Security association lookup in communication system deployments
To generate an encrypted packet, a transmitting endpoint in a communication system chooses the desired IPsec tunnel, then retrieves the SA linked to that tunnel from its Outbound SA table of its local SA database (SAD), and encrypts the packet using the retrieved SA. To decrypt the encrypted packet, the receiving endpoint extracts the Security Parameter Index (SPI) value, the source address, the destination address, and the source port number from the packet to retrieve the appropriate SA from its local SAD database and decrypts the encrypted packet using the retrieved SA. In this way, the transmitting and receiving endpoints can retrieve the appropriate SAs for situations in which either endpoint is one of multiple endpoints located behind a Carrier-Grade Network Address Translation (CG-NAT) function having a single public IP address shared by the multiple endpoints.
1 . A method for processing an encrypted packet at a destination endpoint, the method comprising the destination endpoint:
identifying, for the encrypted packet, a plurality of values including a Security Parameter Index (SPI) value, a source address, a destination address, and a source port number;
using the SPI value, the source address, the destination address, and the source port number to retrieve a Security Association (SA) from an SA database (SAD); and
decrypting the encrypted packet using the retrieved SA, wherein:
using the SPI value, the source address, the destination address, and the source port number to retrieve the SA from the SAD enables the destination endpoint to distinguish encrypted packets from different source Carrier-Grade Network Address Translation (CG-NAT) endpoints located behind a source CG-NAT function; and
encrypted packets from the different source CG-NAT endpoints have the same SPI value, the same source address, the same destination address, and different source port numbers.
2 . The method of claim 1 , wherein:
a destination IP address for the encrypted packet is a public address for the destination endpoint located behind a destination CG-NAT function; and
the destination port number for the packet is a port number for the destination endpoint located behind the destination CG-NAT function.
3 . The method of claim 2 , wherein the destination CG-NAT function is associated with two or more different destination CG-NAT endpoints located behind the destination CG-NAT function, each destination CG-NAT endpoint having a different port number at the destination CG-NAT function.
4 . The method of claim 1 , further comprising extracting the SPI value, the source address, the destination address, and the source port number from the encrypted packet.
5 . The method of claim 1 , wherein:
the source address for the encrypted packet is a public address for the source endpoint located behind the source CG-NAT function; and
the source port number for the encrypted packet is a port number for the source endpoint located behind the source CG-NAT function.
6 . The method of claim 5 , wherein the source CG-NAT function is associated with two or more different source CG-NAT endpoints located behind the source CG-NAT function, each source CG-NAT endpoint having a different port number at the source CG-NAT function.
7 . A destination endpoint comprising:
at least one processor; and
at least one memory storing instructions that, upon being executed by the at least one processor, cause the destination endpoint at least to:
identify, for an encrypted packet, a plurality of values including a Security Parameter Index (SPI) value, a source address, a destination address, and a source port number;
use the SPI value, the source address, the destination address, and the source port number to retrieve an SA from a SAD database; and
decrypt the encrypted packet using the retrieved SA, wherein:
using the SPI value, the source address, the destination address, and the source port number to retrieve the SA from the SAD enables the destination endpoint to distinguish encrypted packets from different source Carrier-Grade Network Address Translation (CG-NAT) endpoints located behind a source CG-NAT function; and
encrypted packets from the different source CG-NAT endpoints have the same SPI value, the same source address, the same destination address, and different source port numbers.
8 . The destination endpoint of claim 7 , wherein:
a destination address for the encrypted packet is a public address for the destination endpoint located behind a destination CG-NAT function; and
the destination port number for the packet is a port number for the destination endpoint located behind the destination CG-NAT function.
9 . The destination endpoint of claim 8 , wherein the destination CG-NAT function is associated with two or more different destination CG-NAT endpoints located behind the destination CG-NAT function, each destination CG-NAT endpoint having a different port number at the destination CG-NAT function.
10 . The destination endpoint of claim 7 , wherein the destination endpoint is adapted to extract the SPI value, the source address, the destination address, and the source port number from the encrypted packet.
11 . The destination endpoint of claim 7 , wherein:
the source address for the encrypted packet is a public address for the source endpoint located behind the source CG-NAT function; and
the source port number for the encrypted packet is a port number for the source endpoint located behind the source CG-NAT function.
12 . The destination endpoint of claim 11 , wherein the source CG-NAT function is associated with two or more different source CG-NAT endpoints located behind the source CG-NAT function, each source CG-NAT endpoint having a different port number at the source CG-NAT function.