Security Association Management via API Provisioning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The Internet Key Exchange (IKE) protocol's reliance on UDP packets for establishing security associations is unreliable due to potential packet loss, misordering, and incorrect key installation or deletion, leading to insecure communication channels.
Innovation Solution
A provider network with a management service that uses customer-initiated API requests and provisioning infrastructure to create security associations, bypassing UDP, ensuring reliable encryption key management and secure communication channel establishment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If the IKE protocol uses UDP packets for establishing security associations, then the protocol can operate with simple packet transmission, but the reliability of security association creation deteriorates due to packet loss and misordering
Solution Approach 1:
The patent introduces an intermediary mechanism (security association management system with API endpoints and provisioning infrastructure) that mediates the security association creation process. This intermediary receives customer-initiated API requests, manages the key exchange process, and ensures reliable delivery of security parameters, thereby resolving the reliability issue without requiring complex modifications to the underlying UDP protocol operation.
2Speed
If UDP packets are used for key exchange, then transmission is fast and simple, but key installation and deletion become unreliable leading to insecure communication channels
Solution Approach 1:
The patent implements feedback mechanisms where the security association management system monitors the establishment and installation of security associations. The system receives acknowledgments from endpoints, tracks the state of security associations, and can initiate retransmission or correction procedures if installation fails, ensuring reliable key management while maintaining fast operation through efficient feedback loops.
Solution Approach 2:
The system performs preliminary validation and preparation of security parameters before actual key exchange occurs. The provisioning infrastructure pre-configures security associations and validates parameters in advance, so that when UDP packets are transmitted, the keys are already verified and ready for reliable installation, preventing errors rather than correcting them later.
3Device complexity
If the IKE protocol operates without additional management infrastructure, then the system remains simple, but security association management becomes unreliable
Solution Approach 1:
The patent segments the security association management functionality into distinct modular components: API endpoints for customer interactions, provisioning infrastructure for backend processing, and endpoint agents for local execution. This segmentation allows each component to perform its specific function reliably while maintaining overall system simplicity through clear separation of concerns and well-defined interfaces between modules.
Data Source
AI summary
A system (and method) includes a plurality of compute devices configured to execute an endpoint node and a provisioning service. The endpoint node is configured to establish an encrypted communication channel over a public network. The provisioning service is configured to retrieve configuration parameters from a database. The configuration parameters define a security association for the encrypted communication channel and include an encryption key and an identifier of an encryption algorithm. The provisioning service is configured to transmit the configuration parameters to the endpoint node for use in implementation of a security association for the encrypted communication channel.