Enhancing IPSEC performance and security against eavesdropping

1. A network element (NE) comprising:

a memory device configured to store instructions; and

a processor configured to execute the instructions by:

dividing a first plurality of data packets of a unidirectional data flow into a first plurality of unidirectional sub-flows;

assigning each sub-flow of the data flow to a different parallel sub-security association (SA) of a first Internet Protocol Security (IPsec) security association (SA) cluster; and

causing the first plurality of sub-flows to be transmitted to a second NE across a network via a plurality of IPsec tunnels, each IPsec tunnel being associated with a different sub-SA and transporting a different sub-flow of the data flow.

2. The NE of claim 1 , wherein a first of the sub-SAs traverses a different network path than a second of the sub-SAs.

3. The NE of claim 1 , wherein a first of the sub-SAs traverses a common network path with a second of the sub-SAs.

4. The NE of claim 1 , wherein the sub-SAs are not nested.

5. The NE of claim 1 , wherein the data packets of the data flow are distributed between the first plurality of sub-SAs by using a selection algorithm.

6. The NE of claim 5 , wherein the selection algorithm comprises a round robin selection algorithm, a random selection algorithm, or combinations thereof.

7. The NE of claim 1 , wherein each of the plurality of sub-SAs comprises a Security Parameter Index (SPI), and wherein each sub-SA SPI comprises a different value than each other sub-SA SPI.

8. The NE of claim 1 , wherein the processor is further configured to receive a second plurality of sub-flows from the second NE via a second IPsec SA cluster.

9. The NE of claim 8 , wherein the second plurality of sub-flows comprise a second plurality of data packets, and wherein the processor is further configured to execute the instructions by performing an anti-replay function on the second plurality of data packets by using an anti-replay bitmap.

10. The NE of claim 1 , wherein the first plurality of data packets each comprise a sequence number, and wherein the sequence number is determined based on the sub-flow with which a data packet is associated and not determined based on the data flow.

11. A network element (NE) comprising:

a processor configured to:

create an Internet Protocol Security (IPsec) Security Association (SA) cluster comprising a first plurality of unidirectional sub-SAs between the NE and a second NE using an internet key exchange (IKE) or an IKE version 2 (IKEv2);

divide a plurality of data packets of a unidirectional data flow into a first plurality of unidirectional sub-flows; and

assign each sub-flow of the data flow to a different sub-SA of the first plurality of sub-SAs of the SA cluster; and

a memory coupled to the processor, the memory comprising a SA database (SAD) configured to store a Security Parameter Index (SPI) for each sub-SA of the SA cluster to correlate encryption keys with each sub-SA.

12. The NE of claim 11 , wherein the processor is further configured to use the first sub-SAs to transmit a first plurality of data packets to the second NE via a network during a communication session.

13. The NE of claim 12 , wherein the processor is further configured to receive a second plurality of data packets from the second NE via the network during the communication session, and wherein the second plurality of data packets are received via a second IPsec SA cluster comprising a second plurality of sub-SAs.

14. The NE of claim 13 , wherein the second plurality of sub-SAs are unidirectional, wherein the second sub-SAs are configured to transport data packets in a common direction, and wherein the second sub-SAs are configured to transport data packets in an opposite direction of the first sub-SAs.

15. The NE of claim 13 , wherein a lookup of the first sub-SAs in a database is performed in parallel, a sequence number of the first plurality of data packets is generated in parallel, an anti-replay check of the second plurality of data packets is performed in parallel, or combinations thereof.

16. The NE of claim 11 , wherein the processor is further configured to create the SA cluster by processing an saCount attribute, and wherein a value associated with the saCount attribute indicates a quantity of first sub-SAs in the SA cluster.

17. The NE of claim 11 , wherein the processor is further configured to create the SA cluster by processing a selectSA attribute, and wherein a value associated with the selectSA attribute indicates a selection algorithm for selecting a sub-SA for transmission of a sub-flow associated with the first plurality of data packets.

18. A method implemented in a first security gateway, the method comprising:

setting up multiple Internet Protocol Security (IPsec) Security Association (SA) sub-tunnels with a second security gateway;

clustering the SA sub-tunnels together to form an SA cluster;

receiving a unidirectional data flow from a first host;

dividing packets from the unidirectional data flow into a plurality of unidirectional sub-flows;

assigning each sub-flow of the data flow to a different SA sub-tunnel of the SA cluster; and

transmitting the sub-flows toward a second host via the SA sub-tunnels of the SA cluster and via the second security gateway.

19. The method of claim 18 , wherein the sub-tunnels are setup independently, and wherein the sub-tunnels are added to the SA cluster one by one.

20. The method of claim 19 , further comprising splitting or alternating IPsec traffic through the subtunnels.

21. The method of claim 20 , wherein the SA cluster does not comprise a lifetime.

22. The method of claim 21 , wherein the sub-tunnels use a shared anti-replay bitmap at a receiving entity.

23. The method of claim 21 , wherein the SA sub-tunnels each use a separate anti-replay bitmap.