Anti-replay protection with quality of services (QoS) queues
View Patent ↗An embodiment of the present invention includes a technique to provide anti-replay protection with QoS queues. A single global anti-replay window is maintained to have global lowest and highest sequence numbers for an Internet protocol security (IPSec) security association (SA). The single global anti-replay window is associated with individual differentiated services code point (DSCP) or DSCP group, the individual DSCP or DSCP group corresponding to individual per-DSCP anti-replay windows. A received packet having a sequence number is pre-processed before packet processing using the single global anti-replay window. The received packet is post-processed after packet processing using the individual per-DSCP anti-replay windows.
1. A method comprising:
maintaining a single global anti-replay window having global lowest and highest sequence numbers for an Internet protocol security (IPSec) security association (SA), the single global anti-replay window being associated with individual differentiated services code point (DSCP) or DSCP group, the individual DSCP or DSCP group corresponding to individual per-DSCP anti-replay windows;
pre-processing a received packet having a sequence number before packet processing using the single global anti-replay window; and
post-processing the received packet after packet processing using the individual per-DSCP anti-replay windows, wherein post-processing comprises:
identifying a DSCP from header of the received packet;
retrieving start and end pointers of the individual per-DSCP group corresponding to the identified DSCP; and
checking the sequence number with the individual lowest and highest sequence numbers in the individual per-DSCP window.
2. The method of claim 1 wherein maintaining the single global anti-replay window comprises:
maintaining the individual per-DSCP anti-replay window for which at least one packet has been received for the IPSec SA, maintaining the individual per-DSCP anti-replay window comprising maintaining start and end pointers corresponding to individual lowest and highest sequence numbers;
storing received sequence numbers corresponding to accepted packets; and
advancing the single global anti-replay window when the sequence number is greater than a global maximum sequence number.
3. The method of claim 2 wherein advancing the single global anti-replay window comprises:
truncating the single global anti-replay window from a side toward the global lowest sequence number.
4. The method of claim 1 wherein pre-processing comprises:
authenticating the received packet to ensure that the sequence number is trusted;
discarding the received packet if the sequence number is lower than the global lowest sequence number;
comparing the sequence number with received sequence numbers in the single global anti-replay window; and
discarding the received packet if the sequence number matches with one of the received sequence numbers.
5. The method of claim 1 wherein checking the sequence number comprises:
if the sequence number is within the individual lowest and highest sequence numbers or higher than the individual highest sequence number, accepting the received packet and marking the sequence number as received in the received sequence numbers;
if the sequence number is lower than the individual lowest sequence number, discarding the received packet; and
if the sequence number is higher than the individual highest sequence number, advancing the individual per-DSCP window.
6. The method of claim 5 wherein advancing the individual per-DSCP window comprises:
modifying start and end pointers of the individual per-DSCP group;
updating the individual lowest and highest sequence numbers of the individual per-DSCP window; and
modifying the global lowest and highest sequence numbers of the single global window if necessary.
7. The method of claim 1 wherein said packet processing comprises decrypting said packet.
8. The method of claim 1 wherein said received packet is mis-ordered.
9. A article of manufacture comprising:
a non-transitory machine-accessible storage medium including information that, when accessed by a machine, cause the machine to perform operations comprising:
maintaining a single global anti-replay window having global lowest and highest sequence numbers for an Internet protocol security (IPSec) security association (SA), the single global anti-replay window being associated with individual differentiated services code point (DSCP) or DSCP group, the individual DSCP or DSCP group corresponding to individual per-DSCP anti-replay windows;
pre-processing a received packet having a sequence number before packet processing using the single global anti-replay window; and
post-processing the received packet after packet processing using the individual per-DSCP anti-replay windows, wherein post-processing comprises:
identifying a DSCP from header of the received packet;
retrieving start and end pointers of the individual per-DSCP group corresponding to the identified DSCP; and
checking the sequence number with the individual lowest and highest sequence numbers in the individual per-DSCP window.
10. The article of manufacture of claim 9 wherein the information causing the machine to perform maintaining the single global anti-replay window comprises information that, when accessed by the machine, causes the machine to perform operations comprising:
maintaining the individual per-DSCP anti-replay window for which at least one packet has been received for the IPSec SA, maintaining the individual per-DSCP anti-replay window comprising maintaining start and end pointers corresponding to individual lowest and highest sequence numbers;
storing received sequence numbers corresponding to accepted packets; and
advancing the single global anti-replay window when the sequence number is greater than a global maximum sequence number.
