ISAKMP SPI Key Identification for Seamless Pre-Shared Key Updates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing ISAKMP-based protocols, such as IKE, lack a method to explicitly signal the identity of pre-shared keys, making it difficult to change these keys without disrupting secure communication, and rely on out-of-band provisioning which can be cumbersome, especially requiring public-key infrastructure (PKI) maintenance.
Innovation Solution
Incorporating a novel key identification technique using the Security Parameter Index (SPI) field in ISAKMP-based headers to explicitly identify pre-shared keys, allowing for regular updates without temporary loss of secure communication, by generating a message with an ISAKMP-based header that includes a key identifier, enabling devices to update keys using an ISAKMP-based key management protocol tailored for pre-shared key updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If pre-shared keys are provisioned identically into both devices for simplicity, then key exchange is simple, but key identity cannot be signaled and key changes disrupt communication
Solution Approach 1:
The patent segments the key management functionality by separating key identity identification from the key exchange process itself. The Security Parameter Index (SPI) field is divided to include a key identifier portion, allowing the key identity to be independently signaled alongside other security parameters. This segmentation enables the key identifier to be transmitted and recognized without disrupting the overall key exchange mechanism.
2Adaptability or versatility
If public-key certificates are used to signal key identity, then key changes become possible, but public key infrastructure maintenance complexity increases
Solution Approach 1:
The patent employs a lightweight key identifier mechanism embedded in the SPI field rather than relying on full public-key certificates. This approach uses simple, easily updated identifier values that can be changed without the overhead of PKI infrastructure. The key identifiers act as disposable, easily replaceable elements that simplify key rotation and eliminate the need for complex certificate management systems.
3Reliability
If pre-shared keys are changed to improve security, then security is enhanced, but communication is disrupted until all devices are updated
Solution Approach 1:
The patent enables preliminary signaling of key identity changes through the key identifier portion of the SPI field. Devices can announce their intent to use new keys before the actual key change takes effect, allowing for coordinated key transitions. This preliminary action mechanism ensures that all devices are aware of upcoming key changes and can prepare accordingly, minimizing communication disruptions and ensuring seamless key rotation.
Data Source
AI summary
An initiating device: generates a message having an ISAKMP-based header that includes a security parameter index (SPI) field; identifies a key in the SPI field of the ISKMP-based header; and sends the message to a responding device. The responding device: receives the message; extracts the key identifier; and when a shared key is selected using the key identifier, uses the selected shared key to establish, with the initiating device, a session having a secure tunnel.