Optimizing utilization of security parameter index (spi) space
AssigneeNicira, Inc.
InventorsDexiang WANG, Zhen MO, Fang PENG, Bo HU, Helen LIU
Life of this patent
Estimating the term…
Abstract
Certain embodiments described herein are generally directed to methods and apparatus for providing a security parameter index (SPI) value for use in establishing a security association between a source tunnel endpoint and a destination tunnel endpoint. In some embodiments, utilization of the SPI bit space is optimized to allow the scaling of key policies within a network. In some embodiment, using an SPI derivation formula, a server in the network is able to generate SPI values whose bit spaces are optimized to allow key policies to scale out.
Claims24
A method for providing a security parameter index (SPI) value for use in establishing a security association between a source tunnel endpoint and a destination tunnel endpoint, comprising:
- receiving, at a server, a request from the source tunnel endpoint for a SPI value for use by the source tunnel endpoint in establishing the security association with the destination tunnel endpoint for securing an exchange of one or more data packets between a source endpoint and a destination endpoint;
- deriving, at the server, the SPI value using a SPI derivation formula based on a key policy assigned to the source tunnel endpoint and the destination tunnel endpoint, wherein most bits from the SPI value are associated with the key policy;
- and
- transmitting, at the server, the SPI value to the source tunnel endpoint for use by the source tunnel endpoint in establishing the security association, wherein the established security association is used by the source tunnel endpoint to encapsulate and encrypt at least a data packet from the one or more data packets received from the source endpoint and destined for the destination endpoint, the encapsulated encrypted data packet comprising a first header and an encrypted payload, the first header comprising a source IP address of the source tunnel endpoint, a destination IP address of the destination tunnel endpoint, and the SPI value, the encrypted payload comprising a second header comprising a source IP address of the source endpoint and a destination IP address of the destination endpoint, and wherein the encapsulated encrypted data packet is transmitted by the source tunnel endpoint to the destination tunnel endpoint.
A non-transitory computer readable medium comprising instructions to be executed in a computer system, wherein the instructions when executed in the computer system perform a method for providing a security parameter index (SPI) value for use in establishing a security association between a source tunnel endpoint and a destination tunnel endpoint, the method comprising:
- deriving, at the server, the SPI value using a SPI derivation formula based on a key policy assigned to the source tunnel endpoint and the destination tunnel endpoint, wherein most bits from the SPI value are associated with the key policy;
- and
- transmitting, at the server, the SPI value to the source tunnel endpoint for use by the source tunnel endpoint in establishing the security association, wherein the established security association is used by the source tunnel endpoint to encapsulate and encrypt at least a data packet from the one or more data packets received from the source endpoint and destined for the destination endpoint, the encapsulated encrypted data packet comprising a first header and an encrypted payload, the first header comprising a source IP address of the source tunnel endpoint, a destination IP address of the destination tunnel endpoint, and the SPI value, the encrypted payload comprising a second header comprising a source IP address of the source endpoint and a destination IP address of the destination endpoint, and wherein the encapsulated encrypted data packet is transmitted by the source tunnel endpoint to the destination tunnel endpoint.
A computer system, wherein system software for providing a security parameter index (SPI) value for use in establishing a security association between a source tunnel endpoint and a destination tunnel endpoint, the method comprising:
- receiving, at a server, a request from the source tunnel endpoint for a SPI value for use by the source tunnel endpoint in establishing the security association with the destination tunnel endpoint for securing an exchange of one or more data packets between a source endpoint and a destination endpoint;
- deriving, at the server, the SPI value using a SPI derivation formula based on a key policy assigned to the source tunnel endpoint and the destination tunnel endpoint, wherein most bits from the SPI value are associated with the key policy;
- and
- transmitting, at the server, the SPI value to the source tunnel endpoint for use by the source tunnel endpoint in establishing the security association, wherein the established security association is used by the source tunnel endpoint to encapsulate and encrypt at least a data packet from the one or more data packets received from the source endpoint and destined for the destination endpoint, the encapsulated encrypted data packet comprising a first header and an encrypted payload, the first header comprising a source IP address of the source tunnel endpoint, a destination IP address of the destination tunnel endpoint, and the SPI value, the encrypted payload comprising a second header comprising a source IP address of the source endpoint and a destination IP address of the destination endpoint, and wherein the encapsulated encrypted data packet is transmitted by the source tunnel endpoint to the destination tunnel endpoint.
Dependencies are inferred from the claim text.