP address can generate identical Security Association (SA) SPI values, leading to incorrect decryption of encrypted packets due to shared IP addresses and ports, causing traffic loss.
Innovation Solution
Incorporating the source port number into the SA lookup process at receiving endpoints, alongside SPI, source, and destination IP addresses, to uniquely identify the correct SA for decryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If endpoints deployed behind CG-NAT share a single public IP address, then network address translation efficiency is improved, but Security Association identification accuracy deteriorates due to SA SPI collision
Solution Approach 1:
The patent extends the SA lookup key from three dimensions (SPI, source IP, destination IP) to four dimensions by adding source port number. This dimensional expansion allows unique identification of SAs even when multiple endpoints share the same public IP address behind CG-NAT, resolving the collision problem while maintaining NAT efficiency.
2Ease of operation
If traditional SA lookup uses only SPI and IP addresses, then lookup simplicity is maintained, but decryption accuracy deteriorates due to SA collisions in CG-NAT environments
Solution Approach 1:
By adding source port number as an additional lookup dimension, the system maintains a straightforward lookup process while significantly improving decryption accuracy. The extended key (SPI, source IP, destination IP, source port) provides unique identification without complicating the overall lookup mechanism.
3Adaptability or versatility
If multiple endpoints share CG-NAT public IP, then IP address resource utilization is improved, but secure communication reliability deteriorates due to identical SA parameters
Solution Approach 1:
The patent enables multiple endpoints to share a public IP address by differentiating them through source port numbers in the SA lookup key. This allows efficient IP address utilization while maintaining secure communication reliability, as each endpoint's SAs are uniquely identified by the combination of SPI, IP addresses, and source port.
Solution Approach 2:
The source port number acts as an intermediary differentiator that allows CG-NAT to successfully share public IP addresses among multiple endpoints while maintaining the ability to uniquely identify and decrypt packets from each endpoint using extended SA lookup keys.
Data Source
AI summary
To generate an encrypted packet, a transmitting endpoint in a communication system chooses the desired IPsec tunnel, then retrieves the SA linked to that tunnel from its Outbound SA table of its local SA database (SAD), and encrypts the packet using the retrieved SA. To decrypt the encrypted packet, the receiving endpoint extracts the Security Parameter Index (SPI) value, the source address, the destination address, and the source port number from the packet to retrieve the appropriate SA from its local SAD database and decrypts the encrypted packet using the retrieved SA. In this way, the transmitting and receiving endpoints can retrieve the appropriate SAs for situations in which either endpoint is one of multiple endpoints located behind a Carrier-Grade Network Address Translation (CG-NAT) function having a single public IP address shared by the multiple endpoints.