Method and system for reducing packet overhead for an LTE architecture while securing traffic in an unsecured environment
View Patent ↗A first packet is received at a network element from an E-UTRAN Node B (eNB) of an E-UTRAN access network via a secured communications tunnel of a secured connection, where the first packet encapsulates a second packet therein. It is determined whether the network element serves both a security gateway functionality and a serving gateway functionality of a core packet network based on the first packet and the second packet. The network element negotiates with the eNB to switch further communications from a tunnel mode to a transport mode of the secured connection if it is determined that the network element serves both the security gateway functionality and the serving gateway functionality. Thereafter, the network element exchanges further packets with the eNB via the transport mode of the secured connection after the eNB switches from the tunnel mode to the transport mode.
1. A machine-implemented method for optimizing packet process overhead while securing traffic in a packet network performed within a network element, the method comprising:
receiving, at a network element, a first packet from an evolved universal mobile telecommunications system (UMTS) terrestrial radio access network (RAN) (E-UTRAN) Node B (eNB) of an E-UTRAN access network via a secured communications tunnel of a secured connection, the first packet encapsulating a second packet therein;
determining at the network element whether the network element serves both a security gateway functionality and a serving gateway functionality of a core packet network based on the first packet and the second packet;
negotiating with the eNB to switch further communications from a tunnel mode to a transport mode of the secured connection if a determination is made that the network element serves both the security gateway functionality and the serving gateway functionality; and
exchanging further packets with the eNB via the transport mode of the secured connection after the eNB switches from the tunnel mode to the transport mode.
2. The method of claim 1 , wherein during the tunnel mode, the second packet is entirely encapsulated within the first packet using an Internet protocol security (IPsec) compatible encapsulating security payload (ESP) method.
3. The method of claim 2 , further comprising:
performing a corresponding ESP method to decrypt the first packet to reveal the second packet from the first packet;
comparing a first destination IP address of a first IP header of the first packet with a second destination IP address of a second IP header of the second packet; and
signaling that the network element serves both a security gateway functionality and a serving gateway functionality if the first destination IP address and the second destination IP address are identical.
4. The method of claim 3 , wherein the first destination IP address is associated with the network element, and wherein the second destination IP address is associated with the network element or a serving gateway of the core packet network.
5. The method of claim 3 , wherein exchanging further packets with the eNB comprises receiving a third packet from the eNB via an IPsec transport mode, wherein the third packet includes a third IP header identical to the second IP header without encapsulating another IP header therein.
6. The method of claim 3 , further comprising:
performing a general packet radio service (GPRS) tunnel protocol (GTP) process on a payload of the second packet; and
transmitting a result of the GTP process to a packet data network (PDN) gateway of the core packet network.
7. The method of claim 1 , wherein the network element is located at an edge of the core packet network interfacing one or more eNBs with the core packet network.
8. A network element, comprising:
a processor; and
a memory coupled to the processor storing instructions, which when executed from the memory, cause the processor to execute in the memory:
a security unit to receive a first packet from an evolved universal mobile telecommunications system (UMTS) terrestrial radio access network (RAN) (E-UTRAN) Node B (eNB) of an E-UTRAN access network via a secured communications tunnel of a secured connection, the first packet encapsulating a second packet therein;
a packet analyzer coupled to the security unit to determine at the network element whether the network element serves both a security gateway functionality and a serving gateway functionality of a core packet network based on the first packet and the second packet; and
a routing logic coupled to the security unit and the packet analyzer to negotiate with the eNB to switch further communications from a tunnel mode to a transport mode of the secured connection if it is determined that the network element serves both the security gateway functionality and the serving gateway functionality, wherein the routing logic exchanges further packets with the eNB via the transport mode of the secured connection after the eNB switches from the tunnel mode to the transport mode.
9. The network element of claim 8 , wherein during the tunnel mode, the second packet is entirely encapsulated within the first packet using an Internet protocol security (IPsec) compatible encapsulating security payload (ESP) method.
10. The network element of claim 9 , wherein the processor further executes in the memory a security unit to perform a corresponding ESP method to decrypt the first packet to reveal the second packet from the first packet, wherein the packet analyzer compares a first destination IP address of a first IP header of the first packet with a second destination IP address of a second IP header of the second packet, and wherein the packet analyzer indicates that the network element serves both a security gateway functionality and a serving gateway functionality if the first destination IP address and the second destination IP address are identical.
11. The network element of claim 10 , wherein the first destination IP address is associated with the network element, and wherein the second destination IP address is associated with the network element or a serving gateway of the core packet network.
12. The network element of claim 10 , wherein exchanging further packets with the eNB comprises receiving a third packet from the eNB via an IPsec transport mode, wherein the third packet includes a third IP header identical to the second IP header without encapsulating another IP header therein.
13. The network element of claim 10 , wherein the processor further executes in the memory a GTP unit to perform a general packet radio service (GPRS) tunnel protocol (GTP) process on a payload of the second packet and to transmit a result of the GTP process to a packet data network (PDN) gateway of the core packet network.
14. The network element of claim 8 , wherein the network element is located at an edge of the core packet network interfacing one or more eNBs with the core packet network.
15. A non-transitory machine-readable storage medium having instructions stored therein, which when executed by a machine, cause a machine to perform a method for optimizing packet process overhead while securing traffic in a packet network performed within a network element, the method comprising:
receiving, at a network element, a first packet from an evolved universal mobile telecommunications system (UMTS) terrestrial radio access network (RAN) (E-UTRAN) Node B (eNB) of an E-UTRAN access network via a secured communications tunnel of a secured connection, the first packet encapsulating a second packet therein;
determining at the network element whether the network element serves both a security gateway functionality and a serving gateway functionality of a core packet network based on the first packet and the second packet;
negotiating with the eNB to switch further communications from a tunnel mode to a transport mode of the secured connection if it is determined that the network element serves both the security gateway functionality and the serving gateway functionality; and
exchanging further packets with the eNB via the transport mode of the secured connection after the eNB switches from the tunnel mode to the transport mode.
16. The non-transitory machine-readable storage medium of claim 15 , wherein during the tunnel mode, the second packet is entirely encapsulated within the first packet using an Internet protocol security (IPsec) compatible encapsulating security payload (ESP) method.
17. The non-transitory machine-readable storage medium of claim 16 , wherein the method further comprises:
performing a corresponding ESP method to decrypt the first packet to reveal the second packet from the first packet;
comparing a first destination IP address of a first IP header of the first packet with a second destination IP address of a second IP header of the second packet; and
signaling that the network element serves both a security gateway functionality and a serving gateway functionality if the first destination IP address and the second destination IP address are identical.
18. The non-transitory machine-readable storage medium of claim 17 , wherein the first destination IP address is associated with the network element, and wherein the second destination IP address is associated with the network element or a serving gateway of the core packet network.
19. The non-transitory machine-readable storage medium of claim 17 , wherein exchanging further packets with the eNB comprises receiving a third packet from the eNB via an IPsec transport mode, wherein the third packet includes a third IP header identical to the second IP header without encapsulating another IP header therein.
20. The non-transitory machine-readable storage medium of claim 17 , wherein the method further comprises:
performing a general packet radio service (GPRS) tunnel protocol (GTP) process on a payload of the second packet; and
transmitting a result of the GTP process to a packet data network (PDN) gateway of the core packet network.
21. The non-transitory machine-readable storage medium of claim 15 , wherein the network element is located at an edge of the core packet network interfacing one or more eNBs with the core packet network.