System and method for IPSec link configuration
A method for configuring Internet Protocol Security (IPsec) protocol. The method includes configuring IPsec phase 1 Security Associations (SA) lifetimes and soft phase 2 SA lifetimes in a manner enabling efficient Dead Peer Detection recovery of secure communication between client and server in the event of a communication disruption and thereby preventing undesirable sustained periods of non-communication between client and server.
1. A method of communicating between a first communication device and a second communication device, said method comprising:
establishing a phase 1 security association between the first communication device and the second communication device, the phase 1 security association having a phase 1 security association timer corresponding to a time value of the phase 1 security association; and
establishing a phase 2 security association between the first communication device and the second communication device, the phase 2 security association having a soft phase 2 security association timer and a hard phase 2 security association timer, the soft phase 2 security association timer corresponding to a time value of a soft phase 2 security association, the hard phase 2 security association timer corresponding to a time value of a hard phase 2 security association, wherein the time value of the soft phase 2 security association is less than the time value of the hard phase 2 security association, and
wherein the time value of the phase 1 security association is derived from the time value of the soft phase 2 security association such that the time value of the phase 1 security association is an integer multiple of the time value of the soft phase 2 security association.
2. The method of claim 1 , wherein said establishing a phase 1 security association between the first communication device and the second communication device comprises:
initiating the phase 1 security association between the first communication device and the second communication device; and
completing the phase 1 security association between the first communication device and the second communication device.
3. The method of claim 2 , wherein said establishing a phase 2 security association between the first communication device and the second communication device comprises:
initiating the phase 2 security association between the first communication device and the second communication device; and
completing the phase 2 security association between the first communication device and the second communication device.
4. The method of claim 3 , further comprising:
establishing a communication link between the first communication device and the second communication device; and
exchanging information between the first communication device and the second communication device over the established communication link, wherein said completing the phase 2 security association between the first communication device and the second communication device is performed after said completing the phase 1 security association between the first communication device and the second communication device, and
wherein said establishing a communication link between the first communication device and the second communication device is performed after said completing the phase 2 security association between the first communication device and the second communication device.
5. The method of claim 4 , further comprising ending the established communication link.
6. The method of claim 5 , further comprising establishing a second phase 2 security association between the first communication device and the second communication device, the second phase 2 security association having a second soft phase 2 security association timer and a second hard phase 2 security association timer.
7. The method of claim 1 , wherein said establishing a phase 2 security association between the first communication device and the second communication device comprises:
initiating the phase 2 security association between the first communication device and the second communication device; and
completing the phase 2 security association between the first communication device and the second communication device.
8. The method of claim 7 , further comprising establishing a second phase 2 security association between the first communication device and the second communication device, the second phase 2 security association having a second soft phase 2 security association timer and a second hard phase 2 security association timer.
9. The method of claim 1 , wherein:
a new time value of the phase 1 security association is not automatically configured until a new soft phase 2 security association is requested, and
the new time value of the phase 1 security association is configured automatically to be an integer multiple of a new time value of the soft phase 2 security association after the new soft phase 2 security association is requested.
10. A communication device operable to communicate with a second communication device, said communication device comprising:
an internet key exchange protocol portion operable to negotiate a phase 1 security association with the second communication device, the phase 1 security association having a phase 1 security association timer corresponding to a time value of the phase 1 security association; and
an IPsec portion operable to establish a phase 2 security association, the phase 2 security association having a soft phase 2 security association timer and a hard phase 2 security association timer, the soft phase 2 security association timer corresponding to a time value of a soft phase 2 security association, the hard phase 2 security association timer corresponding to a time value of a hard phase 2 security association, wherein the time value of the soft phase 2 security association is less than the time value of the hard phase 2 security association, and wherein the time value of the phase 1 security association is derived from the time value of the soft phase 2 security association such that the time value of the phase 1 security association is an integer multiple of the time value of the soft phase 2 security association.
11. The communication device of claim 10 , wherein said internet key exchange protocol portion and said IPsec portion are a unitary portion.
12. The communication device of claim 10 , wherein said internet key exchange protocol portion and said IPsec portion are separate portions.
13. The communication device of claim 10 , further comprising a transmitter portion operable to transmit wireless signals or wireline signals.
14. The communication device of claim 13 , wherein said transmitter portion is further operable to transmit wireless public switched telephone network signals or wireline public switched telephone network signals.
15. The communication device of claim 14 , wherein said transmitter portion is further operable to transmit wireless broadband Internet access signals or wireline broadband Internet access signals.
16. The communication device of claim 13 , wherein said transmitter portion is further operable to transmit wireless broadband Internet access signals or wireline broadband Internet access signals.
17. A non-transitory device readable media for use with a first device for communicating with a second
communication device, the device readable media having device-readable instructions stored thereon, the device-readable instructions being capable of instructing the first device to:
establish a phase 1 security association between the first communication device and the second communication device, the phase 1 security association having a phase 1 security association timer corresponding to a time value of the phase 1 security association; and
establish a phase 2 security association between the first communication device and the second communication device, the phase 2 security association having a soft phase 2 security association timer and a hard phase 2 security association timer, the soft phase 2 security association timer corresponding to a time value of a soft phase 2 security association, the hard phase 2 security association timer corresponding to a time value of a hard phase 2 security association, wherein the time value of the soft phase 2 security association is less than the time value of the hard phase 2 security association, and wherein the time value of the phase 1 security association is derived from the time value of the soft phase 2 security association such that the time value of the phase 1 security association is to be an integer multiple of the time value of the soft phase 2 security association.
18. The non-transitory device readable media of claim 17 , wherein the device-readable instructions being capable of instructing the first device to establish a phase 1 security association between the first communication device and the second communication device comprises device-readable instructions being capable of instructing the first device to:
initiate the phase 1 security association between the first communication device and the second communication device; and
complete the phase 1 security association between the first communication device and the second communication device.
19. The non-transitory device readable media of claim 18 , wherein the device-readable instructions being capable of instructing the first device to establish a phase 2 security association between the first communication device and the second communication device comprises device-readable instructions being capable of instructing the first device to:
initiate the phase 2 security association between the first communication device and the second communication device; and
complete the phase 2 security association between the first communication device and the second communication device.
20. The non-transitory device readable media of claim 19 , further comprises device-readable instructions being capable of instructing the first device to:
establish a communication link between the first communication device and the second communication device; and
exchange information between the first communication device and the second communication device over the established communication link, wherein the device-readable instructions being capable of instructing the first device to complete the phase 2 security association between the first communication device and the second communication device after completing the phase 1 security association between the first communication device and the second communication device, and wherein the device-readable instructions being capable of instructing the first device to establish a communication link between the first communication device and the second communication device after completing the phase 2 security association between the first communication device and the second communication device.
21. The non-transitory device readable media of claim 20 , further comprises device-readable instructions being capable of instructing the first device to end the established communication link.