Security Association Rekeying Using SPI Transform
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure key exchange (SKE) systems generate a Security Parameter Index (SPI) using a random number generator without association with other values, leading to limitations in secure data transfer between endpoints.
Innovation Solution
Implementing SKE messaging using an SPI Transform to provide secure data transfer between endpoints, enabling additional functions such as hardware acceleration and overcoming limitations of conventional secure data transfer arrangements by using an SPI Transform to derive cryptographic keys and authenticate endpoints.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a random number generator is used to generate SPI without association with other values, then the SPI generation is simple and fast, but the security and functionality are limited
Solution Approach 1:
The patent introduces an SPI Transform as an intermediary mechanism that processes the base SPI value through cryptographic transformations. This transform acts as a mediator between the simple random SPI generation and the security requirements, applying cryptographic functions (such as HMAC or other key derivation functions) to derive secure cryptographic keys from the SPI without requiring complex changes to the overall system architecture
Solution Approach 2:
The patent changes the parameter representation by transforming the SPI value through cryptographic functions. Instead of using the raw random SPI directly as a key, the system applies parameter transformations (key derivation functions) that convert the simple SPI into secure cryptographic keys with appropriate security properties, thereby improving security while maintaining the simplicity of the original SPI generation approach
2Adaptability or versatility
If conventional SPI generation is used, then the system is easier to implement, but additional functions such as hardware acceleration cannot be enabled
Solution Approach 1:
The SPI Transform mechanism provides multi-functionality by serving multiple purposes: it generates cryptographic keys for secure data transfer, enables hardware acceleration capabilities, and maintains compatibility with existing Fibre Channel protocols. The same transform infrastructure supports various cryptographic algorithms and key derivation methods, making the system adaptable to different security requirements and hardware capabilities without requiring separate mechanisms for each function
3Productivity
If SPI is derived using Transform with SA Index, then security and efficiency are enhanced, but the key exchange protocol becomes more complex
Solution Approach 1:
The patent performs preliminary cryptographic transformations during the SA initialization phase, where the SPI Transform is applied upfront to derive cryptographic keys before actual data transfer begins. This preliminary action ensures that secure keys are ready in advance, enabling efficient hardware-accelerated encryption during data transfer without adding complexity to the ongoing communication process. The transform results are cached and reused, improving productivity while isolating the complexity to the initial setup phase
Data Source
AI summary
Disclosed embodiments implement rekeying keys of a Security Association (SA) using an SPI Transform to provide secure data transfer in a computing environment. A disclosed method comprises detecting, by a local key manager (LKM) executing on a computing node, an expired rekey timer of an SA between an initiator channel on the computing node and a responder channel on a responder node. The LKM requests, based on the expired rekey timer, an SA Index from the initiator channel on a computing node. The LKM creates an SPI based on an SPI Transform using the new SA Index and SPI Transform values. The LKM builds an SKE SA Initialization Request message based on an authentication key of the SA and the SPI to obtain a new session key.