Security Association Activation via Authentication Done Message
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In Fibre Channel environments, establishing secure communication between nodes can result in inconsistent states and traffic loss due to errors during security association establishment and rekey operations, as existing protocols require delayed data transmission until old security associations are deleted.
Innovation Solution
A computer program product and method that includes a responder sending an authentication done message to confirm successful authentication and activation of a new security association, allowing immediate use and coordinating key usage between initiator and responder, with optional accept messages for synchronized activation, and a rekey operation that maintains both old and new security associations until pending transmissions are flushed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data transmission is delayed until old security association is deleted, then security association establishment is completed, but traffic loss occurs during this time
Solution Approach 1:
The patent applies preliminary action by having the initiator activate the new security association before the old one is deleted. The initiator sends an authentication done message to the responder to indicate the new security association is activated, allowing data transmission to proceed immediately without waiting for the old association to be deleted, thus preventing traffic loss while maintaining security.
2Reliability
If reauthentication is performed to refresh cryptographic keys, then security is maintained, but multiple security associations are maintained and traffic loss may occur
Solution Approach 1:
The patent inverts the traditional approach by having the initiator (rather than the responder) delete the old security association after activation. The initiator sends an delete request to the responder to delete the old security association, giving the initiator control and simplifying the management process while maintaining security through proper key rotation.
3Reliability
If error checking is implemented during security association establishment, then authentication reliability is improved, but messaging errors may still cause inconsistent states
Solution Approach 1:
The patent implements feedback by having the responder send an authentication done message back to the initiator to confirm the new security association is activated. This feedback mechanism ensures both parties are synchronized on the activation status, preventing inconsistent states even if messaging errors occur during the establishment process.
Data Source
AI summary
Provided are a computer program product, system and method embodiments for secure communication between an initiator and a responder over a network. The responder receives, from the initiator, a security association initialization message to establish a security association with the responder including key material used to generate a key for the security association. The responder receives an authentication message from the initiator to program the responder to establish authentication between the responder and the initiator after establishing the security association. The responder sends an authentication message response to the initiator to establish authentication with the responder in response to the authentication message. The responder sends an authentication done message to the initiator after sending the authentication message response to cause the initiator to activate using the security association and the key to encrypt and decrypt communication between the responder and initiator.