Rekeying a security association SA
AssigneeHuawei Technologies Co., Ltd.
InventorsSandeep Kampati, De Sheng, Dharmanandana Reddy Pothula, Bharath Soma Satya Meduri
Life of this patent
Estimating the term…
Abstract
In the IKE or IPSec SA rekeying, whether the rekey exchange includes the cryptographic suite in the payload depends on whether the cryptographic suite used in the old SA is changed on both ends, e.g., the initiator and the responder. If the cryptographic suite is not changed, then the rekey exchange does not include the cryptographic suite. Additionally, in the IPSec SA rekey, if the flowing information is not changed in either end, the rekey exchange further does not include the Traffic Selector (TS). As such, the size of the payload is decreased, which saves bandwidth, more processing time and power in the course of the IKE SA or the IPSec SA rekey.
Claims30
A method for rekeying a security association (SA) applied in a network system including a first network device and a second network device, wherein an Internet Key Exchange (IKE) tunnel and an Internet Protocol Security (IPSec) tunnel are established between the first network device and the second network device, the method comprising:
- determining, by the first network device, whether there is a change in a cryptographic suite associated with the first network device;
- sending, by the first network device, a first rekey request to the second network device for rekeying the SA when there is no change in the cryptographic suite associated with the first network device, wherein the first rekey request carries a first Security Parameter Index (SPI) and does not carry the cryptographic suite associated with the first network device;
- receiving, by the first network device, a first rekey response from the second network device, wherein the first rekey response carries a second SPI and does not carry a cryptographic suite associated with the second network device when there is no change in the cryptographic suite associated with the second network device;
- rekeying, by the first network device, the SA according to the first SPI and the second SPI when there is no change in the cryptographic suite associated with the first network device and there is no change in the cryptographic suite associated with the second network device.
A method for rekeying a security association (SA) applied in a network system including a first network device and a second network device, wherein an Internet Key Exchange (IKE) tunnel and an Internet Protocol Security (IPSec) tunnel are established between the second network device and the first network device, the method comprising:
- receiving, by the second network device, a first rekey request from the first network device for rekeying the SA, wherein the first rekey request carries a first Security Parameter Index (SPI) and does not carry a cryptographic suite associated with the first network device;
- determining, by the second network device, whether there is a change in a cryptographic suite associated with the second network device;
- sending, by the second network device, a first rekey response to the first network device, wherein the first rekey response carries a second SPI and does not carry the cryptographic suite associated with the second network device when there is no change in the cryptographic configuration associated with the second network device;
- rekeying, by the second network device, the SA according to the first SPI and the second SPI.
A first network device for rekeying a security association (SA) in a network system comprising the first network device and a second network device, an Internet Key Exchange (IKE) and an Internet Protocol Security (IPSec) tunnel are established between the first network device and the second network device, the first network device comprising:
- a memory storing instructions;
- and
- at least one processor in communication with the memory, the at least one processor configured, upon execution of the instructions, to perform the following steps:
- determine whether there is a change in the cryptographic suite associated with the first network device;
- send a first rekey request to the second network device for rekeying an SA when there is no change in the cryptographic suite associated with the first network device, the first rekey request carries a first Security Parameter Index (SPI) and does not carry the cryptographic suite associated with the first network device;
- receive a first rekey response from the second network device, the first rekey response carries a second SPI and does not carry a cryptographic suite associated with the second network device when there is no change in the cryptographic suite associated with the second network device;
- rekey the SA according to the first SPI and the second SPI when there is no change in the cryptographic suite associated with the first network device and in the cryptographic suite associated with the second network device.
A second network device for rekeying a security association (SA) in a network system comprising a first network device and the second network device, an Internet Key Exchange (IKE) and an Internet Protocol Security (IPSec) tunnel is established between the first network device and the second network device, the second network device comprising:
- a memory storing instructions;
- and
- at least one processor in communication with the memory, the at least one processor configured, upon execution of the instructions, to perform the following steps:
- receive a first rekey request from the first network device for rekeying an SA, wherein the first rekey request carries a first Security Parameter Index (SPI) and does not carry a cryptographic suite associated with the first network device;
- determine whether there is a change in a cryptographic suite associated with the second network device;
- send a first rekey response to the first network device;
- wherein the first rekey response carries a second SPI and does not carry the cryptographic suite associated with the second network device when there is no change in the cryptographic configuration associated with the second network device;
- rekey the SA according to the first SPI and second SPI.
Dependencies are inferred from the claim text.