IKE/IPSec SA Rekeying With Reduced Payload Overhead
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing IKEv2 and IPSec rekey processes consume significant bandwidth and power due to the inclusion of cryptographic suites and flow information in rekey requests and responses, especially when these parameters remain unchanged, which is particularly problematic for devices with limited power and bandwidth capabilities.
Innovation Solution
The proposed method reduces payload size by omitting cryptographic suites and flow information in rekey requests and responses when these parameters do not change, using Security Parameter Index (SPI) notifications or Lightweight SA payloads to facilitate rekeying.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional rekey requests and responses include cryptographic suites and flow information, then rekeying can be performed with full security parameters, but bandwidth consumption and power usage increase significantly
Solution Approach 1:
The patent extracts and removes redundant cryptographic suite and flow information from rekey requests and responses when these parameters remain unchanged from the existing security association. This extraction is performed by checking whether the current SA's cryptographic suite and flow information match the proposed values, and if they match, omitting these fields from the rekey exchange messages, thereby reducing bandwidth and power consumption while maintaining security.
Solution Approach 2:
The patent changes the parameters of the rekey exchange protocol by introducing conditional inclusion of cryptographic suite and flow information fields. Instead of always transmitting these parameters, the system dynamically adjusts the message structure based on whether the parameters have changed, reducing the payload size and associated energy consumption when no changes are needed.
2Adaptability or versatility
If conventional rekey requests and responses include cryptographic suites and flow information, then all security parameters can be updated, but processing time and bandwidth increase
Solution Approach 1:
The patent extracts unnecessary cryptographic suite and flow information from rekey messages when these parameters are unchanged. The system compares the proposed parameters with the existing SA parameters and only includes the full parameter sets in rekey requests and responses when actual changes are detected, thereby reducing processing time and bandwidth usage while maintaining the capability to update all security parameters when needed.
Solution Approach 2:
The patent applies partial action by transmitting only the necessary security parameters during rekeying operations. Instead of always transmitting complete parameter sets, the system transmits only the parameters that have changed or are required for the rekey operation, reducing processing overhead and time while maintaining adequate adaptability for security parameter updates.
3Adaptability or versatility
If rekey requests and responses use full SA payload structure, then complete security negotiation is achieved, but devices with limited resources experience high processing overhead
Solution Approach 1:
The patent extracts and omits cryptographic suite and flow information fields from rekey requests and responses when these parameters remain unchanged from the existing security association. This extraction reduces the message payload size and processing requirements for devices with limited resources, while still maintaining complete security negotiation capability when parameter changes occur.
Solution Approach 2:
The patent introduces dynamic adaptability in the rekey exchange protocol by conditionally including cryptographic suite and flow information fields based on whether changes are detected. The system dynamically adjusts the message structure and processing requirements according to the actual rekey needs, allowing devices with varying resource capabilities to participate effectively in security negotiations.
Data Source
Figure 1A
Figure 1B~1C
Figure 2
AI summary
In the IKE or IPSec SA rekeying, whether the rekey exchange includes the cryptographic suite in the payload depends on whether the cryptographic suite used in the old SA is changed on both ends, e.g., the initiator and the responder. If the cryptographic suite is not changed, then the rekey exchange does not include the cryptographic suite. Additionally, in the IPSec SA rekey, if the flowing information is not changed in either end, the rekey exchange further does not include the Traffic Selector (TS). As such, the size of the payload is decreased, which saves bandwidth, more processing time and power in the course of the IKE SA or the IPSec SA rekey.