Dynamic rekeying of IPSec security associations

A computer system, comprising:

• a memory comprising executable instructions;
• and
• a processor in data communication with the memory and configured to execute the instructions to cause the computer system to:
• establish, by a destination tunnel endpoint (TEP), an in-bound security association with a source TEP, with a first security parameter index (SPI) value, for encrypting data packets communicated between the source TEP and the destination TEP;
• rekey, by the destination TEP, the in-bound security association, the rekeying including generating a second SPI value for replacing the first SPI value based on a trigger event relating to at least one of:
• a real-time security score of the in-bound security association, wherein the real-time security score is based at least on a number of replay packets having the first SPI value that are received by the destination TEP or a number of times the destination TEP failed to decrypt encrypted packets including the first SPI value,
• a number of security associations assigned to a compute resource that the in-bound security association is assigned to, or
• a determination that the compute resource that the in-bound security association is assigned to has a highest amount of load of a plurality of compute resources;
• receive an encrypted packet from the source TEP, wherein the encrypted packet includes the second SPI value;
• and
• process, by the destination TEP, the encrypted packet based on the second SPI value.

A non-transitory computer readable medium having instructions stored thereon that, when executed by a computer system, cause the computer system to perform a method comprising:

• establishing, by a destination tunnel endpoint (TEP), an in-bound security association with a source TEP, with a first security parameter index (SPI) value, for encrypting data packets communicated between the source TEP and the destination TEP;
• rekeying, by the destination TEP, the in-bound security association, the rekeying including generating a second SPI value for replacing the first SPI value based on a trigger event relating to at least one of:
• a real-time security score of the in-bound security association, wherein the real-time security score is based at least on a number of replay packets having the first SPI value that are received by the destination TEP or a number of times the destination TEP failed to decrypt encrypted packets including the first SPI value,
• a number of security associations assigned to a compute resource that the in-bound security association is assigned to, or
• a determination that the compute resource that the in-bound security association is assigned to has a highest amount of load of a plurality of compute resources;
• receiving an encrypted packet from the source TEP, wherein the encrypted packet includes the second SPI value;
• and
• processing, by the destination TEP, the encrypted packet based on the second SPI value.