11. The article of manufacture of claim 10 wherein the information causing the machine to perform advancing the single global anti-replay window comprises information that, when accessed by the machine, causes the machine to perform operations comprising:
truncating the single global anti-replay window from a side toward the global lowest sequence number.
12. The article of manufacture of claim 9 wherein the information causing the machine to perform pre-processing comprises information that, when accessed by the machine, causes the machine to perform operations comprising:
authenticating the received packet to ensure that the sequence number is trusted;
discarding the received packet if the sequence number is lower than the global lowest sequence number;
comparing the sequence number with received sequence numbers in the single global anti-replay window; and
discarding the received packet if the sequence number matches with one of the received sequence numbers.
13. The article of manufacture of claim 9 wherein the information causing the machine to perform checking the sequence number comprises information that, when accessed by the machine, causes the machine to perform operations comprising:
if the sequence number is within the individual lowest and highest sequence numbers or higher than the individual highest sequence number, accepting the received packet and marking the sequence number as received in the received sequence numbers;
if the sequence number is lower than the individual lowest sequence number, discarding the received packet; and
if the sequence number is higher than the individual highest sequence number, advancing the individual per-DSCP window.
14. The article of manufacture of claim 13 wherein the information causing the machine to perform advancing the individual per-DSCP window comprises information that, when accessed by the machine, causes the machine to perform operations comprising:
modifying start and end pointers of the individual per-DSCP group;
updating the individual lowest and highest sequence numbers of the individual per-DSCP window; and
modifying the global lowest and highest sequence numbers of the single global window if necessary.
15. The article of manufacture of claim 9 wherein said packet processing comprises decrypting said packet.
16. The article of manufacture of claim 9 wherein said received packet is mis-ordered.
17. A computer system comprising:
a global window maintaining module to maintain a single global anti-replay window having global lowest and highest sequence numbers for an Internet protocol security (IPSec) security association (SA), the single global anti-replay window being associated with individual differentiated services code point (DSCP) or DSCP group, the individual DSCP or DSCP group corresponding to individual per-DSCP anti-replay windows;
a pre-processor coupled to the global window maintaining module to pre-process a received packet having a sequence number before packet processing by a packet processor using the single global anti-replay window; and
a post-processor coupled to the packet processor to post-process the received packet after packet processing using the individual per-DSCP anti-replay windows wherein post-processing comprises:
identifying a DSCP from header of the received packet;
retrieving start and end pointers of the individual per-DSCP group corresponding to the identified DSCP; and
checking the sequence number with the individual lowest and highest sequence numbers in the individual per-DSCP window.
18. The system of claim 17 wherein the global window maintaining module comprises:
an individual window maintaining module to maintain the individual per-DSCP anti-replay window for which at least one packet has been received for the IPSec SA, the individual window maintaining module maintaining start and end pointers corresponding to individual lowest and highest sequence numbers; and
a memory to store received sequence numbers corresponding to accepted packets; and
wherein the single global anti-replay window is advanced when the sequence number is greater than a global maximum sequence number.
19. A system comprising:
a sending server coupled to a network to send a packet through a virtual private network; and
a receiving server coupled to the VPN to receive the packet, the receiving server having a VPN gateway, the VPN gateway including a QoS anti-replay processor, the QoS anti-replay processor comprising:
a global window maintaining module to maintain a single global anti-replay window having global lowest and highest sequence numbers for an Internet protocol security (IPSec) security association (SA), the single global anti-replay window being associated with individual differentiated services code point (DSCP) or DSCP group, the individual DSCP or DSCP group corresponding to individual per-DSCP anti-replay windows, a pre-processor is coupled to the global window maintaining module to pre-process a received packet having a sequence number before packet processing by a packet processor using the single global anti-replay window, and a post-processor coupled to the packet processor to post-process the received packet after packet processing using the individual per-DSCP anti-replay windows, wherein post-processing comprises:
identifying a DSCP from header of the received packet;
retrieving start and end pointers of the individual per-DSCP group corresponding to the identified DSCP; and
checking the sequence number with the individual lowest and highest sequence numbers in the individual per-DSCP window.
20. The system of claim 19 wherein the global window maintaining module comprises:
an individual window maintaining module to maintain the individual per-DSCP anti-replay window for which at least one packet has been received for the IPSec SA, the individual window maintaining module maintaining start and end pointers corresponding to individual lowest and highest sequence numbers; and
a memory to store received sequence numbers corresponding to accepted packets; and
wherein the single global anti-replay window is advanced when the sequence number is greater than a global maximum sequence number.