Methods, systems, and computer readable media for performing encapsulating security payload (ESP) rehashing
View Patent ↗Methods, systems, and computer readable media for accelerating stateless IPsec traffic generation by performing ESP rehashing of ESP packets are disclosed. A first ESP packet is generated by encrypting a portion of the packet and adding ESP headers and trailers to the encrypted portion, hashing the encrypted portion and the ESP header to compute a first ESP integrity check value (ICV), and adding the ESP ICV as a trailer to the ESP packet. At least one second ESP packet is generated by modifying parameters in the first ESP packet. The first and second ESP packets are transmitted to a device under test.
1. A method for accelerating stateless Internet protocol security (IPsec) traffic generation by performing encapsulating security payload (ESP) rehashing of ESP packets, the method comprising:
generating a first ESP packet by encrypting a portion of the packet and adding an ESP header and an ESP trailer to the encrypted portion, hashing the encrypted portion and the ESP header to compute a first ESP integrity check value (ICV), and adding the first ESP ICV as a trailer to the ESP packet;
performing rehashing of the first ESP packet to generate at least one second ESP packet whereby the encrypted portion of the first ESP packet is used in the at least one second ESP packet without decrypting and re-encrypting the encrypted portion of the first ESP packet, wherein performing rehashing of the first ESP packet includes generating the at least one second ESP packet by modifying at least one parameter in the ESP header of the first ESP packet, hashing the modified ESP header and the encrypted portion of the first ESP packet to compute a second ESP ICV for the at least one second ESP packet, and replacing the first ESP ICV with the second ESP ICV in the at least one second ESP packet; and
transmitting the first and the at least one second ESP packets to a device under test to test an aspect of the device under test.
2. The method of claim 1 wherein generating the first and the at least one second ESP packets includes one of generating a random initialization vector (IV) for each of the ESP packets and reusing the same IV for each of the ESP packets.
3. The method of claim 1 comprising dynamically adjusting a number of the at least one second ESP packets generated using the encrypted portion from the first ESP packet according to operator-configurable criteria.
4. The method of claim 1 wherein modifying at least one parameter in the ESP header includes incrementing the sequence number.
5. A packet traffic generator for accelerating stateless Internet protocol security (IPsec) traffic generation by performing encapsulating security payload (ESP) rehashing of ESP packets, the packet traffic generator comprising:
an ESP packet generation module that generates a first ESP packet by encrypting a portion of the packet and adding an ESP header and an ESP trailer to the encrypted portion, hashing the encrypted portion and the ESP header to compute a first ESP integrity check value (ICV), and adding the first ESP ICV as a trailer to the ESP packet;
an ESP rehashing module that performs rehashing of the first ESP packet to generate at least one second ESP packet whereby the encrypted portion of the first ESP packet is used in the at least one second ESP packet without decrypting and re-encrypting the encrypted portion of the first ESP packet, wherein performing rehashing of the first ESP packet includes generating the at least one second ESP packet by modifying at least one parameter in the ESP header of the first ESP packet, hashing the modified ESP header and the encrypted portion of the first ESP packet to compute a second ESP ICV for the at least one second ESP packet, and replacing the first ICV with the second ICV in the at least one second ESP packet; and
an output buffer that transmits the first and the at least one second ESP packets to a device under test to test an aspect of the device under test.
6. The packet traffic generator of claim 5 comprising an initialization vector (IV) module that generates a random IV for each of the ESP packets and reusing the same IV for each of the ESP packets.
7. The packet traffic generator of claim 6 wherein the ESP rehashing module dynamically adjusts a number of the at least one second ESP packets generated using the encrypted portion from the first ESP packet according to operator-configurable criteria.
8. The packet traffic generator of claim 6 wherein the ESP rehashing module increments the sequence number.
9. A non-transitory computer readable medium having stored computer executable instructions that when executed by a processor of a computer cause the computer to perform steps comprising:
generating a first encapsulating security payload (ESP) packet by encrypting a portion of the packet and adding an ESP header and an ESP trailer to the encrypted portion, hashing the encrypted portion and the ESP header to compute a first ESP integrity check value (ICV), and adding the first ESP ICV as a trailer to the ESP packet; performing rehashing of the first ESP packet to generate at least one second ESP packet whereby the encrypted portion of the first ESP packet is used in the at least one second ESP packet without decrypting and re-encrypting the encrypted portion of the first ESP packet, wherein performing rehashing of the first ESP packet includes generating the at least one second ESP packet by modifying at least one parameter in the ESP header of the first ESP packet, hashing the modified ESP header and the encrypted portion of the first ESP packet to compute a second ESP ICV for the at least one second ESP packet, and replacing the first ESP ICV with the second ESP ICV in the at least one second ESP packet; and
transmitting the first and the at least one second ESP packets to a device under test to test an aspect of the device under test.
10. The non-transitory computer readable medium of claim 9 wherein generating the first and the at least one second ESP packets includes one of generating a random initialization vector (IV) for each of the ESP packets and reusing the same IV for each of the ESP packets.
11. The non-transitory computer readable medium of claim 9 comprising dynamically adjusting a number of the at least one second ESP packets generated using the encrypted portion from the first ESP packet according to operator-configurable criteria.
12. The non-transitory computer readable medium of claim 9 wherein modifying at least one parameter in the ESP header includes incrementing the sequence number.