Flow multiplexing in IPsec
AssigneeTelefonaktiebolaget LM Ericsson (publ)
InventorsDaniel Migault, Stere Preda
Life of this patent
Estimating the term…
Abstract
Systems and methods for processing inbound and outbound secure packet traffic are provided herein. A first lookup operation can be performed to identify a security association corresponding to a received packet. A second lookup operation can be performed to determine a security parameters index associated with the packet and the identified security association. The packet can be processed in accordance with the security association and the security parameters index.
Claims22
A method for outbound packet processing, the method comprising:
- receiving a packet, the packet including one or more traffic selector (TS) parameters;
- performing a first lookup in a first table to identify a Security Association (SA) associated with the packet in accordance with at least one of the TS parameters;
- responsive to identifying the SA, performing a second lookup in a second table to determine a Security Parameters Index (SPI) value associated with the packet and the identified SA in accordance with at least one of the TS parameters;
- processing the packet by encrypting the packet using a security key from the identified SA and adding the determined SPI value to the encrypted packet;
- and
- transmitting the processed packet.
A network node comprising circuitry including a processor and a memory, the memory containing instructions executable by the processor whereby the network node is operative to:
- receive a packet, the packet including one or more traffic selector (TS) parameters;
- perform a first lookup in a first table to identify a Security Association (SA) associated with the packet in accordance with at least one of the TS parameters;
- responsive to identifying the SA, perform a second lookup in a second table to determine a Security Parameters Index (SPI) value associated with the packet and the identified SA in accordance with at least one of the TS parameters;
- process the packet by encrypting the packet using a security key from the identified SA and adding the determined SPI value to the encrypted packet;
- and
- transmit the processed packet.
A method for inbound packet processing, the method comprising:
- receiving an encrypted packet, the packet including a Security Parameters Index (SPI) value;
- performing a first lookup in a first table to identify a Security Association (SA) associated with the packet in accordance with the SPI value;
- responsive to identifying the SA, performing a second lookup in a second table to determine one or more traffic selector (TS) parameters in accordance with the SPI value;
- decrypting the packet using a security key from the identified SA;
- verifying the packet by comparing TS parameters in decrypted packet to the TS parameters determined by the second lookup;
- and
- processing the decrypted packet.
A network node comprising circuitry including a processor and a memory, the memory containing instructions executable by the processor whereby the network node is operative to:
- receive an encrypted packet, the packet including a Security Parameters Index (SPI) value;
- perform a first lookup in a first table to identify a Security Association (SA) associated with the packet in accordance with the SPI value;
- responsive to identifying the SA, perform a second lookup in a second table to determine one or more traffic selector (TS) parameters associated in accordance with the SPI value;
- decrypt the packet using a security key from the identified SA;
- verify the packet by comparing TS parameters in decrypted packet to the TS parameters determined by the second lookup;
- and
- process the decrypted packet.
Dependencies are inferred from the claim text.