SPI Value Allocation via Endpoint Derivation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In software-defined networking (SDN) with distributed network encryption (DNE), managing security associations and SPI values across multiple hosts becomes complex due to the need for frequent key renegotiations and scalability issues when using the Internet Key Exchange (IKE) protocol, leading to potential network disruptions and data loss.
Innovation Solution
Implementing a method to allocate globally and locally unique SPI values based on key policies, allowing endpoints to derive their own SPI values using SPI Derivation Data (SDD) and formulas, eliminating the need for centralized storage and reducing the burden on network controllers, thus preventing replay attacks and maintaining network integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the Internet Key Exchange (IKE) protocol is used for key management in IPSec, then security associations can be established between hosts, but the system becomes complex and scalability is reduced due to frequent key renegotiations
Solution Approach 1:
A centralized key management server is introduced as an intermediary to handle all key generation, SPI allocation, and security parameter distribution. This server mediates between multiple hosts, eliminating the need for complex peer-to-peer IKE negotiations and reducing key management complexity while maintaining security association reliability
Solution Approach 2:
The key management server performs multiple functions including key generation, SPI allocation, security parameter distribution, and host registration management. This universal approach consolidates what would otherwise require multiple separate mechanisms, reducing overall system complexity while maintaining robust security associations
2Ease of operation
If SPI values are centrally stored and managed by network controllers, then tracking and distribution is simplified, but scalability is reduced and network disruptions can occur during controller failures or restarts
Solution Approach 1:
SPI values are pre-computed and associated with host identifiers before hosts join the network. The key management server maintains a mapping of host IDs to SPI values in advance, allowing hosts to retrieve their assigned SPI values immediately upon joining without requiring real-time allocation during network operations, thus preventing disruptions
Solution Approach 2:
Each host autonomously retrieves its pre-assigned SPI value from the key management server using its host identifier, and uses this SPI value locally for security associations. This self-service approach eliminates the need for continuous centralized tracking and reduces the risk of network disruptions during controller events
3Reliability
If new SPI values are distributed to all hosts whenever a host restarts, then anti-replay protection is maintained, but network performance degrades and data loss increases due to frequent key renegotiations
Solution Approach 1:
Each host maintains its own unique SPI value that is specific to its identity and security context. This locally unique SPI assignment means that when a host restarts, only that specific host's SPI needs to be refreshed, not the SPI values of all other hosts in the network. This localized approach maintains anti-replay protection for the restarted host while avoiding unnecessary key renegotiations elsewhere, thus preserving network performance
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Certain embodiments described herein are generally directed to allocating security parameter index ("SPI") values to a plurality of endpoints in a network. The SPI values may be derived using an SPI derivation formula and a plurality of parameters. In some embodiments, the SPI values may be derived by an endpoint and in other embodiments by a server. Using the SPI derivation formula and the plurality of parameters enables endpoints and servers to instantaneously derive SPI values without the need for servers to store them.