Tunnel-less Encryption Migration via Sub-group Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Converting networks from plaintext to tunnel-less encryption is complicated and disruptive, especially when VPN gateways do not know the state of their peers, as in tunnel-less VPN methods like GET VPN, which lack the concept of a peer, making it difficult to perform network migration.
Innovation Solution
The method involves logically partitioning VPN gateway devices into sub-groups based on CIDR blocks, configuring a policy server with DO NOT ENCRYPT statements, and using passive mode to incrementally convert devices to tunnel-less encryption while maintaining connectivity, allowing VPN gateways to accept and send encrypted or plaintext packets based on security policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If VPN gateways are configured to encrypt packets during network conversion, then network security is improved, but network connectivity is disrupted because gateways cannot determine peer encryption state in tunnel-less VPN
Solution Approach 1:
The network is divided into sub-groups based on CIDR blocks, allowing incremental conversion where each sub-group can be converted independently without affecting the entire network. This segmentation enables security improvements to be applied progressively while maintaining overall network connectivity.
Solution Approach 2:
VPN gateways are configured in passive mode before active encryption is enabled. This preliminary configuration allows gateways to receive and process both encrypted and plaintext packets, ensuring connectivity is maintained during the transition period before full encryption activation.
2Reliability
If tunnel-less encryption is implemented across the entire network at once, then encryption coverage is maximized, but network disruption increases due to lack of peer state information
Solution Approach 1:
The network conversion process is segmented into manageable sub-groups based on CIDR blocks. Each sub-group can be converted independently, allowing encryption coverage to expand gradually while maintaining network availability. This avoids the need for simultaneous network-wide conversion that would cause extensive disruption.
Solution Approach 2:
The conversion process is made dynamic and incremental rather than static and all-at-once. Gateways can dynamically adjust their encryption behavior based on their sub-group's conversion status, enabling flexible progression from plaintext to encrypted communication without forcing immediate network-wide changes.
3Ease of operation
If VPN gateways operate in passive mode to maintain connectivity during conversion, then network availability is preserved, but encryption enforcement is weakened
Solution Approach 1:
Passive mode is used as a preliminary configuration step during the conversion process, not as a permanent state. This temporary relaxation of encryption enforcement allows connectivity to be maintained while gateways are being prepared for full encryption operation.
Solution Approach 2:
The encryption enforcement level is made dynamic, transitioning from weaker enforcement in passive mode to stronger enforcement when active encryption is enabled. This dynamic adjustment allows the system to balance availability and security requirements at different stages of the conversion process.
Data Source
AI summary
A method comprises, in a network comprising VPN gateway devices configured only for plaintext data communication, configuring a policy server with a security policy including DO NOT ENCRYPT statements temporarily overriding PERMIT statements defining which packets should be encrypted; selecting one sub-group of the VPN gateway devices in which tunnel-less encryption is not configured; configuring of the VPN gateway devices in the sub-group for tunnel-less encryption by: configuring each device in a passive mode of operation in which the device is configured to receive either encrypted packets or plaintext packets matching encryption policy; configuring local DO NOT ENCRYPT statements matching traffic that is currently being converted to ciphertext; removing, from the access control list of the policy server, DO NOT ENCRYPT statements referring to protected LAN CIDR blocks behind the VPN gateway devices in the selected sub-group; configuring the sub-group to send encrypted packets by removing, from each of the VPN gateway devices in the selected sub-group, the local DO NOT ENCRYPT statements for the CIDR blocks currently being converted and protected by the selected sub-group; repeating the configuring each of the VPN gateway devices in the selected sub-group for tunnel-less encryption, and the configuring the sub-group to send encrypted packets, for each other one of the sub-groups; and removing the passive mode on each of the VPN gateway devices.