Per-Priority Sequence Validation for IPsec Tunnels
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Quality of Service (QoS) devices, such as routers, can alter packet sequences in VPN tunnels, leading to false detection of replay attacks, which is undesirable in secure communications.
Innovation Solution
Assigning sequence numbers on a per-priority class basis and embedding the priority class in the IPsec header to maintain sequence integrity across VPN tunnels, allowing for accurate sequence validation and preventing false replay attack detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If QoS devices alter packet sequences to manage network traffic, then network traffic management is improved, but false replay attack detection occurs
Solution Approach 1:
The patent segments the sequence number space by priority class, creating separate sequence number counters for each priority level (e.g., AF11, AF12, AF21, AF22). This allows QoS devices to reorder packets within priority classes without causing false replay attack detections, as each priority class maintains its own sequence integrity independently.
Solution Approach 2:
The patent applies different sequence number validation rules locally to each priority class. By embedding the priority class in the IPsec header and using it to select the appropriate sequence number counter, the system allows localized sequence management that accommodates QoS reordering while maintaining security validation for each class separately.
2Reliability
If sequence numbers are checked to prevent replay attacks, then security is improved, but QoS packet reordering is restricted
Solution Approach 1:
The patent divides the sequence number validation mechanism into separate segments for each priority class. By maintaining independent sequence counters for different priority levels and using the priority class field to select the appropriate counter, the system allows packets to be reordered across priority classes while preventing replay attacks within each class.
Solution Approach 2:
The patent changes the parameter of sequence number validation by making it priority-class-dependent. Instead of a single global sequence number check, the system uses the priority class parameter embedded in the IPsec header to select which sequence number counter to validate against, enabling flexible reordering while maintaining security.
Data Source
AI summary
Packet sequence number checking through a VPN tunnel may be performed by assigning sequence numbers on a per-priority class basis to packets traversing the VPN tunnel. In one implementation, a network device may receive a packet that is to be transmitted over a VPN tunnel, the packet including control information that includes at least a QoS priority class of the packet. The network device may extract the priority class of the packet from the control information and generate a sequence value that describes an arrival sequence of the packet relative to other received packets of the same priority class as the packet. The network device may additionally generate an IPsec header for the packet, the IPsec header including the sequence value and the priority class of the packet; attach the IPsec header to the packet; and transmit the packet through the VPN tunnel.