Dynamic rekeying of IPSec security associations

Patent metadata

Field	Value
Publication number	US-11770389-B2
Application number	US-202017012235-A
Country	US
Kind code	B2
Filing date	Sep 4, 2020
Priority date	Jul 16, 2020
Publication date	Sep 26, 2023
Grant date	Sep 26, 2023

Abstract

Certain embodiments described herein are relate to a method for dynamically rekeying a security association. The method includes establishing, by a destination tunnel endpoint (TEP), an in-bound security association with a source TEP, with a first security parameter index (SPI) value, for encrypting data packets communicated between the source TEP and the destination TEP. The method further includes rekeying, by the destination TEP, the in-bound security association, the rekeying including generating a second SPI value for replacing the first SPI value based on a trigger event relating to at least one of a real-time security score of the in-bound security association, a number of security associations assigned to a compute resource that the in-bound security resource is assigned to, an amount of load managed by the compute resource that the in-bound security resource is assigned to, and an indication received from an administrator.

First claim

What is claimed is:

1. A method for dynamically rekeying a security association, comprising:
establishing, by a destination tunnel endpoint (TEP), an in-bound security association with a source TEP, with a first security parameter index (SPI) value, for encrypting data packets communicated between the source TEP and the destination TEP;
rekeying, by the destination TEP, the in-bound security association, the rekeying including generating a second SPI value for replacing the first SPI value based on a trigger event relating to at least one of:
a real-time security score of the in-bound security association, wherein the real-time security score is based at least on a number of replay packets having the first SPI value that are received by the destination TEP or a number of times the destination TEP failed to decrypt encrypted packets including the first SPI value,
a number of security associations assigned to a compute resource that the in-bound security association is assigned to, or
a determination that the compute resource that the in-bound security association is assigned to has a highest amount of load of a plurality of compute resources;

receiving an encrypted packet from the source TEP, wherein the encrypted packet includes the second SPI value; and
processing, by the destination TEP, the encrypted packet based on the second SPI value.

2. The method of claim 1 , wherein the real-time security score is based further on:
an amount of time that has passed since the in-bound security association was established.

3. The method of claim 1 , wherein, prior to the rekeying:
the trigger event relates to the number of security associations assigned to the compute resource that the in-bound security association is assigned to being higher than a number of security associations assigned to an additional compute resource, and
the second SPI value is associated with the additional compute resource.

4. The method of claim 3 , wherein the trigger event relates to the number of security associations assigned to the compute resource that the in-bound security association is assigned to being higher than the number of security associations assigned to the other compute resource by at least two.

5. The method of claim 1 , wherein prior to the rekeying:
the trigger event relates to an amount of load managed by the compute resource that the in-bound security association is assigned to being higher than an amount of load managed by an additional compute resource at the destination TEP, and
the second SPI value is associated with the additional compute resource.

6. The method of claim 5 , wherein the trigger event relates to the amount of load managed by the compute resource that the in-bound security association is assigned to being higher than the amount of load managed by the other compute resource at the destination TEP by at least two times an amount of load associated with the in-bound security association prior to the rekeying.

7. The method of claim 1 , wherein the trigger event relates to the real-time security score of the in-bound security association.

8. The method of claim 1 , wherein the trigger event relates to at least one of:
the number of security associations assigned to the compute resource that the in-bound security association is assigned to, or
the determination that the compute resource that the in-bound security association is assigned to has the highest amount of load of the plurality of compute resources.

9. The method of claim 1 , wherein the trigger event relates to the number of security associations assigned to the compute resource that the in-bound security association is assigned to.

10. The method of claim 1 , wherein the trigger event relates to the determination that the compute resource that the in-bound security association is assigned to has the highest amount of load of the plurality of compute resources.

11. A computer system, comprising:
a memory comprising executable instructions; and
a processor in data communication with the memory and configured to execute the instructions to cause the computer system to:
establish, by a destination tunnel endpoint (TEP), an in-bound security association with a source TEP, with a first security parameter index (SPI) value, for encrypting data packets communicated between the source TEP and the destination TEP;
rekey, by the destination TEP, the in-bound security association, the rekeying including generating a second SPI value for replacing the first SPI value based on a trigger event relating to at least one of:
a real-time security score of the in-bound security association, wherein the real-time security score is based at least on a number of replay packets having the first SPI value that are received by the destination TEP or a number of times the destination TEP failed to decrypt encrypted packets including the first SPI value,
a number of security associations assigned to a compute resource that the in-bound security association is assigned to, or
a determination that the compute resource that the in-bound security association is assigned to has a highest amount of load of a plurality of compute resources;

receive an encrypted packet from the source TEP, wherein the encrypted packet includes the second SPI value; and
process, by the destination TEP, the encrypted packet based on the second SPI value.

12. The computer system of claim 11 , wherein the real-time security score is based further on:
an amount of time that has passed since the in-bound security association was established.

13. The computer system of claim 11 , wherein prior to the rekeying:
the trigger event relates to the number of security associations assigned to the compute resource that the in-bound security association is assigned to being higher than a number of security associations assigned to an additional compute resource, and
the second SPI value is associated with the additional compute resource.

14. The computer system of claim 13 , wherein the trigger event relates to the number of security associations assigned to the compute resource that the in-bound security association is assigned to being higher than the number of security associations assigned to the other compute resource by at least two.

15. The computer system of claim 11 , wherein prior to the rekeying:
the trigger event relates to an amount of load managed by the compute resource that the in-bound security association is assigned to being higher than an amount of load managed by an additional compute resource at the destination TEP, and
the second SPI value is associated with the additional compute resource.

16. The computer system of claim 15 , wherein the trigger event relates to the amount of load managed by the compute resource that the in-bound security association is assigned to being higher than the amount of load managed by the other compute resource at the destination TEP by at least two times an amount of load associated with the in-bound security association prior to the rekeying.

17. A non-transitory computer readable medium having instructions stored thereon that, when executed by a computer system, cause the computer system to perform a method comprising:
establishing, by a destination tunnel endpoint (TEP), an in-bound security association with a source TEP, with a first security parameter index (SPI) value, for encrypting data packets communicated between the source TEP and the destination TEP;
rekeying, by the destination TEP, the in-bound security association, the rekeying including generating a second SPI value for r

Assignees

• Vmware Inc

Inventors

• Bhattacharya Sourabh
• Wang Yong
• Sharma Awan Kumar
• Puvvada Bhargav
• Katke Mayur

Classifications

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04L9/0891

  Revocation or update of secret information, e.g. encryption key update or rekeying · CPC title

• H04L47/125

  by balancing the load, e.g. traffic engineering · CPC title

• H04L63/029 Primary

  Firewall traversal, e.g. tunnelling or, creating pinholes · CPC title

• H04L63/0485

  Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up · CPC title