IPsec Security Association Rekeying Without Traffic Loss
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
IPsec communication experiences traffic loss during the rekeying process due to the temporary disruption in handling inbound packets when old Security Associations (SAs) are deleted before new SAs are fully established, particularly in high-speed and critical communication scenarios like remote medical operations.
Innovation Solution
Implement a temporary coexistence mechanism where devices continue to use old SAs until specific conditions are met, such as data packet thresholds or time thresholds, ensuring seamless communication by retaining old SAs until new SAs are fully established and acknowledged by peers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If old SAs are deleted before new SAs are fully established during rekeying, then security is improved by limiting key lifetime, but traffic loss occurs due to temporary disruption in handling inbound packets
Solution Approach 1:
The system performs preliminary actions by establishing the new SA before deleting the old SA. The new SA is created, configured, and validated while the old SA remains active to handle inbound packets. Only after the new SA is fully established and can successfully process traffic does the system delete the old SA, ensuring continuous traffic flow without loss.
Solution Approach 2:
The old SA acts as an intermediary during the transition period. It continues to handle inbound packets that arrive before the new SA is fully established, serving as a bridge that prevents traffic loss. The system maintains both SAs temporarily, allowing the old SA to mediate traffic handling while the new SA becomes operational.
2Productivity
If old SAs are retained after rekeying completes, then traffic loss is prevented by maintaining handling capability for inbound packets, but device complexity increases due to managing multiple SAs
Solution Approach 1:
The system dynamically adjusts the lifecycle of SAs based on real-time traffic conditions. After rekeying completes, the old SA is not immediately deleted but is retained temporarily to handle any remaining inbound packets that may arrive with the old SA identifier. The system monitors traffic patterns and automatically deletes the old SA once it confirms no more packets are being sent with the old identifier, optimizing the balance between traffic handling and resource management.
3Reliability
If rekeying is performed immediately when key lifetime expires, then security is maintained by updating keys promptly, but communication interruptions occur due to lack of temporary coexistence mechanism
Solution Approach 1:
The system initiates the new SA creation process before the old SA expires, performing preliminary setup and configuration. This allows the transition to occur smoothly without interruption, as the new SA is already prepared and can take over immediately when ready, eliminating communication interruptions.
Solution Approach 2:
The system ensures continuous traffic flow during the rekeying process by maintaining the old SA's functionality throughout the transition. Both SAs coexist temporarily, allowing the system to switch from old to new SA without interrupting the useful action of data transmission, thus eliminating communication interruptions.
Data Source
AI summary
A method by a first device for providing Internet Protocol Security (IPsec) communication with a second device in a network. In response to a request for updating a first old Security Association (SA) from the second device, the method generates a first new SA, and sends, to the second device, an acknowledgement that the first new SA is available at the first device. The method uses the first old SA to encapsulate traffic data sent to the second device until receiving, from the second device, traffic data encapsulated with a second new SA generated at the second device. The method retains the first old SA to have a capability of handling traffic data encapsulated with a second old SA received from the second device until a preset condition is satisfied.