Security Association Failure Recognition via Active Reference Count
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Standard Internet Protocol (IP) lacks security features such as authentication and encryption, making it vulnerable to unauthorized access and data modification, and existing IPSec protocols like IKE require multiple messages and keys for secure communication establishment, which can be inefficient.
Innovation Solution
A system and method for failure recognition that establishes a security association (SA) between a client and a server, maintains an active reference count of connections, and evaluates the SA when the count drops below a certain threshold, allowing for timely failover and connection reestablishment without compromising IPSec security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If standard IP protocol is used for network communication, then open exchange of information is enabled, but security features such as authentication and encryption are lacking
Solution Approach 1:
The patent segments the security implementation by introducing separate Security Association (SA) structures and key management mechanisms that operate independently from the core IP protocol. This allows standard IP to maintain its open exchange capability while adding security layers through distinct negotiation protocols like IKE that establish separate authentication and encryption channels.
2Reliability
If IPSec protocols with multiple messages and keys are used for secure communication, then security is improved, but negotiation complexity and time consumption increase
Solution Approach 1:
The patent applies preliminary action by pre-establishing Security Associations and exchanging cryptographic keys through the IKE negotiation protocol before actual data transmission begins. This preliminary security setup includes pre-authentication, pre-key exchange, and pre-establishment of security parameters, so that once the SA is created, subsequent communications can proceed with already-configured security measures rather than negotiating security for each message.
Solution Approach 2:
The patent uses copying by creating Security Association copies that can be reused for multiple communications. Once an SA is established through the complex IKE negotiation, the same SA structure and cryptographic parameters can be copied and applied to multiple subsequent data transmissions, avoiding the need to repeat the entire negotiation process for each message while maintaining security consistency.
3Loss of time
If active connection monitoring is implemented to detect failures early, then failure recognition time is improved, but system complexity increases
Solution Approach 1:
The patent implements feedback by continuously monitoring the active reference count of Security Associations and using this feedback to trigger failure detection and recovery actions. The system monitors connection status, counts active references to each SA, and when the count drops below a threshold (indicating potential failure), it automatically initiates SA re-establishment procedures. This feedback loop enables automatic failure recognition and recovery without requiring complex external monitoring systems.
Data Source
AI summary
A system and method for failure recognition is disclosed. The technology initially establishes a security association (SA) between a client and a first server on a network. In addition, an active reference count of a number of connections in the SA between the client and the first server is maintained. The SA is evaluated when the active reference count returns less than two connections within the SA between the client and the first server.