System and method for communicating IPSec tunnel packets with compressed inner headers
AssigneeCorrent Corporation
InventorJohn Davis
Life of this patent
Estimating the term…
Abstract
Compression of inner headers of IPSec tunnel packets is achieved by storing an inner IP header and an inner protocol header in a context sub-table associated with the security association database entry at a destination tunnel device. IPSec tunnel packets having compressed inner headers may be identified by the LSBs of the SPI number in the IPSec header. The SPI number may also identify whether the IPSec tunnel packet is a TCP packet. A portion of padding in the encapsulated portion may identify a particular context sub-table used for decompressing the inner headers. The context sub-table may be updated as portions of the inner headers change.
Claims28
A method for communicating IPSec tunnel packets with compressed inner headers, a tunnel header, an IPSec header, an encapsulated portion, and an authentication code, the method comprising:
- storing an inner IP header and an inner protocol header from an initial IPSec tunnel packet in a context sub-table at a destination tunnel device;
- for a subsequent IPSec tunnel packet, generating at the source tunnel device a compressed inner header from the inner protocol header of the subsequent IPSec tunnel packet;
- performing a operation on at least one of the compressed inner header, a payload field and a padding field of the subsequent IPSec tunnel packet to generate the encapsulated portion;
- replacing at least one of the inner IP header, the inner protocol header, the payload field and the padding field of the subsequent IPSec tunnel packet with the encapsulated portion to generate an IPSec tunnel packet with compressed inner headers;
- at the destination tunnel device, identifying a security association database entry for the tunnel using a security policy index number in the IPSec header;
- at the destination tunnel device, decrypting the encapsulated portion to determine at least one of the compressed inner protocol header and the padding field, the padding field including a context sub-table identifier to identifies a context sub-table associated with the security association database entry;
- at the destination tunnel device, retrieving at least one of the inner IP header and the inner protocol header for the subsequent IPSec tunnel packet from the context sub-table;
- and
- recreating the subsequent IPSec tunnel packet using the inner IP header and inner protocol header retrieved from the context sub-table.
A method for communicating IPSec tunnel packets with compressed inner headers comprising:
- generating a compressed inner header from an inner protocol header of an IPSec tunnel packet with full inner headers;
- performing an operation on at least one of the compressed inner header, a payload field and a padding field of the IPSec tunnel packet to generate an encapsulated portion;
- replacing at least one of an inner IP header, the inner protocol header, the payload field and the padding field of the IPSec tunnel packet with the encapsulated portion to generate an IPSec tunnel packet with compressed inner headers;
- performing a second operation on the encapsulated portion of the IPSec tunnel packet with compressed inner headers to determine the compressed inner protocol header and the padding field, the padding field including a context sub-table identifier to identify a context sub-table;
- retrieving the inner IP header and the inner protocol header for the IPSec tunnel packet from the context sub-table;
- and
- recreating the IPSec tunnel packet with full inner headers using the IP header and inner protocol header retrieved from the context sub-table.
The method as claimed in clam 6 wherein the generating the compressed inner header comprises generating a status field to indicated fields of the inner protocol header that have changed from the prior IPSec tunnel packet.
The method as claimed in clam 6 wherein the generating the compressed inner header comprises including a generation data field in the compressed inner header.
The method as claimed in clam 5 wherein performing the operation comprises performing either an encryption operation or an authentication operation on the compressed inner header, the payload field and the padding field to generate the encapsulated portion.
A tunnel device for communicating IPSec tunnel packets with compressed inner headers, the tunnel device comprising:
- an inner header compressor to (i) generate a compressed inner header from an inner protocol header of an IPSec tunnel packet with full inner headers that include an inner IP header, (ii) compare the inner protocol header with an inner protocol header of a prior IPSec tunnel packet with full inner headers, (iii) refrain from including information from the inner IP header, and (iv) generate a status field to indicate fields of the inner protocol header that have changed from the prior IPSec tunnel packet;
- a security processor to perform a security operation on the compressed inner header, a payload field and a padding field of the IPSec tunnel packet to generate an encapsulated portion;
- and
- an IP packet processor to replace an inner IP header, the inner protocol header, the payload field and the padding field of the IPSec tunnel packet with the encapsulated portion to generate an IPSec tunnel packet with compressed inner headers,
- wherein a second tunnel device performs a security operation on the encapsulated portion of the IPSec tunnel packet with compressed inner headers to determine the compressed inner protocol header and the padding field, the padding field including a context sub-table identifier to identify a context sub-table, retrieves the inner IP header and the inner protocol header for the IPSec tunnel packet from the context sub-table, and recreates the IPSec tunnel packet with full inner headers using the IP header and inner protocol header retrieved from the context sub-table.
A computer readable medium having program instructions stored thereon for performing a method of communicating IPSec tunnel packets with compressed headers when executed within a digital processing device, the method comprising:
- generating a compressed inner header from an inner protocol header of an IPSec tunnel packet with full inner headers that include an inner IP header, while refraining from including information from the inner IP header;
- comparing the inner protocol header with an inner protocol header of a prior IPSec tunnel racket with full inner headers;
- generating a status field to indicate fields of the inner protocol header that have changed from the prior IPSec tunnel packet;
- performing a security operation on the compressed inner header, a payload field and a padding field of the IPSec tunnel packet to generate an encapsulated portion;
- replacing an inner IP header, the inner protocol header, the payload field and the padding field of the IPSec tunnel packet with the encapsulated portion to generate an IPSec tunnel packet with compressed inner headers;
- performing a security operation on the encapsulated portion of the IPSec tunnel packet with compressed inner headers to determine the compressed inner protocol header and the padding field, the padding field including a context sub-table identifier to identify a context sub-table;
- retrieving the inner IP header and the inner protocol header for the IPSec tunnel packet from the context sub-table;
- and
- recreating the IPSec tunnel packet with full inner headers using the IP header and inner protocol header retrieved from the context sub-table.
Dependencies are inferred from the claim text.