IPsec Tunnel Maintenance via Dynamic SA Record Updates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing IPsec tunnel becomes unavailable and interrupts the service provided by a VPN gateway when the IP address of a terminal device changes, as the VPN gateway cannot find the corresponding security associations (SAs) due to changes in the 5-tuple information of IP packets.
Innovation Solution
The terminal device and VPN gateway negotiate to update the tunnel identifiers and security associations (SAs) when the IP address changes, ensuring that the VPN gateway can continue to decrypt IP packets by using the updated tunnel identifiers and SAs, without establishing a new IPsec tunnel through renegotiation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the IP address of the terminal device changes, then the terminal device can access different networks or locations, but the existing IPsec tunnel becomes unavailable and service is interrupted
Solution Approach 1:
The terminal device proactively detects IP address changes and initiates the tunnel maintenance process before service interruption occurs. By monitoring its own IP address and triggering the maintenance procedure in advance, the system ensures continuous availability without waiting for failure detection.
Solution Approach 2:
The terminal device sends a first request packet to the VPN gateway containing the new IP address information, creating a feedback loop that allows the gateway to update its SA records. This feedback mechanism enables the system to adapt to IP changes while maintaining tunnel availability.
2Productivity
If the VPN gateway uses 5-tuple information to search for SAs, then packet decryption is efficient, but the gateway cannot find corresponding SAs when IP address changes occur
Solution Approach 1:
The tunnel identifier acts as an intermediary element that decouples the SA lookup process from the IP address. Instead of directly searching using 5-tuple information that changes with IP address, the system uses the stable tunnel identifier as a mediator to find SAs, then maps them to the current IP address.
Solution Approach 2:
The system changes the search parameter from IP address-based 5-tuple information to tunnel identifier-based lookup. This parameter transformation allows the gateway to maintain efficient decryption while adapting to IP address changes, as the tunnel identifier remains stable throughout the connection.
3Adaptability or versatility
If a new IPsec tunnel is established through renegotiation when IP address changes, then the tunnel can adapt to the new address, but service continuity is interrupted and time is lost
Solution Approach 1:
The patent maintains the existing IPsec tunnel's useful action (encrypted packet transmission) continuous by updating the SA records in place rather than establishing a new tunnel. The gateway continues to process packets using the same tunnel identifier and encrypted flow, merely updating the associated IP address information.
Solution Approach 2:
The terminal device performs preliminary actions by detecting the IP address change and sending the first request packet before the gateway would normally need to renegotiate. This preliminary notification allows the gateway to update its records proactively, avoiding the time loss associated with waiting for failure detection and subsequent renegotiation.
4Stability of the object's composition
If the VPN gateway sends IP packets to the old IP address after IP change, then the tunnel configuration remains valid, but the packets cannot reach the terminal device
Solution Approach 1:
The terminal device provides feedback to the VPN gateway about its new IP address through the first request packet. This feedback enables the gateway to update its forwarding information while maintaining the stable tunnel configuration, ensuring packets are sent to the correct current address.
Solution Approach 2:
The system introduces dynamic updating of the gateway's SA records based on real-time IP address changes. Rather than static configuration, the gateway's internal mapping between tunnel identifiers and IP addresses becomes dynamic, allowing it to adapt the destination address while preserving the established tunnel's encryption and routing properties.
Data Source
AI summary
An Internet Protocol Security tunnel maintenance method, apparatus, and system including a terminal device that negotiates with a VPN gateway based on a first IP address and according to the IKE protocol, and establishes an IPsec tunnel based on SAs obtained through negotiation; determines, the first IP address changes to a second IP address; sends a first request packet to the VPN gateway, where the first request packet carries the second IP address and a first tunnel identifier, where the first request packet is used to request to update a first SA record, and where the first SA record includes a correspondence between the SAs, the first IP address, and the first tunnel identifier; generates a second tunnel identifier based on the second IP address and a predefined algorithm; and replaces the first tunnel identifier in a second SA record with the second tunnel identifier.