System and method for switching security associations
View Patent ↗A system and method for switching security associations between network devices. The system and method includes a first, a second, and a third network device, with a first secure communication being established between the first and second network devices, and a second secure communication being established between the first and third network devices. Both secure communications may have replay prevention enabled. In addition, the first secure communication has a security association and a pre-defined sequence number limit less than a maximum sequence number, while the second secure communication has the same security association as the first secure communication, but an initial sequence number greater than the pre-defined sequence number limit. The system and method may also have a fourth network device with security information corresponding to the security association. The fourth network device is capable of passing the security information from the first network device to the third network device.
1. A network system for switching security associations comprising:
a first network device;
a second network device, the second network device being an active network device; and
a third network device, the third network device being a standby network device;
a first secure communication between the first and second network devices, the first secure communication having a security association and a pre-defined sequence number limit less than a maximum sequence number; and
a second secure communication between the first and third network devices, the second secure communication having the same security association as the first secure communication without negotiating a different security association, the second secure communication also having an initial sequence number greater than the pre-defined sequence number limit.
2. The network system of claim 1 further comprising a fourth network device having security information corresponding to the security association, the fourth network device capable of passing the security information from the second network device to the third network device.
3. The network system of claim 2 wherein the security information comprises at least a security parameter index.
4. The network system of claim 2 wherein the fourth network device is a redundancy handler.
5. The network system of claim 2 wherein the fourth network device is a router.
6. The network system of claim 2 wherein the fourth network device is a media gateway controller, and the second and third network devices are media gateways.
7. The network system of claim 1 wherein the second and third network devices are blades.
8. The network system of claim 1 wherein the second secure communication replaces the first secure communication when the first secure communication fails.
9. The network system of claim 1 wherein replay prevention is enabled for both the first and second secure communications.
10. A network system for switching security associations comprising:
a first network device:
a second network device, the second network device being an active network device: and
a third network device, the third network device being a standby network device;
a first secure communication between the first and second network devices, the first secure communication having a security association and a pre-defined sequence number limit less than a maximum sequence number;
a second secure communication between the first and third network devices, the second secure communication having the same security association as the first secure communication without negotiating a different security association, the second secure communication also having an initial sequence number greater than the pre-defined sequence number limit; and
a fourth network device having security information corresponding to the security association, the fourth network device capable of passing the security information from the first network device to the third network device;
wherein replay prevention is enabled for both the first and second secure communications.
11. The network system of claim 10 wherein the second secure communication replaces the first secure communication when the first secure communication fails.
12. The network system of claim 10 wherein the first and second secure communications are voice calls.
13. The network system of claim 10 wherein the security information comprises at least a security parameter index.
14. A method for switching security associations between network devices, the method comprising:
establishing a first communication between a first network device and a second network device, the second network device being an active network device;
negotiating a security association for the first communication;
using a pre-defined sequence number limit less than a maximum sequence number for the first communication;
replacing the first communication with a second communication between the first network device and a third network device, the third network device being a standby network device;
implementing the same security association for the second communication as the first communication without negotiating a different security association; and
using an initial sequence number greater than the pre-defined sequence number limit for the second communication.
15. The method of claim 14 further comprising passing security information corresponding to the security association from the first network device to the third network device.
16. The method of claim 15 further comprising providing at least a security parameter index for the security information.
17. The method of claim 15 further comprising storing the security information in a fourth network device.
18. The method of claim 14 further comprising replacing the first communication with the second communication when the first communication fails.
19. The method of claim 14 further comprising enabling replay prevention for both the first and second communications.
20. The method of claim 14 further comprising providing voice calls for the first and second communications.
21. The method of claim 14 further comprising providing blades for the second and third network devices.
22. A method for switching security associations between network dices, the method comprising:
establishing a first communication between a first network device and a second network device, the second network device being an active network device;
negotiating a security association for the first communication;
using a pre-defined sequence number limit less tan a maximum sequence number for the first communication;
replacing the first communication with a second communication between the first network device and a third network device, the third network device being a standby network device;
passing security information corresponding to the security association from the first network device to the third network device;
implementing the same security association for the second communication as the first communication without negotiating a different security association;
using an initial sequence number greater than the pre-defined sequence number limit for the second communication.
23. The method of claim 22 further comprising providing at least a security parameter index for the security information.
24. The method of claim 22 further comprising replacing the first communication with the second communication when the first communication fails.
25. The method of claim 22 her comprising enabling replay prevention for both the first and second communications.
26. The method of claim 22 further comprising storing the security information in a fourth network device.